{ "Event": { "published": true, "date": "2026-03-27", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-27", "timestamp": 1774656181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "670546aa-75a1-43bd-9621-85c2ee1b2ef0", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ee2539-2973-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774570943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774570943, "uuid": "2cd31f92-dbfe-459b-b060-e5f6400ab6f7", "comment": "Malware payload (SalatStealer)", "value": "9d90464ab364023418d20d2cdf701f9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774570943, "uuid": "28e99a97-fc7e-44f2-94d8-cb38f19b3308", "comment": "Malware payload (SalatStealer)", "value": "006136a045df59840e9b97880440bfd9c2164f7c461256057d68fdf4bece064e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774570943, "uuid": "57f8d26e-d815-4211-a015-e7bd50a8b0b7", "comment": "Malware payload (SalatStealer)", "value": "c305896a67ae54e6a70ebb3962a90745e175d23f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774570943, "uuid": "fed2d15a-d560-41be-93ff-f2facf36aac8", "comment": "Malware payload (SalatStealer)", "value": "aa453e63dbc257e14c1218c3951f0e35c153eb31e99779611b56c749f9177ac54bbffe310a4c5c0ce471e86741c1c27a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774570943, "uuid": "12cfe82b-b72b-4aa0-8566-affae08e9176", "value": "T1B5F5334182195FCBE31531B37A1BB8FA9B51187884C364E1F81FA318631679EFB91B4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774570943, "uuid": "a0487848-6b7e-4d49-a323-8dc443b5a03a", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774570943, "uuid": "f3d67577-b1d6-4b7f-bbaf-087a34662b45", "value": "98304:Uy/S/8X09h1wBKrG9xHy1L1XFBWkS4XgLKtG:hKgZx9xHiLrlS4XgLKtG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774570943, "uuid": "b3b38194-70e5-4c0a-b7e2-7573954acbcc", "value": 3594240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774570943, "uuid": "0cd9fd59-ce5c-4be8-8f35-e1459be62f6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774570943, "uuid": "393a92c8-95fa-49b3-88f5-18ee5c1157a5", "value": "sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe76a96-2a21-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774645771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645771, "uuid": "341a28d0-a2ab-4ebf-8ab7-15d884ad62c6", "comment": "Malware payload", "value": "0f5a7fee8be111c83e50a27476f807f3", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "fiker-cattermicoffa-sbs", "colour": "#11C8CE", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645771, "uuid": "a4c5c777-e48b-4fa8-854e-9d14651b0856", "comment": "Malware payload", "value": "04dcb0bffd83475e3dabb1b285b6c0129053e2d6994c01cf6be459ac11616127", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "fiker-cattermicoffa-sbs", "colour": "#11C8CE", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645771, "uuid": "42af4331-6027-4339-950c-0f55a9fd4cd9", "comment": "Malware payload", "value": "4f6b309a825fa2e15ce8e796e2c063235e7fa4d3", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "fiker-cattermicoffa-sbs", "colour": "#11C8CE", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645771, "uuid": "d8b51294-1c0d-4e84-9713-adf4d6732544", "comment": "Malware payload", "value": "3fbb3dd4d1c9c0d00e676de0b07b8de82a454b64edc0238194aae25dd595b5debd39937093dbc73543b387eec4d71b5b", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "fiker-cattermicoffa-sbs", "colour": "#11C8CE", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645771, "uuid": "19d742f3-fc78-4603-a6f3-b89be337ddc7", "value": "T165373328A7ADA5E3E3FB7675B2A5001E91A1B238D573FB4B31CCD15459E33D22623306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645771, "uuid": "e2599c4c-e030-4ba5-9929-68fd1dcaf2a5", "value": "393216:O0z/n86Q+zltAfEB/m68kdziatPMJq6GGKeiVtJ+dAXODvRRnI+WhIM58xX/72HC:pDn2+zlJ+kZlBMJqjGKeKtJjXODvYThc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774645771, "uuid": "de257d83-2450-4b1c-a717-59b679018c32", "value": 23252308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774645771, "uuid": "59f0b438-3afd-4a05-8495-75b18f6c0c09", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645771, "uuid": "37a90346-341d-4794-952c-fc97e4818686", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b918e01-29d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774612237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612237, "uuid": "5d034111-41db-4909-abc2-c91eb6b11a12", "comment": "Malware payload", "value": "cfe3bc8242e0e7ff3104fd9d18fc3928", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612237, "uuid": "875fb312-3b99-4df5-9721-e4b3c5217e83", "comment": "Malware payload", "value": "0546cab5259aa90a837e86ef5921214bdc056505f1d5a2e48607357fe9e3820c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612237, "uuid": "db4608b7-3b08-491e-b752-7f7fea652bdb", "comment": "Malware payload", "value": "dfaf7ee154962040824bac289a1a068feb48c749", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612237, "uuid": "a2187338-762d-47ba-bad1-59395b05720b", "comment": "Malware payload", "value": "646a1245b7a9322b4ef6d092cbf329f57b3f51cda356adc562f6778ff0ac69cb06637a8563b89e953746b10ff6bbbf69", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612237, "uuid": "09250147-14d0-462e-a985-5e127e97b200", "value": "T150B66A137B6CEB1FC228223409F2DA946B695C9201D7A517B385F31DE9F20AC496EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612237, "uuid": "c7fa8dbc-b0ff-4677-bd6f-1841a5e53b28", "value": "196608:3p2o4mspeR4KNEzs/H9PRzDKxquMJqvnvqOFs4eJu3AFfwmZPPk/QOL97:3p2o4mspeR4KNEzsP9PRzDKxquxvnvd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612237, "uuid": "7b2d8538-4e4e-4674-97c4-b992e7a936e8", "value": 10967185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612237, "uuid": "8a47cc29-586d-49fb-bc79-0b88a546d992", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612237, "uuid": "1b57b474-dbc2-460d-9dfe-00132044bfd1", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a53000-29ef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774624469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624469, "uuid": "ab4f54fa-681d-4e06-b765-a37ef1ceed00", "comment": "Malware payload (Mirai)", "value": "64aa068afe8bb831a9389b087421fcb2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624469, "uuid": "b9cd311e-4c74-4686-9214-90705120b7eb", "comment": "Malware payload (Mirai)", "value": "05538877966b9357ca89234a9bdf23725878ae0b1fc59ada7f09e182662fd66d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624469, "uuid": "cb6ae0c0-4a65-41d9-8d8c-67911138c91d", "comment": "Malware payload (Mirai)", "value": "80905d90fd2856de243d8f2f704689eaf56dd628", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624469, "uuid": "0f503b8d-dcec-415f-8657-d737865e3e59", "comment": "Malware payload (Mirai)", "value": "3af60bb6f8e94ce1cc1cfd27f433bf407cef8d0bd9577488d0d99503290d8705f4130042288fb39fd59ef832a35dc960", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624469, "uuid": "2aa7e0bc-5f29-4a2b-8a31-930675d66ecc", "value": "T1B6B44A55B8419B92C2C06FBBFB5D834873271779D2EFB0069D1A5F642AABC1B0F76402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624469, "uuid": "63d0cf74-760f-4565-8d23-112771523ccc", "value": "12288:zaP5US0j2F1SkTNI/FN56sU9rj1t5NiaQlLgpobvbWR5oxl1V:zxSB1S1wlzYDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774624469, "uuid": "a311ab03-1f91-4e09-b10e-a99b99b4bd0f", "value": 516372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774624469, "uuid": "8c5683aa-ddd2-41c6-b31e-02c056267138", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624469, "uuid": "037f152b-4201-463a-9e77-1397e87c687a", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21279e5c-2995-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774585590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585590, "uuid": "de5707cc-9cf2-475d-b0d4-32559a453662", "comment": "Malware payload", "value": "4a33eb6fb8daec13786415ac38034034", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585590, "uuid": "8d779cda-9db8-40b8-87b4-03075e07924b", "comment": "Malware payload", "value": "05e9b542a6dfc4bf8e11730ea58ca20f5df59ac8cdb09365887e675a37b13281", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585590, "uuid": "3bc8977f-4e09-45f2-8868-5b2bac6839d5", "comment": "Malware payload", "value": "c4a0885e861789d615b4c4c0ae4b0f5a0ec346f7", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585590, "uuid": "2538af75-99ad-43d9-ae8b-d857e9c077b6", "comment": "Malware payload", "value": "0e958746e5bc9cf2a4d953b7f62a265f7db049f004a21befc34717c2233eba35fd468d62cef23ca80dd12fee4bd4ec9b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774585590, "uuid": "e372b23c-bd76-4403-b5ae-be158b09a548", "value": "T1DEF0AC0778824B1267F20EA34C32F1A2B58A404B71DD86527069C5A17A464E0E43CCDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774585590, "uuid": "8a6212af-70e7-4807-a09a-67e4aad7f5ed", "value": "12:xF04isrwLpZb8AO6l/CnrCt/6i7aIcr4MZHMJLLhaKhG3BqCzCzZ:E4ilFZFX/6i7k8TF1NhGDCzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774585590, "uuid": "8c406c67-d4a6-4a9a-821e-72079ccde7f1", "value": 571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774585590, "uuid": "80d55183-6e29-41e6-9bfb-a22fa7fef6ac", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774585590, "uuid": "bce668af-b4af-410a-95da-4f86c6bbc403", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c284f76-299c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774588642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774588642, "uuid": "76f8a2dd-b997-4cff-8c43-e5a017006d09", "comment": "Malware payload (Mirai)", "value": "44720e528b9415fc2f149219e15b0c6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774588642, "uuid": "a8ba34ea-468f-4ea3-9571-a7a44226adee", "comment": "Malware payload (Mirai)", "value": "0615077aaf41e19f27eb6830b6430a322f3c0e0b38f32db55415f24bf0921266", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774588642, "uuid": "0b575e1d-825b-4259-8247-bb4d20160c2f", "comment": "Malware payload (Mirai)", "value": "41950874540215a016b41c0947c226d5ebbf0ff7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774588642, "uuid": "0226364e-9ba6-41b4-99b1-846b921ff89d", "comment": "Malware payload (Mirai)", "value": "82fa3d34e9c3649bf52e49a6b066b744d7874e213ca12aec33e87840396e54d8ddc822cb55f199a482cfcf13191fbc6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774588642, "uuid": "4a6893f4-41d0-46d4-87e8-c1d7017f3a71", "value": "T1FE367C98FE0E3C51F3DAE37C9E4ACBA1731B39B0D32781A37E42525C85A66D5C6B1814", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774588642, "uuid": "64aaf514-b366-4fa1-8908-064d304d70b2", "value": "49152:gPdp901SERm6iWtHY3zTLzjQGq+QXUSPIAL1UO:gPH901S8vddoLjQG4EzAL1UO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774588642, "uuid": "95143c50-231d-482a-b9b7-7da9fd735da7", "value": 4957080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774588642, "uuid": "c5eedd5c-eeca-4a34-b35c-f33d0bc627bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774588642, "uuid": "7138ced5-71ce-444f-8b43-98eda906ad8f", "value": "wlan.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b45b90-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774625113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625113, "uuid": "4cadcd8b-d959-4cf9-80ad-15b14deb639b", "comment": "Malware payload (Mirai)", "value": "9f081367408abbb679cc3e1cfe7d7719", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625113, "uuid": "611ce934-8d1a-4547-8cb5-c942a8e133c0", "comment": "Malware payload (Mirai)", "value": "06f2b552bf105b8601d11a253988afe620d7391a5a4e7c43eb5f627405c30633", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625113, "uuid": "027d61bb-2152-4d95-bcfb-43bfbe89a4e0", "comment": "Malware payload (Mirai)", "value": "64c2dc4e37fb464f483d51a04002960e6c8bdad1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625113, "uuid": "6430aad1-0e89-4c6b-8deb-00009cf97e51", "comment": "Malware payload (Mirai)", "value": "3db34c4d7a24ce0be52371e41b4ffe70226a932601d1fcd4929e514887c3df21d17aeb6c82b24ffeecd5f95535dd025f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625113, "uuid": "44eaede4-c46a-441c-8991-6139dcdd7175", "value": "T11A230271850A8DB125303C36DB999393B6E11AB1C6672013D62C0B383F79B131E47E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625113, "uuid": "34dd788d-7f9b-4188-800b-6ae3ad3ae4e5", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3E9q3UELbUXfi6nVMQHI4vcGpvs:DECFd+A6YHAxtLRQZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625113, "uuid": "7d053d53-32d9-413c-b935-7db548093dc7", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625113, "uuid": "59e1b5f4-0f6a-41d4-a0d5-ab133c1da0bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625113, "uuid": "9f8fdb49-b470-4568-8178-367864fb50b5", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2616b765-2993-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774584740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774584740, "uuid": "abc4cc79-d1ed-40e1-a18e-d9033a38ebd0", "comment": "Malware payload (Mirai)", "value": "11a5368458d54c89a7f27922a05a5879", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774584740, "uuid": "f165520c-cac2-4c07-a4de-651724d1903f", "comment": "Malware payload (Mirai)", "value": "072775c801557a2198a9602922e640453b8500c32542bf8b10c54ff3e48949f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774584740, "uuid": "7d9123f0-6655-44b5-9ba8-dbf10440d208", "comment": "Malware payload (Mirai)", "value": "ceb8d3356be372b0bb71d3b670098ff25fc6f4ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774584740, "uuid": "50bb08f1-fa10-4542-8961-cbc838a8701a", "comment": "Malware payload (Mirai)", "value": "94e0090624f3ba790d942ace2db38697a590837ee6f5b0a580f0fcae30d0e786ed89cd413bd55f133790b782071e91f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774584740, "uuid": "f1e9e492-97e3-4b98-91ec-8ff6143aa7d5", "value": "T18DE53A62FC91CA52CBC067BABB5DC2DC73135B75D2DF31068D14833436ABA5A0A3B652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774584740, "uuid": "3bb25ea2-aa4a-4f05-a96a-a0278fb7de4e", "value": "49152:AuaWhhnTTy2UNqNWNR5Udtmiqq3N9+tjx3klP0:AuaWnTT2NqNqAd4cNqN3kS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774584740, "uuid": "26c1a298-eec7-49a6-964d-96a6ebdacf86", "value": 3253680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774584740, "uuid": "c1a3c00c-6a56-4e36-a029-8dc370c1abb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774584740, "uuid": "b6c80f0e-654a-43bd-9d85-821a6610a8bf", "value": "wlan.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3837913-29b2-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1774598399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598399, "uuid": "e5f34682-d143-46e4-8dc1-3833b5516b97", "comment": "Malware payload (GuLoader)", "value": "c6dd27911d268408966e7e9e954fcf75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598399, "uuid": "1942c2b6-c435-4c0e-b369-988af40e08b6", "comment": "Malware payload (GuLoader)", "value": "072d6dfc5ad637c6220f86c169e62deeb8fcac13a3e5eeb9d548c4bda3c5cbc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598399, "uuid": "57f65b93-be60-46eb-8e2c-14a2e6196acf", "comment": "Malware payload (GuLoader)", "value": "e98e3b7e14eaa1ab374c8dc936c8180a66c34978", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598399, "uuid": "5b96f86c-3a4c-4233-ad3b-a962b378c5c7", "comment": "Malware payload (GuLoader)", "value": "3538b913688466891be2795f04c22e42fc0d83ed0f92d581f66970303c767f5e1efb714a9271b4e02fb0f2992d086424", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774598399, "uuid": "51c5a5f4-bc4e-48fa-8b64-cba96fc4c241", "value": "T1E1A4E143330885F1DC769B32E42691692A3848FE52D8264B3BEC679E3D71B510D1FB7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774598399, "uuid": "e5f5870b-aa71-439b-a516-c07d74973e2b", "value": "e2f3f8ec66b7e1900c37978aca89d3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774598399, "uuid": "e93ef52b-fe0c-446a-9613-3a0c3aeb936d", "value": "6144:ZMBaOmEYWswbLTHw9qDKrwZjdz4kwsGvld38/FMGBfT1VLaV2:moLwPbwqDKrgjdzLwhteNBLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774598399, "uuid": "73b9ec01-9063-471a-99d1-81d282bb2c66", "value": 456400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774598399, "uuid": "e7b62fa1-2375-496c-88c7-bacae319b0a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774598399, "uuid": "c02815ca-ee42-4595-bbd1-c050d35850cd", "value": "PO 17825.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec3d309-29a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774592190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774592190, "uuid": "214c898f-9d8c-4783-854e-fb9cd885a53f", "comment": "Malware payload", "value": "e2470b4bb66131ac43a0e7d30bb30ede", "object_relation": "md5", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774592190, "uuid": "93d0f1f9-f193-42cc-9099-418a10042273", "comment": "Malware payload", "value": "07cd03e2082bcb0b890cc59ce4c770d1a095ac6f1ae9cf999f5542555c56f841", "object_relation": "sha256", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774592190, "uuid": "af7a8abc-37a4-4868-9582-491dc9ef635d", "comment": "Malware payload", "value": "4f2c2a808194d27992ef227c4b9134de01d051fc", "object_relation": "sha1", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774592190, "uuid": "e5f03d6b-2355-4cb0-a296-34e8cf369617", "comment": "Malware payload", "value": "525540e4407ad62d908512b6108dcb0962ec9bc2c2039e5180d2632efb8d30016628b2a2ca1858d39f3196794d8d5108", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774592190, "uuid": "df91e5e4-8bfe-40e3-a8d1-12a96397f511", "value": "T13F65FA0BB6C5CAF5C05D1732D49B081C0BA1A3421623FB0AF9B6139E5D537F66B4A68F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774592190, "uuid": "0b900cc5-1167-4be0-8957-32463cec11cb", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774592190, "uuid": "2d45aea2-c28e-4fb2-89a0-dda786105c2b", "value": "12288:um7NqcLZaP4MWymcMkUitzeCtOObNMZ8LR0b0rJ6sb/Shgh5/91snhNGV4vaZP:u+Nq4QFmCJUOb3R+0c4igh5l1snm4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774592190, "uuid": "c758e133-59b4-4dbc-b88e-3a993044d72c", "value": 1533440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774592190, "uuid": "f7f610dd-505d-40ee-8e8e-856f135a48e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774592190, "uuid": "cb1d0f66-f51f-4e42-948a-34399c4675eb", "value": "07cd03e2082bcb0b890cc59ce4c770d1a095ac6f1ae9cf999f5542555c56f841", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0595bc-29b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774597718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597718, "uuid": "b5497140-6a9f-43d3-b5ab-f75dc3c30099", "comment": "Malware payload (Mirai)", "value": "54d3ad35a6410efb1d8d154c0f966231", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597718, "uuid": "c735c9f4-4a62-430a-8018-7ba41852f323", "comment": "Malware payload (Mirai)", "value": "08c1b3b4c36ddbdf8013a91756f3e5816b9f2ef5e57f0e28634fb62bdf44f4a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597718, "uuid": "f416ba47-4393-4fbf-9466-06913cd7a476", "comment": "Malware payload (Mirai)", "value": "02fde128189a89f0c8684fd637cf28737dc5b805", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597718, "uuid": "6891a26c-e15b-4ad7-a420-fe562d3efc38", "comment": "Malware payload (Mirai)", "value": "759150eec0b4a1ee5657cfaa73a1ac4d5785b842909ea17f479b4a9165affc6f61ebeb6cd947b168a6d70c10fcda4591", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597718, "uuid": "2aa03bb4-a070-4127-8554-88ba4e9e0318", "value": "T177465C1AB2B314ADC15AC430836FDA236D35B85542317D7F2684AE742EB6E705B2EF31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597718, "uuid": "b9a77f47-f0c8-428c-a67e-325aff0c35b6", "value": "98304:mMT1f8UY2oeL6V5SZl1ugvu7m/+ErBeqWRE+g5pDMbyC:mlg/heq7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774597718, "uuid": "6f3bbaab-e77c-4650-a966-25ac5df25af1", "value": 5669928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774597718, "uuid": "3e39bade-0775-4d31-9abb-104f00147ca1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597718, "uuid": "9c690eef-bae3-48d5-acf0-47efc5c88804", "value": "wlan.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac069161-2a21-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774645953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645953, "uuid": "50c5db84-a883-4b1d-953f-bbf54706b493", "comment": "Malware payload", "value": "b1b529914fa2cf94cca36825cb44f685", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "fiker-cattermicoffa-sbs", "colour": "#11C8CE", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645953, "uuid": "6749983f-bb4c-450e-aafa-8482c85b0006", "comment": "Malware payload", "value": "090348d561eca62352f6a5e129fdcdf81ba1cbdcf45b9fa86f16c77d8aaa0f25", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "fiker-cattermicoffa-sbs", "colour": "#11C8CE", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645953, "uuid": "8b2d106e-a365-46cb-b96d-20376f725797", "comment": "Malware payload", "value": "e302adfdb9be0fd09909e060159f7cf1a6e3e090", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "fiker-cattermicoffa-sbs", "colour": "#11C8CE", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645953, "uuid": "a87a934d-d656-4fa8-a730-4a4fae8afb6c", "comment": "Malware payload", "value": "5fefdb720a233a369e4f6e67ea6d253fd7449d6cee0cb77161bc0c0400ec5152c32e2641475bea1fc65bdb9907708096", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "fiker-cattermicoffa-sbs", "colour": "#11C8CE", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645953, "uuid": "0afcc791-45bf-4fa2-91a1-000da78ca190", "value": "T195B6BF10EA41E06AD85721B1612F67796D3C6E511B2488C3E1F4BCE82BB35F317B636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645953, "uuid": "7d925008-473c-4747-99d3-a1617831e638", "value": "77269cae0968bddaaee2b7ffb668a92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645953, "uuid": "8c22e491-707c-4014-b6d3-0c68ededfda4", "value": "98304:O0u51GxhiehH7MZcniemsYXDHMknHkF51O64mM5RpeDJ1UTLgdhKf9Ze9AKtPNbD:OtPIUZuYTHMQkF519M5He8gef9ZDkHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774645953, "uuid": "b851250d-1ac0-4578-ad01-028a3b04de6c", "value": 11236864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774645953, "uuid": "a30ff541-513f-4fc2-a2bc-5415ebbfe328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645953, "uuid": "c3ef7a5c-bd68-42fb-a195-bd192d43068c", "value": "python314.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee9f072-29f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774626657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626657, "uuid": "2834db23-61f9-4a4d-9114-1f47247285b4", "comment": "Malware payload (Gafgyt)", "value": "77cbebc2ef2c6243db4e97b27790c252", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626657, "uuid": "7f6b2a98-799d-4cbe-b0a5-5a7ae8379e56", "comment": "Malware payload (Gafgyt)", "value": "094cb6cc0932332d62ce091199faf6d0d037a5d7485cd65dc4e982bf2b167f7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626657, "uuid": "34cd54b3-555d-4776-9cfe-a6ed55e488ce", "comment": "Malware payload (Gafgyt)", "value": "8004aae08238512a48025eb57df8c45dd821d4ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626657, "uuid": "1327dde4-f236-417e-85dd-24d89abb6884", "comment": "Malware payload (Gafgyt)", "value": "17b297fd40ccb481d2522e986d5ee6ff865fb8564dac7b8190edb5c05d87c97b13c03437b93acb0efc8c4ca9867017c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626657, "uuid": "6a58dd7a-dfdb-408c-841e-89475c949d2d", "value": "T101C35BA3DC666FACD219D1B0B0B48F792B63996046871FBE156BC3B48043D8DF5067B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626657, "uuid": "fc4b0a49-d73a-4094-b141-bee0d0dcca10", "value": "1536:XXbf5lFvY42ze3/CQKFKG26AoqnI26ZW28v8D17dbjYYw:7TFvgze3/SFhqIhZWdv8xNjYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774626657, "uuid": "53004c17-8639-4a36-b441-c00050d445c9", "value": 119184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774626657, "uuid": "80330987-9f80-4a7d-a0a4-d7f9de39e5f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626657, "uuid": "8a799269-0a62-4fc9-8a4d-d7ea97b80012", "value": "udevdpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467b2c13-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774596390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596390, "uuid": "262dd35c-0143-4537-aa60-5d8c057211bc", "comment": "Malware payload (Mirai)", "value": "878e676bf5cc6deb40825ea69d31ff74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596390, "uuid": "c34b031f-3cd2-45f5-bb26-a1f9034c017d", "comment": "Malware payload (Mirai)", "value": "0a9f2c061a03e064b880c07917afbc71956c310fea1c95c307d80672c6fa2bcb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596390, "uuid": "d69f0be1-ef2a-4904-aa13-41d540eac238", "comment": "Malware payload (Mirai)", "value": "ad141078c699fd1eee06827bfcb3b047be984fdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596390, "uuid": "e8b11676-574c-4a22-9e49-dd17616949ba", "comment": "Malware payload (Mirai)", "value": "6cc97fb7e770c18d29d63f17a59a3e779b6704986759006eb55f44210d2b5d9483396191209977a165456205f7e5a988", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596390, "uuid": "1edd30ce-d040-4284-ae48-6bb7cbee5975", "value": "T192145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596390, "uuid": "0ae08266-0322-43f2-a4de-5ed40d0a3747", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NXRUaN:HZ15BTYCrYq1QDY6S4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596390, "uuid": "9373c25d-e171-4f71-8b40-283ee9e837d7", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596390, "uuid": "d9622229-9bdc-411e-becf-6e2c9632df78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596390, "uuid": "1b5883a2-221c-4d1c-9235-429f5a4c9b9d", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4bb735-298d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774582304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774582304, "uuid": "123abc40-c21f-41bf-9dee-a6d6de2f2d26", "comment": "Malware payload", "value": "b09246e2200b94cb3dd82d86389fc4a6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774582304, "uuid": "5b889959-190f-45eb-84ba-0f3a53fe1e9c", "comment": "Malware payload", "value": "0b4c4039cc81d5f78fa7265720c4e6ae370303fb9f5d0cda97c74953576f458d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774582304, "uuid": "3ea3f7a5-8f31-4934-92cb-32336147f714", "comment": "Malware payload", "value": "c9a9d35566f34e2e31f44cb376e035ee85fb57a1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774582304, "uuid": "846a1c4e-c511-4afe-ac40-8febaabe3674", "comment": "Malware payload", "value": "0d34588004ea2f775fe7d4f9b74dc457359aef5752449508f8c73ed0381892ac2b4c39c20c64216084c1601445969f06", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774582304, "uuid": "0df34739-b99b-4ddc-824a-8eddabdf6d4a", "value": "T166925BB916096C79BBC0DE7D8F3C7F0CADE481C02119A3ACBA4F39714A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774582304, "uuid": "bbe2c956-0186-4fe4-86b5-ffc86d28cb84", "value": "384:xn0M3vgRjGlsaq7qzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:xDmjfezsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774582304, "uuid": "13432c7c-81f7-46af-b3a3-3ed4a50775df", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774582304, "uuid": "764b393a-5e9b-43fd-b969-0a6c4fa421b3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774582304, "uuid": "4d553b30-49d3-4dfd-a7c9-511b7ccc242e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95e8949-2a29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774649465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774649465, "uuid": "82f5e999-a97c-4940-a7e5-e71720481d18", "comment": "Malware payload (Mirai)", "value": "15ad1c917f573c5911995d6781a7db81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774649465, "uuid": "0bae04ac-fab1-4f56-9cb7-e40d016b0950", "comment": "Malware payload (Mirai)", "value": "0ba78d70d0dd96d14a2a0baaeecec89b5a6c1e3ac5bc6c5996b55efe3e37eb35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774649465, "uuid": "173947a6-1ed8-4690-8d59-9b131315de16", "comment": "Malware payload (Mirai)", "value": "2270927b47cbaf12d5f640c91fb62091910c28fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774649465, "uuid": "4b602749-3326-4e49-941f-cc0de71c7844", "comment": "Malware payload (Mirai)", "value": "a86a0cf8add60b36ab1299db28b5c4d701f37ca2821322cccbc0865974aaa9e1e26ec2c16d7f25c1450c72b45b4b6324", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774649465, "uuid": "688307e0-1846-4777-b26a-018919343e1b", "value": "T12EE35C46FA808F13C4D5277ABAAF42493322A764D3DB73068D189FB43F86B9E0D63515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774649465, "uuid": "69b00b07-279e-49f6-a55f-f647d3fa0586", "value": "3072:vSziFXtZ8QT0u9t6yUsh/2x9ytp0qS/KaM/9Z9sIl3:vSzKZHT00hUsh/2xgt1S/7M/9Z9sIl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774649465, "uuid": "a0d26636-4371-4f72-b00e-bc3f1a9d7fa2", "value": 148397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774649465, "uuid": "ea2d6e19-d2cf-41fc-8b46-4deef33728ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774649465, "uuid": "de4c29ad-7239-408b-83a1-146d88677be0", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aeda499-29b3-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1774598599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598599, "uuid": "bedf08a2-1d16-4ddd-ac8a-a00c9d79e0ff", "comment": "Malware payload (VIPKeylogger)", "value": "a5fae6dba4fe7a53427a3c2ac5fb94b7", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598599, "uuid": "b738ce9b-afbc-4e71-b0af-796bfd9dead2", "comment": "Malware payload (VIPKeylogger)", "value": "0be7cfe55f250b4503eaddc969fcc9b9c81d6a29cba5e7f55fae47dc1279d5fe", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598599, "uuid": "a73d706d-688f-47a0-8ef3-e309ccffe58f", "comment": "Malware payload (VIPKeylogger)", "value": "b0d451d7ff6933aa61d495d581479b5fa9c7eade", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598599, "uuid": "cdc4edf9-0a6f-4978-a509-0de5104cd9ec", "comment": "Malware payload (VIPKeylogger)", "value": "423e381d648fa64b8e77d88184af94e09450c9343c053d978439c4a289a413b4312294d9425d546185133371ae6c0964", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774598599, "uuid": "2fb534a2-1c6f-4ffc-addd-3a067a6b0f53", "value": "T190F3F225C9CC1FB58E9A5E1890BE261A67F04ACB543B5AC9FF737F4A9FA7240040B0D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774598599, "uuid": "4747698c-247e-42aa-a9c4-6ad4a8998e40", "value": "3072:zqt14HbF1xLUNC598c4ad5b6wStYPOdDkb672IOgTqeXodD20YeN4M:01qbFoNCUMdQw2d0u2tmXoTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774598599, "uuid": "da8bac70-536e-421d-867d-bb9d1774e35f", "value": 164654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774598599, "uuid": "ffcdf92e-3aa2-4752-a8c6-4d98066082d1", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774598599, "uuid": "a1162d2b-d179-4890-9dfb-f18c52a86d2f", "value": "RFQ-TLQ-520 # 2600260001.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66bf4d23-29b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774597733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597733, "uuid": "3b75da99-89f5-44c2-b29e-fb262a6e135f", "comment": "Malware payload (Gafgyt)", "value": "9d405c9278c59c346f59e7f259ff76a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597733, "uuid": "9302848f-babb-4c57-9c88-a864b7684c9a", "comment": "Malware payload (Gafgyt)", "value": "0dc4d8932b1319965f4639567680d3a1d5f6fd772ae5f154ca6ef1a4b01038d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597733, "uuid": "400b8d90-49b3-46b4-b14a-6999c6a06104", "comment": "Malware payload (Gafgyt)", "value": "2fb085fec16baaf0f9b9da7b518221a9f0190da2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597733, "uuid": "0dfca268-6386-4594-a0cb-a2e57ceff41e", "comment": "Malware payload (Gafgyt)", "value": "829a58c7b40cec12c35fd6953a0ba273b73463e0e3e3f83b3dabaceaacfae45a0750d03e90e59f04be470f65db893d89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597733, "uuid": "1d66ad02-8628-4318-95e2-f7d7757eca70", "value": "T179E31A077AC2C9FFC4D7D1F44BE7A5369D36F82E0935715A63A4BE921B49ED02A18320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597733, "uuid": "fb973ae4-979a-4af8-b391-981eef9439e9", "value": "3072:bG+sAOnp3Lq2SKN1eR61Dq+3HrnyMtn6jdu9VpcTj:lsQie83LyMtzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774597733, "uuid": "36f4988b-4356-4d8d-b2ed-10c70deef6a8", "value": 149472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774597733, "uuid": "7c9a6f55-f95a-4d35-8a33-fb12fe36b033", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597733, "uuid": "66186c57-fa3a-4aed-a456-7d1f1c2d24e1", "value": "iowa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e7964f-29f2-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774625756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625756, "uuid": "21143655-fba8-4385-bee7-f3be83ab4cb6", "comment": "Malware payload (ValleyRAT)", "value": "07c44e24127f6594a08f793cbc76ed87", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625756, "uuid": "1159cf43-b0c0-4ed5-ac11-9d0df0735962", "comment": "Malware payload (ValleyRAT)", "value": "0e4d7fc19fc912a50e26ef99ca954613c480a3d05155bd23e3d78cf52ec0e90e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625756, "uuid": "0362c590-502a-4609-84b7-e39c840eef1a", "comment": "Malware payload (ValleyRAT)", "value": "518d740ee411cfbefa228cf824c8633902786d12", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625756, "uuid": "f8a9683f-458b-47c9-b037-f76e342c65f9", "comment": "Malware payload (ValleyRAT)", "value": "51ed94743f3537085dc9b1eb2ae2beaccd47a03612b89ad04a2c16d904bac90198214f68bd544a16b016a78e75d62d1b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625756, "uuid": "624fd97c-c59a-401b-9b88-798d81d17c14", "value": "T1F064AE227661C432D09A153C95A5C7B25BBFA833A7F454CBFBA01A7D1EB02D06F38356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625756, "uuid": "b573c749-1219-4b85-ae2f-215bedf9a371", "value": "780438621d5af15a20a28693b9ed80e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625756, "uuid": "fad0a98c-49fe-41ff-af50-8ec68226bbba", "value": "6144:qOZx/DF/tWi9rISW/YR3uUtYdtQkqrM2pJHMU1ONtZiV:H/DdhaytYdtQeQ1ONtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625756, "uuid": "82e0797a-7257-4813-834c-4a19267e5f24", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625756, "uuid": "7b7f7ee6-6ae9-47f5-82a0-b9b614b13066", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625756, "uuid": "8d60a432-e4f7-4377-8785-50d177009c15", "value": "07C44E24127F6594A08F793CBC76ED87.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7fb4aac-2989-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774580689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774580689, "uuid": "1cc1f26d-502f-46b0-8a37-8184fb872407", "comment": "Malware payload (Mirai)", "value": "12f1ffd854c036805dd59a4b85e21add", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774580689, "uuid": "ecb7b87b-1dba-45a1-bed4-74c645a6ddb3", "comment": "Malware payload (Mirai)", "value": "1026793356cf17586f6ecaaaa9b87f2228915cd86f506e333dcc4fa642a7c03b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774580689, "uuid": "1d802de2-eee5-4068-8c78-18fe4922d20b", "comment": "Malware payload (Mirai)", "value": "0326518cf2a7aac4e9187942ca9e93a0501223a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774580689, "uuid": "d9a12325-1c9a-4486-bc11-66e51cd29a20", "comment": "Malware payload (Mirai)", "value": "71a76326cfa487ffab24896463e343a4bebe0e1c83a647a48a2ef1c1fa5fbb705c0430cc50e9b0dd6ee6d3cd075717da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774580689, "uuid": "fdfd75df-3bd7-41a8-a341-5cd320ae1158", "value": "T1FE362A029F449EF7D8EBCD314A3DC343049DAC9761CC666AB97CCA5C7A6A50A1F834D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774580689, "uuid": "65f2e726-7875-42eb-a4c5-638c95f73e1b", "value": "98304:DV3vOtP8eDmvuK9FKyRLZW6U9gkJNrnTWXPxQBUHpqoZf5FoZW6:DikKKfcNrnUPeSpqExFX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774580689, "uuid": "8fbc3b2a-2d7f-4d1b-bb9a-0fe2f95370bd", "value": 5340832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774580689, "uuid": "64c6051b-600e-4362-8bb8-d39b6c846094", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774580689, "uuid": "5708a8c7-899b-4400-a6ed-b3b5b940569c", "value": "wlan.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48da780-29f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774626694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626694, "uuid": "b5eadba5-8e06-4380-8a43-0460ace778b7", "comment": "Malware payload (Mirai)", "value": "2a8e0a73bd3dfd9a15a6c6132f1368b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626694, "uuid": "be9409bc-9936-4712-8373-0304017bef2f", "comment": "Malware payload (Mirai)", "value": "108cb7303ccb45d5c4967ab566524c6342beca08bf0ac28a668c725583b9c8f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626694, "uuid": "5c06fef9-ce85-4638-bb30-dfa6d4b8b9e6", "comment": "Malware payload (Mirai)", "value": "4b34bc6f17dad6169455c46bc762037bb6e6cd54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626694, "uuid": "c0117cf0-72e5-4aba-bd57-175f6293af1a", "comment": "Malware payload (Mirai)", "value": "bf244df6ef5e5cecede461cb176aaf6d0bfbd156305d18d2d9e7c831fa5e3638f14b91ad2d3034c1758f46648113f329", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626694, "uuid": "9cf945db-7ed2-48bb-8a8e-883e687ea103", "value": "T157D39DA7B34F14A1C42647F41BC7575D2A2320018E2FAAE73C5F367E5A3B5DA58063E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626694, "uuid": "ef90a0fd-55f3-4f41-9e25-e30bf508fb35", "value": "3072:yF6YKq9XdLARSN5VDJAPxfMPfzFkcarOglCn4oZ/fTeqX:yFhKqXARWMJMhRardCn4oZXKqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774626694, "uuid": "6f3d537d-0569-4b3d-9d31-90653ee11106", "value": 132816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774626694, "uuid": "6be97643-0e55-470d-a03a-b741dc4b4637", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626694, "uuid": "c8325c52-caf2-46a3-8c90-8d8e70577605", "value": "lighttpdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccfd07da-29af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774597046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597046, "uuid": "e0dde673-a161-436d-84b2-878fa6b7a8c5", "comment": "Malware payload (Mirai)", "value": "37f84cf2e070dc77f58a1d3407f24a84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597046, "uuid": "dbb6749b-efb5-4a19-a84f-e786548bd021", "comment": "Malware payload (Mirai)", "value": "1117383b001b2b11dc9e963aa9f6142904cc84367cba62853b1242d6a3d28f47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597046, "uuid": "5f5acf01-c81f-4755-abcc-a11790cd99b4", "comment": "Malware payload (Mirai)", "value": "5f64ff9a768c4a1911350e2d60c41feb5eefdf33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597046, "uuid": "c4f6eeaf-04aa-45c0-beef-ee88a1655d8f", "comment": "Malware payload (Mirai)", "value": "20aacc797ed12793c328ba058f834ee5047659e59538221abc97083ae07d17040e58d9807b203d8373c686ad39fbaf74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597046, "uuid": "48f67440-0ec2-4431-9def-c5dbbb4ac030", "value": "T100A533998CD499B3FD34B41EA6110FDE2CD4E526BCCE26CECD1EA9421DB0EC90636752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597046, "uuid": "ecd538d4-0b1f-47c1-a086-6ce862477aa0", "value": "49152:9DSIfEPzcSAFAsfPYq30nYmYReUW2JgDxR6lX7q/:9mMqHiAsfPblmYReUWkgDL6lX7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774597046, "uuid": "5e65cd62-f5b9-44fb-b4ed-d04b1f7c39be", "value": 2110584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774597046, "uuid": "9c22b620-d32a-4f13-b6cf-cd71bc035223", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597046, "uuid": "0c357e75-5269-4982-82b2-1b35e2c2732d", "value": "wlan.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d2e075-299e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774589407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774589407, "uuid": "9063b788-56ae-4da8-9a57-0551109723d6", "comment": "Malware payload", "value": "265a7d6f30a092724abeaa03435ff998", "object_relation": "md5", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774589407, "uuid": "b4ee4957-016f-418e-9ca1-a0bcd30f0b48", "comment": "Malware payload", "value": "12a4fddf996a70adfbebe662c60f44ee51b1716e6f10fbebb58214ee6887705b", "object_relation": "sha256", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774589407, "uuid": "2bb1f51b-f5a6-48ee-9c25-04c485655674", "comment": "Malware payload", "value": "bc7e04a209a82abe8661cb37ddf0ec6a82a63488", "object_relation": "sha1", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774589407, "uuid": "486ba928-dfbc-49cb-a1e6-4d3db990e9a1", "comment": "Malware payload", "value": "c2c2585febfd1d93633750254a62867b76645824d8875ed2a7b57c45d19012372d69ea7a624257f6808b688f82f11928", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774589407, "uuid": "389413d0-f457-44c1-a0aa-5d514d77780b", "value": "T140845A0293FD8118F1F34F88AA7A50610AB7BE9A1D78D06D06AC540D1AF3E58D9B57F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774589407, "uuid": "1867ce4e-b6b7-440c-8567-a540daf76b62", "value": "6144:oPRbdGdSM7HWvymIumGgq+q6SWnUkf6z9Jgf0eLMjmxVpCCL7Oo9+FvL:opB4qvymIumHqX6SWnUBz9JgceLomLpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774589407, "uuid": "96b0ddba-09bc-4fe6-80de-4db3cedc552f", "value": 381390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774589407, "uuid": "c21ea14a-abdc-4311-b6a8-6eed0a6ff64a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774589407, "uuid": "be41ceb8-b986-45fe-b9e5-062150b9d235", "value": "QUOTE 951063800.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9163e0-2a16-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774641310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774641310, "uuid": "c234efc2-fed4-4116-835f-6faef2c37958", "comment": "Malware payload (RustyStealer)", "value": "4711abfb5214deffec7481d9b8be57fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774641310, "uuid": "64ee1ae7-143f-4852-aeea-edd804f6a251", "comment": "Malware payload (RustyStealer)", "value": "15b4253c76e24e55f9e79233c5b0068837c25f9250a38357e87375ce216c0f9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774641310, "uuid": "1f04126c-b813-4a24-ba35-97568baac916", "comment": "Malware payload (RustyStealer)", "value": "378bd91abdc7134a935d84e7d510d3fb5ccae07c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774641310, "uuid": "c78c190a-c003-477d-a838-6fc0edbad283", "comment": "Malware payload (RustyStealer)", "value": "3029d54ddf451fe9c016bc9066a79eac22f1b48a48083718efb4a1ba274e041be41b6799aa86ba49f91ed3f498691f81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774641310, "uuid": "a45e263b-611f-42e9-8e0f-df09f0a4f1a0", "value": "T156355B03E69585EAC55EC078C7579672BA32B8890B34A6EF67D42B383E27F805F1D314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774641310, "uuid": "4658f4d5-3b5e-4e0d-a762-4e7db6d727ed", "value": "fd019ca73338941cdfcf567f59e17e76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774641310, "uuid": "503a78be-9782-4a83-93f2-471db7683f95", "value": "12288:W6OebP90Vs+aFho4xwD0JF7RaGEaircPTTYR6z4kPMTHb1Jkd:BOe6sBFho4xwD0wGbirmTii49xG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774641310, "uuid": "c04534e5-43b3-42b4-a801-71fb24ef9009", "value": 1102328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774641310, "uuid": "0150fc60-93c6-42e3-a18c-2325b9f5629d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774641310, "uuid": "600919e4-a25b-49d5-9a89-b056794d574c", "value": "updata.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e54f56-29ec-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774623226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623226, "uuid": "eaff01a6-3565-42b1-9113-e80cdbddc97b", "comment": "Malware payload (Mirai)", "value": "05c6c00570568f86deebd07239d56e39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623226, "uuid": "2bca8f46-e355-48fa-b33c-caa442fb8bf8", "comment": "Malware payload (Mirai)", "value": "15e08cc8389b8bd2db97c1ffe361c945016e76dc1a09e5188bed6d12ae22445e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623226, "uuid": "a7ba943c-5a62-40bc-918c-af2749b572de", "comment": "Malware payload (Mirai)", "value": "1792556f9198bc049e67d3a1149c213173715e1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623226, "uuid": "2aade21e-579a-4f73-8b84-804fc3c0098f", "comment": "Malware payload (Mirai)", "value": "8268762831fadafd58f2bf73bd98975f3c9e59bcb59d0bf36bb92f6b930ca65706f320b15c7f4843acead958ab3e75a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623226, "uuid": "60a70d6f-0b8c-4127-9cfb-8bac7c874389", "value": "T146D3AD9BF38B04A1C86206F007CB4F9E2D6361C25F5BC5E37D29A63B6E754DB0906B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623226, "uuid": "32a508be-8ec7-4882-949c-50fe28f67b7f", "value": "1536:s5II0zLazyR2vbTZiuBLdcBe4AFlj39LxgRx6Uugn5j+/LWO:rvy24vbTZiWL2BetnLxgUgnt+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774623226, "uuid": "e316e96e-58d3-4463-b070-9f5c9422aaf1", "value": 132648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774623226, "uuid": "0fba2bf9-6769-46dc-b37a-2013d4da5ae7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623226, "uuid": "1366c6fc-306d-46f7-9826-94bd3ea94295", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "232f1d3c-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774625107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625107, "uuid": "f02dfb22-2a4b-4a87-b2c9-267e862b682c", "comment": "Malware payload (Mirai)", "value": "7b989bb9e8879163488b95d8ab9834c7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625107, "uuid": "f41bbdd3-6bbb-4acc-8984-39a82cfef6cb", "comment": "Malware payload (Mirai)", "value": "164435180e2a8287cb1c179fda496f4cd5fa49ba709a218bac7beb6ad6a674b5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625107, "uuid": "aad1e340-5119-45d1-b6ac-6795ba19d2d3", "comment": "Malware payload (Mirai)", "value": "8a195a909d690d078c8ecaaca26733a092911153", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625107, "uuid": "178bde1b-5897-4b7c-9e83-ba33123a6977", "comment": "Malware payload (Mirai)", "value": "fffb456b29706a003aba6e82710ba6a64febb19bd7e8c3c0ade9a37dd91a51a61ea3d533ce83cb6611879fe3b3a1c5c9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625107, "uuid": "bc3cfe27-6ff2-4ff5-8762-2f574894a41e", "value": "T1E7C2D0A0B726F931C520AC3DE52A4D8A3A51067C91FF353764158C39CFC169B27A48F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625107, "uuid": "b8c5ff27-d865-4a65-b8b7-c47b6ad115b6", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwrru9q3UELuZ:NKy4qfqoeJdXWgrTLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625107, "uuid": "a460f6df-9ee2-4e69-80c8-d9ff381b685c", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625107, "uuid": "06cd17a7-1832-4a06-8e92-11da721e3c2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625107, "uuid": "2b1dd295-a334-413b-8db0-558209b353f9", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4296d3ef-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774596384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596384, "uuid": "05b542ba-73de-4f95-a4d2-ea4354b9214d", "comment": "Malware payload (Mirai)", "value": "cf02a1e9c20b3c6b57a4613cb25d6265", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596384, "uuid": "0d2350ce-7106-4bdc-a540-f5c888a87940", "comment": "Malware payload (Mirai)", "value": "1807bb43d04c293682eaf7e4a0360535bdff2e79d018b903b273bfd72d5134d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596384, "uuid": "f3f8ecc3-cb86-4749-8127-1dff78cfed69", "comment": "Malware payload (Mirai)", "value": "c8b89b866bc45b2644765717ecf7afa89534bdf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596384, "uuid": "77b7d389-4a69-463a-aba7-df8bddb14591", "comment": "Malware payload (Mirai)", "value": "1ae20506836b311c35e727c39c138ebf2c3426369cee0a391a5fa986aad540bc3e8eac26c50d8ad48682645c0f5c6139", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596384, "uuid": "e835a147-83c5-4891-9bc0-db3d8efc83be", "value": "T194C3F185BB6369D1C1A342BDA4C00AC387912E318BE313080699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596384, "uuid": "deab797a-7cb1-4ec5-b896-99f8d4d8a84a", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTnv:0OCDjXG9qTWywxlxTnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596384, "uuid": "0a3fda25-8d3f-4594-8e4a-a861324aa0db", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596384, "uuid": "582d54e2-aa63-4acf-8d1c-e78d1a0b53e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596384, "uuid": "9345fe9f-b1ce-4312-8cc3-d57e2230a48b", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3ec1e5-2a25-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774647508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647508, "uuid": "be08113a-d0f8-449b-a67c-1ee65318e40a", "comment": "Malware payload (Mirai)", "value": "333ddaee46fa7e5f6c23457d3241354d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647508, "uuid": "42ed470a-9e57-4422-8dc5-626d66355280", "comment": "Malware payload (Mirai)", "value": "18e0fa9c979ca33e4f414177dcc0b554190ddea92445687753145acc026ad3b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647508, "uuid": "f0ca33fb-5fdd-41f9-9ae7-427a4f084311", "comment": "Malware payload (Mirai)", "value": "5e86f15b0cc086bbb85a5a9d3455d0649a315388", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647508, "uuid": "8f616bf2-697d-4f35-b899-d15e54eef6f1", "comment": "Malware payload (Mirai)", "value": "ca8f763fb4c9e023122e3a7ec3cebdfb71377fbf3577253ab13ece483a3c986cd14cd53d0ad45c020dd9207a276b4417", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647508, "uuid": "8cbf6216-28a6-4dea-915e-13bf3b3abf88", "value": "T138936BC5E6C3D5FAF89304B161775B328B73E539613AEB56C3AEA831D862400C71A76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647508, "uuid": "c6c58879-8c55-4a35-b0bc-de154296ff41", "value": "1536:j/G7MuTwPVUselzW3x7WmBFNfFjL/fySM7T0:jG7MuTiTSzW3kmj5F3baT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774647508, "uuid": "a3de7110-af17-4028-a394-dbc15c04732f", "value": 95596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774647508, "uuid": "e7d3cc1e-9ef1-43fe-a303-27ee4b96065e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647508, "uuid": "02ad9112-45a7-4eab-bbf3-cce270c4d9aa", "value": "telentd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0fd766-29d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774612001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612001, "uuid": "4e11ef7d-623a-4e40-af80-ffd473523677", "comment": "Malware payload (Mirai)", "value": "fc7babf30595021ef3306eaad24ebb22", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612001, "uuid": "e1293f1c-ad18-4643-9bb1-e6a345c77747", "comment": "Malware payload (Mirai)", "value": "18ea8dc6e271c7ecf890fffa76155041bfa4d8144b7f0af2122bf14c575024ab", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612001, "uuid": "0d8513d5-6805-4732-b83d-d14a84d27f42", "comment": "Malware payload (Mirai)", "value": "73e984b849759100928818140d4559ccbc7134eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612001, "uuid": "a5286827-55f4-434b-b562-7f3a69963b3a", "comment": "Malware payload (Mirai)", "value": "64e5df0105a316aa311e22eaac9e8ce8ac34b42fb958a5d20dbb9e63ba6c34fcdd76071053d3d0f385d4fe7fde9abdd7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612001, "uuid": "6f35919e-99ab-4bbe-8983-b9dadf6018a1", "value": "T19E933B45FC919A12C6D5137BFB2E228E372663A4E2DE3203DE156F22338659B0D7B741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612001, "uuid": "fd8c1413-f03b-41e1-8855-662bfc8303ef", "value": "1536:lOV4HFG59DYFVayhwnb8pPRLQ0YeKXffd6bqmv1F:lOV4HO9E/VBpPVQ0+Pk1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612001, "uuid": "40881683-1272-4b79-a790-c2d4173679d8", "value": 92248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612001, "uuid": "495f6c20-1e42-41be-bf96-e4a2911d65b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612001, "uuid": "d41a4be6-1be9-4857-bb41-778b2310dafd", "value": "windy.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daddc17b-2977-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774573017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573017, "uuid": "142a927b-e6bf-4d6a-a444-e5c718779ffc", "comment": "Malware payload (AsyncRAT)", "value": "79ac9e680b06e0bb5f5c85d74870678e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573017, "uuid": "495fbc32-6f1a-435c-a601-a3984d50e814", "comment": "Malware payload (AsyncRAT)", "value": "1969f65e0e903cd62c3fb071b0a66cd6f0b48d8f18d8d57ba53f38a2d7e838cc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573017, "uuid": "3ae9fc24-7f53-472c-93a1-df8fdaa65e54", "comment": "Malware payload (AsyncRAT)", "value": "6967fa1740ab93e99eb46f321613cb7df3435dbe", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573017, "uuid": "8a4f9962-70ee-46ae-9ad9-d621a6e2395b", "comment": "Malware payload (AsyncRAT)", "value": "c9aac2918a954a1f001c1b081a1f844a37f0a64e93a02e7e0cbfe4501139932d43d40743e7fba81f32372ce4acb464f1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573017, "uuid": "d3be7697-0473-4278-b727-c377f5639564", "value": "T1B6E23C4877E44312C9FEAFF02DF2710A1675E11B9C23EF5E0CD88A962B679C146907E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573017, "uuid": "8f1681ff-02c5-46e4-8d65-20c1bbebbc08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573017, "uuid": "ec0f343d-cfc3-4bc5-a7d6-fb9511f2afc2", "value": "384:hYaJWq4Ava7Rm32oDuuw3+q5XwYeLBEivh0FbOKTCOQSCRApkFTBLTAOZwpGd2vG:rxC3fOJ5yivGFbO75SCVFo9jLOjhWbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774573017, "uuid": "cc86acf9-76f9-4fc6-b477-3c606531c00b", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774573017, "uuid": "816c30b5-4e33-453a-909f-69c772e6c7b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573017, "uuid": "d3786828-92d3-41c6-a8fe-4e950f8b660e", "value": "3.try.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af9c454-2993-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774584694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774584694, "uuid": "1a1a5ade-0985-4a25-a7d6-f76e8bdae9dd", "comment": "Malware payload (Mirai)", "value": "a96e76cd643fa823743043148ac0cb87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774584694, "uuid": "cf7e1160-577a-4b6d-87cc-be383c2c9be7", "comment": "Malware payload (Mirai)", "value": "1ab17cb9b0de82b3ecc8cd8059009d96e6b78c840e2f29267bbdb5191d531ec5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774584694, "uuid": "4b2d769c-6828-4985-bb56-35d3cea799cc", "comment": "Malware payload (Mirai)", "value": "6098074b646bb6fc78d06026066b46c7dcaec7f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774584694, "uuid": "753a2fff-1abf-43f4-acf4-994faa037b85", "comment": "Malware payload (Mirai)", "value": "771a34740b595887fc119936c28f2033ab1db103ce07e78bb97fbd17c0effc41cdae17cc4609c7fb5dad742e3c2799e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774584694, "uuid": "f390bb3f-e21c-45ce-84ff-f8117eb6bc79", "value": "T1806533276959D130E619A8FCF88E66458B6C50ABEF0B3E3E11E6105A74B13ED43704EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774584694, "uuid": "d10ce250-08b8-4520-9174-1896a6f7f724", "value": "24576:Tqzl4JX2MbcYIlSS/CPpwnC7YysMwHvrIAvPsqkZLHLRGiMh3q6f:TqiJ2MQXlV/9nLpvP3kZLHduh3qk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774584694, "uuid": "f6a92b96-4f8e-4267-862f-3735cfdca301", "value": 1477568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774584694, "uuid": "1a6e31a1-47f1-4947-9fc0-edd83746492e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774584694, "uuid": "fd97351d-107d-4e66-87f3-85f36915582b", "value": "wlan.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5278f6-29f0-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1774625041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625041, "uuid": "a3e81c21-63b8-4553-97b3-778d10eb0b0a", "comment": "Malware payload (NirCmd)", "value": "4f4717ed5471cd92e94d468ac2e9c119", "object_relation": "md5", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625041, "uuid": "73c69fdf-e90f-45cd-82c2-40d34b06e16d", "comment": "Malware payload (NirCmd)", "value": "1b8d1aa319b93fd9d5711f6dd99e0e1f1e1a6e1af198708a0521ff6bebaffba6", "object_relation": "sha256", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625041, "uuid": "36c054bf-11ed-43a8-bf48-907548a77364", "comment": "Malware payload (NirCmd)", "value": "97b0e5f8160c79181cb9775d51e1851d0bbf67d4", "object_relation": "sha1", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625041, "uuid": "fa6a51d5-99fe-4bb1-8840-62a4af736be3", "comment": "Malware payload (NirCmd)", "value": "946af15c510262b9ad1cc14a868d488f9a6284e54353b9dcf2614e7c1dec9c70a3342b8a34d57db15d03d474c1b0a97c", "object_relation": "sha3-384", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625041, "uuid": "3c329a25-3c95-40f1-8423-dab67fad1abe", "value": "T10FA52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625041, "uuid": "f56a376d-a95a-4523-8e26-e34d01319ff8", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625041, "uuid": "073ed989-ba73-4f5b-a824-20d2b20aa3ac", "value": "49152:ABR5Tpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:aDTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625041, "uuid": "625f98e6-ecab-43f3-baa4-85877f8fdb21", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625041, "uuid": "269e3f5e-a254-43e5-bc7a-0fe5358070b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625041, "uuid": "c96d5a0f-2ec9-49b6-97db-6b7d390e575d", "value": "17746066621b8d1aa319b93fd9d5711f6dd99e0e1f1e1a6e1af198708a0521ff6bebaffba6276.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3212dc-29b2-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1774598358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598358, "uuid": "f1b1d3d6-3fad-4751-9431-02ce9e178190", "comment": "Malware payload (GuLoader)", "value": "a8eeb48d760948e5e8099bdc13006b70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598358, "uuid": "0bdb6634-3fec-4f42-90a9-6f1c912850c5", "comment": "Malware payload (GuLoader)", "value": "1baa435dd0c1834273117c8fbbf47cbdfba5450ee71c90926affe63f07afbb92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598358, "uuid": "1d1b91ed-d743-48d5-a358-7e99dc4376e8", "comment": "Malware payload (GuLoader)", "value": "70b7a1c068e5b96b303a03f29edb094f6bc5b478", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598358, "uuid": "0e32bf67-e882-48da-a0bf-5d68b9e752a4", "comment": "Malware payload (GuLoader)", "value": "3871e1bf2ac313b1a3972d7459155f9c7fecee2265fc24fdfa36f2b355646e8f936c2dd2e2b6191afe5f70734a4e846f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774598358, "uuid": "1f4d2264-594d-4fb3-8d92-2a2090370051", "value": "T129D412413ECBEDBAF16158310CE9D95676BABC265EA01A4B73413B3F39316168B0F712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774598358, "uuid": "bfc90f24-1799-4cf9-8f93-e0c6b2f2899b", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774598358, "uuid": "86846ed8-8793-41f7-83b8-8aa549dbcda0", "value": "12288:gMwzdCO5/bAH4mWDguDwv4uszqaf8BJsaw3bMg6gK0E9:gMwZCOZsYbDguD3qJB0bMgkR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774598358, "uuid": "1224d377-aa22-4a34-b1bb-85baa5e9b64e", "value": 650503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774598358, "uuid": "4e03228d-41f0-4516-a766-9b669542f841", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774598358, "uuid": "d3329d7e-148c-4277-88a3-5d7520ac490d", "value": "Oplysningskontors.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3674c7-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774596507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596507, "uuid": "816e81e1-1030-4152-a7bc-f9d1f3472196", "comment": "Malware payload (Mirai)", "value": "6d3c3c98f4295d43ffedc1f89af80511", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596507, "uuid": "3a3d2649-6afb-4dea-995f-5e05870cfca9", "comment": "Malware payload (Mirai)", "value": "1beca388b080e11753cec946ac7d1048d3a8dc8d67ca330b636f9405dfc433f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596507, "uuid": "f586b8a7-0f87-43fe-b981-cc34739b7560", "comment": "Malware payload (Mirai)", "value": "25829b29e684d91f69c629f1f8353597d3ee9fb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596507, "uuid": "b428084d-4b6d-4ab0-b029-bcce826ac4ce", "comment": "Malware payload (Mirai)", "value": "58a01be23898039e5a8265c6c14ecfffd29f569842711515d6366a304e7c0215e314d75e38af72ccc53251afccc46e9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596507, "uuid": "2fe9006f-8090-45b4-a3f7-205dc25afb6e", "value": "T16A148D68FE4F78D2D2C7E37DAE4A0FA2302779749565C0B51A00A29FD5EAFD488D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596507, "uuid": "03c7cbd5-03a5-437d-ae4a-e53aee425e35", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxe:bOVfbEdxm4iub0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596507, "uuid": "c7f16dcf-77fd-4ecc-ab3b-986c64bab16e", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596507, "uuid": "a9e8b408-415c-43b4-9847-9f701677941b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596507, "uuid": "6e0ab136-064b-472f-a348-058cd8f4c19d", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0217c9-2a2e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774651595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651595, "uuid": "6bc073cf-f9a7-408d-b1f3-582fe4104f09", "comment": "Malware payload (AgentTesla)", "value": "1aec3775575a657c160c2403150fd782", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651595, "uuid": "5f69e1b3-3aff-4bc7-96b1-a64bb499feaa", "comment": "Malware payload (AgentTesla)", "value": "1c31d2c43a460f620f6d16b808aff25e13e1f85faa48f5ec2ae0e685b9890fb2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651595, "uuid": "3e5cce4a-a21e-473a-bcef-bb448c409e70", "comment": "Malware payload (AgentTesla)", "value": "b0088ec5e3ae5b5a607ab36a23b1f7ac70ff374b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651595, "uuid": "95d06c35-d5e5-49c3-940b-de9e7644b4ab", "comment": "Malware payload (AgentTesla)", "value": "0dbf6aca112e9d4eae7b374be88c3c94100f930567c1dee2e1a4bae88136fe5cdbe4a25527cca1b51ce7e915b6232fc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774651595, "uuid": "1fab6ad6-5819-436d-8f4a-112f46791f00", "value": "T1D43533580DFCD0E21F3244657DA0E0A04B7B45E658A3F9729DF835528FFA2E533A079A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774651595, "uuid": "d008ff4b-1880-4fb4-8489-74077f69ae72", "value": "24576:CI+KcmamJ2e8YqBG6znkEQ+DyXtDpFdjpTxY4mvKOK/YemKF:CI+KdeBNVQ++LFdjpTxdyKfmKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774651595, "uuid": "17dba24d-da50-4e6b-8d44-30f641db5bda", "value": 1073313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774651595, "uuid": "9e1baffb-3223-498d-bbe5-01f450a4c276", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774651595, "uuid": "4812234e-3c22-4e3c-9df2-d00f2e906736", "value": "MT_ELFRIEDE_APPOINTMENT_LETTER (5).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b78f286-2994-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774585232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585232, "uuid": "486f08af-788f-4bc7-9539-9f4caaa6325a", "comment": "Malware payload (Mirai)", "value": "170955f2b3aa2adea50919cd2ad1871e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585232, "uuid": "8e75804c-ed98-443f-82da-31622e76e028", "comment": "Malware payload (Mirai)", "value": "1d3d29677708ed04c65fce39184dee58727de4c5adca4500ae56c909768855e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585232, "uuid": "1faabff9-5ca6-45ad-8837-66de914d09ef", "comment": "Malware payload (Mirai)", "value": "3ffda8d547dab4f6c2ee86d0ec42d43ae3d5f5d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585232, "uuid": "484c6240-7a5d-4fc9-9060-c3215e27ff53", "comment": "Malware payload (Mirai)", "value": "050055acb6f987178e383f13ffe208a538d55dcaca515f42162a977be6e194c611cf3d1ff07c97ee265a444eeda55785", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774585232, "uuid": "753707c6-cb16-4c76-8406-e610eee4c979", "value": "T180F58D13B7F2409DEA4042768BB5C781795BEEA024A6071B4F60AEDFAF733904E554F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774585232, "uuid": "6a0349a5-d577-4856-b413-02d37dfc199a", "value": "24576:um62zlvA5w9rrI+8nq2ANXl51wMDw8kUfzgyI1gm1nlYnPJCgoYVZRd0v5VcRmNe:NJVA6ZrI+oqNhlAyzgbazoYy32j+/Pg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774585232, "uuid": "ab8266f9-7171-460d-9ab5-cb71f72ab371", "value": 3565464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774585232, "uuid": "c0b71d7d-d34b-4294-885f-90f21eafc9f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774585232, "uuid": "c7c1432f-ab71-411d-9a99-c2ca6f3a2f67", "value": "wlan.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c0598d-2a1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774643392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774643392, "uuid": "61c7bdda-48e1-4ae0-9002-02b3cd234e8c", "comment": "Malware payload (Mirai)", "value": "5d6b435b49265454d0217efab4138884", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774643392, "uuid": "c1e83815-b0bd-4ea9-8cbf-37bdec9fe12b", "comment": "Malware payload (Mirai)", "value": "1d89432d9c4d27cb87145db6737ea4bb7d3c4ac8b4952b4e2c5b9e94faa7d05b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774643392, "uuid": "21346d8b-2eaf-4214-9f64-302038b0072d", "comment": "Malware payload (Mirai)", "value": "5ef8672b028590b0f303ae8bacb1167aaa93ce62", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774643392, "uuid": "fe8ddf3f-b82b-44ee-b4df-ed474e58bbf8", "comment": "Malware payload (Mirai)", "value": "1fa0cfc0c41f4617e95dd91bee2d17fad2d82e255848527e69bb427b501af28e4cc4eaf542e8199e65e313db81d0e3d3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774643392, "uuid": "9e287515-0664-4eb5-9002-0f0a09115da8", "value": "T1D8A182E974B4A36B2DA0ED7375D6CA42F14021A7E0C91C0FE6D6F0E9498CF61F494B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774643392, "uuid": "2d878cac-2b3f-405c-9ac0-2186a3af0ede", "value": "48:vpK8KMV4klpKDK1V4RpKrOKrWV4cpKQKoV4apKE0KEEV4EepKUKkV4+pKDK1V4RT:v37dWbPXDTGEpe7NFajEffjlt0rAjd/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774643392, "uuid": "0bf64c06-c586-430d-8c14-d1b2962ea3f0", "value": 4807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774643392, "uuid": "39634e69-42d8-42e2-9466-3affab8e1f1b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774643392, "uuid": "9adaa467-1ed1-4b34-8219-2430673a6355", "value": "yarn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3097927f-29a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774590341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774590341, "uuid": "76f02206-1cda-46bb-8389-23dea47e5a36", "comment": "Malware payload (Mirai)", "value": "82aaaeebd888353f34610b9f72495dfd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774590341, "uuid": "ffd66b2c-5ae6-4a2f-9ca3-c3362d7a1376", "comment": "Malware payload (Mirai)", "value": "1ecdabc4bb203f194d32529ec6e2899a20aeffad50ce4e1e02a7f564c74648e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774590341, "uuid": "26f9a1b8-5f43-48c8-bf66-05f9d523d7f5", "comment": "Malware payload (Mirai)", "value": "fa1a8e2d00bb3ac208392ce89f7f118d795c49b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774590341, "uuid": "ef8c447b-a1e9-479f-bed1-7d6dab48b317", "comment": "Malware payload (Mirai)", "value": "8668f011e0408b4d5838037fd9dced5c2ac9053b9884f4bb16a4c65153f3b0c7cccdf6e83f45ce038e55b9e087b7bce1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774590341, "uuid": "08caa246-b43a-49ea-b7a7-645c9f3bb44d", "value": "T1B0953330E601AA02D93DF65A3D1F4AA3F10E10835D9FC450EDA79724E83E9EA5E3475E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774590341, "uuid": "5a8a0bbe-43de-4fbe-ab35-a272c09cb21b", "value": "49152:/Qli56De9+sdOManUA4EnVxUo8hzXs39O5Eu//:/F5VUsfq4qxSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774590341, "uuid": "a8c70e40-04a3-4ce3-aa5d-ba0011d689b1", "value": 1996664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774590341, "uuid": "2a53bb92-84a5-4945-99ab-d4a18bc5c7a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774590341, "uuid": "4daf0459-4652-4e47-8993-827c7bba12e9", "value": "wlan.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3baa34ff-2a03-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1774632879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774632879, "uuid": "c16e7067-0405-43a1-abad-be82b2fda53c", "comment": "Malware payload (DattoRMM)", "value": "7303f779e990f9d0559a2fe37706e1d4", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774632879, "uuid": "53281fa1-65b3-463b-9cba-41ae37bd9442", "comment": "Malware payload (DattoRMM)", "value": "1f5b84a5c549e271b28099f1d01fd7f62c01bfc5e1819349ee909745a83c4b48", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774632879, "uuid": "b29126ab-85fb-4893-8e78-0a9ea497c09e", "comment": "Malware payload (DattoRMM)", "value": "a639bc8ee62847a6e78a9fa6da7baf79e5be89d1", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774632879, "uuid": "26ae1e47-06da-43f0-b864-a6111bc3628f", "comment": "Malware payload (DattoRMM)", "value": "1370d98627fa282cf1f7b8bfc9dc1f6ca8c44d2d1225ef367786e9e6d8e862fec3cecb2599b7af3b214f7f2217d1d306", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774632879, "uuid": "809a9c2e-52ab-4d83-a841-15781960abf3", "value": "T1F0B63347D9778DF0CA330A3890D2196B3305980E485BF4C9F609277ADAF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774632879, "uuid": "d8013c7d-5661-435c-aabd-1abe89530239", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774632879, "uuid": "ba76859b-7150-4b59-a65b-99a283f33a0d", "value": "196608:3aZk+w8P+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2z:vnzmzZFw5S9pE7Asjp29qIT0jarlZr87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774632879, "uuid": "aadba432-eaa7-426c-b7a5-45a5e54246b8", "value": 11056104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774632879, "uuid": "67717e21-669c-4000-9570-d8224cdc0770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774632879, "uuid": "be3d856e-6b4f-49b6-ba19-36cc7e67185d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11601b8-29f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774626688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626688, "uuid": "d307126d-302e-42b5-bff7-0f4b6b659fb2", "comment": "Malware payload (Mirai)", "value": "ca6f5fca12feb75ff1c182d7f88f7cb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626688, "uuid": "56bbe14b-820f-45c4-8eae-d212c42bcd5e", "comment": "Malware payload (Mirai)", "value": "1f947ec089e0a185f4f389fc813753f7bf1ec86c4bf44a275fac86c71eadde48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626688, "uuid": "3b78948c-274a-403e-a6da-250cc99d3cab", "comment": "Malware payload (Mirai)", "value": "394effe903c34dd06a1e90e54aa4e09b25b03e7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626688, "uuid": "0dad2c9d-e834-4044-ae90-c13e36146451", "comment": "Malware payload (Mirai)", "value": "1bf1f9ad519edd6cd4ae508510224fbc79686cb1e704f7331cb74561a8b553f91fdde05c62a6b65eae40207cbb233ce2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626688, "uuid": "50691595-48b6-405e-8f9d-b7eabc8c907b", "value": "T17ED31845F8909F63C6C2127BFB5E428D7B2A17A8D3EA72039D156F21378B45B0E3B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626688, "uuid": "a193f6c3-2828-44c8-a532-d7a2cea39ff6", "value": "1536:avCaArmiOgTC5rwdAjitCCyknRWpA4VG67H8wnEp9OoEsd/Y6NHCDuJlJAwywzAL:aIOgaw2jWCCykD4dZY9OoXx4saWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774626688, "uuid": "344516cc-6751-4e3b-b97d-a33f0fe6708f", "value": 133932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774626688, "uuid": "bc8bbb9f-115c-4d03-ae8b-6c32a040c024", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626688, "uuid": "cfdbb369-2b59-4678-a94e-ab16a1523701", "value": "avahi-deamon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92745a1f-2a32-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774653211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774653211, "uuid": "6a5f85cc-1546-4932-a0ad-4d1a43d0a584", "comment": "Malware payload (Mirai)", "value": "f4d3e0911c841ab90c0bffe9ab664805", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774653211, "uuid": "2dca1b16-0696-43d9-81b0-9b9a59e6abf5", "comment": "Malware payload (Mirai)", "value": "1fd6d68852a93148e8d04ac6089fda742ac5ffc4d326b3dba5e4884b3b0bd3a0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774653211, "uuid": "8ce7de14-f5e1-4eb8-8a62-3e3cfd8502ac", "comment": "Malware payload (Mirai)", "value": "995526d5c67904545790d8469174b3e528cf1848", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774653211, "uuid": "2c0f9d4f-81ac-48e9-8851-da9310a3ed06", "comment": "Malware payload (Mirai)", "value": "78f4ad6441deb027f41947b4f2ba2fb6191e0abb00dc35e41e93d3c3c6e946446393745c4ff80651e4f29815465a7b68", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774653211, "uuid": "006c025e-83be-4e8e-a752-4de9b32d77f6", "value": "T1E4A1C5E974B4936B3DB0ED7375D6CA52F24021A7E0C91C0AE6D6F0E9498CF61F494B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774653211, "uuid": "9abd80d1-0df7-4585-9f20-eae83e5a58c8", "value": "48:vpK8KMV4kUpKDK1V4ApKrOKrWV4bpKQKoV4ZpKE0KEEV4ENpKUKkV4tpKDK1V4A+:v3idFbGXqTGEpN7cFZjjf2jUtzrvjM/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774653211, "uuid": "cacee42d-806b-4880-acba-3368efc9fc24", "value": 4793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774653211, "uuid": "e78d6a70-ed3e-46a7-8208-ba6bdc183364", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774653211, "uuid": "fa8924e8-faef-4d69-b6d5-870d0209d41a", "value": "zte", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b30836d-299e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774589661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774589661, "uuid": "a27c24ba-d644-4d29-8472-1d3ae327873e", "comment": "Malware payload", "value": "2a27b19d6a6cf9f51dd1204d699e5179", "object_relation": "md5", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774589661, "uuid": "99cb0cb8-8852-4366-8f40-46f0bafb5670", "comment": "Malware payload", "value": "2010eb9a562f80b574f68781e0e5351962a53774912fbb91243bbb80d90cf74f", "object_relation": "sha256", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774589661, "uuid": "0f28dfe6-9a40-4f19-9c39-5701572fc41f", "comment": "Malware payload", "value": "00ac715e6b81cfa8e411105d128dd3f24d3dd20c", "object_relation": "sha1", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774589661, "uuid": "6ba8462c-5e2e-41d8-9e0e-8b6495a0dc4b", "comment": "Malware payload", "value": "46f4360ca1a0f120743bfb865c07d04b3fee1dde60baaddbd3c9079761e40ce108b8096a80e012fb8c6e3749b13c2059", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774589661, "uuid": "0e577c9c-d247-4936-b78d-7b2386cc0128", "value": "T18ED3025F1BC4E742FA6F4BB224A20A7069B2A3170D26726F4AF1489C5F773901F95CA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774589661, "uuid": "90666191-8f7c-4a73-8ce2-9bbafc41b299", "value": "3072:FynkoF6JqLZXWuTkmEAbMh9LRleulONGWf8icqXJyndqh:wRF6IQoQtCIONDhc+Jyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774589661, "uuid": "531ae705-072e-425f-a6d4-55880d805b3b", "value": 137216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774589661, "uuid": "50b08a23-8bde-409f-8916-0de36068a945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774589661, "uuid": "c3c162b4-61e5-477e-9387-f0603c4bce04", "value": "2010eb9a562f80b574f68781e0e5351962a53774912fbb91243bbb80d90cf74f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a22971-2a2e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774651584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651584, "uuid": "d664ea29-8bb2-412d-b063-1f811498bb0c", "comment": "Malware payload (AgentTesla)", "value": "69ac7e2ca8ead89cfd85e26ef055f039", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651584, "uuid": "e0e20822-cdd6-4e8d-a5ae-1730781b0c2e", "comment": "Malware payload (AgentTesla)", "value": "20241d9cda50e0d0942759c71f20dd1d0a9bb98b2dfa42d4e120025cae1ba5c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651584, "uuid": "ce084d54-708f-4b0b-a4c1-cfa32d4a5353", "comment": "Malware payload (AgentTesla)", "value": "ab370f0774ad98afbb395ab3430d800a0160358f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651584, "uuid": "acae9ee3-3cf4-45a7-a943-be6af8ac173d", "comment": "Malware payload (AgentTesla)", "value": "05f4ad74bb9315429afa61a0c9f91c150addddbbf366412d509747c42397b3c0189c308997deaa2e7ea7c72e414f1b45", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774651584, "uuid": "55f5a855-4f45-4c4e-8ef4-0deb98228695", "value": "T1783533980DFCD0E21F3244657DA0E0A04B7B45E658A3F9729DF435528FFA2E533A079A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774651584, "uuid": "a0836fbd-b368-4dd8-a750-10dda28cfd61", "value": "24576:RI+KcmamJ2e8YqBG6znkEQ+DyXtDpFdjpTxY4mvKOK/YemK8:RI+KdeBNVQ++LFdjpTxdyKfmK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774651584, "uuid": "fc71ca69-ce49-426f-9312-5e6494f22b7f", "value": 1073309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774651584, "uuid": "9bdd1efc-7e5f-46c8-bd13-05169c93f955", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774651584, "uuid": "fae966c8-5320-406f-90e1-593e86a81108", "value": "Marine_Tiger_Vsl_Information (6).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c269058c-29d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774612060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612060, "uuid": "36f2145e-0411-45db-9259-efe271cb72bf", "comment": "Malware payload (Mirai)", "value": "0aed7a1ff46d517b897a80457c692052", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612060, "uuid": "0828edf6-37d5-4173-8f83-5c9c528878f9", "comment": "Malware payload (Mirai)", "value": "211b694d498c59df4e2b1e3303cbf603ae57ce1df577aaa679f7d7ff72cd51f1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612060, "uuid": "44d30c09-77a4-4447-a126-b4d45d27720a", "comment": "Malware payload (Mirai)", "value": "25c34152c09321913a040b0d11796b2160eb91e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612060, "uuid": "10dfbbbe-5573-4781-ad73-0eca5520897d", "comment": "Malware payload (Mirai)", "value": "47d876f529521c3d5d7676afd9411132f256325ace8ab3927ce437a120eb64752f69a5b2e3018d1d781adafd9597130e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612060, "uuid": "73345d88-9368-4216-b542-730ef10ad789", "value": "T1FB044C46EB814A13C0D62779F69F524633239BA4D3DB33069918AFB43F867DE0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612060, "uuid": "10918671-4309-4268-b12e-185f44c8f889", "value": "3072:/lE42o+DImaehF/h9PZpgBmsXCKiHUdwQy3d0fM/97ezERM:/lrKLaehF/h9RpwJCDH0wQy3dEM/9DM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612060, "uuid": "353442d1-ccee-4a96-bb5f-418395b40d34", "value": 176507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612060, "uuid": "b41cd6c0-e659-4a20-afa4-f272b696b287", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612060, "uuid": "7a90ee0f-b9ff-4a3d-8599-4193928ea521", "value": "windy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe7398a-29d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774612022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612022, "uuid": "38a1c82b-93a4-4f50-9eac-157d3285406d", "comment": "Malware payload (Mirai)", "value": "16ec5d5020f91ec02222fcf914cafe28", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612022, "uuid": "8d7c6a0d-efc4-4b9e-81df-7a8a6ecd62a3", "comment": "Malware payload (Mirai)", "value": "232bc1cb0abf802bb28563dd8fd711cc1583489a068d45bd420326da07d03d7a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612022, "uuid": "a5228cc0-7843-4d3e-9e56-25b5f08fea52", "comment": "Malware payload (Mirai)", "value": "345f463f9ce2defc318ee5a7e3ba1d19172ec8e4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612022, "uuid": "4457cc41-3219-4ee4-8269-6c27eccdaa6d", "comment": "Malware payload (Mirai)", "value": "f4ff32821171665d7d21b4c8d83b91314a246861eb6833b29599ff85eee2232f0b2522770e53ad368f67c13958782218", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612022, "uuid": "92995b8b-51d1-43e4-b391-8550fbb664c5", "value": "T11F834B0273580D43D1A71EF02A3F37E593EFD59121F4BA89660E9B4A81B5EF2154AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612022, "uuid": "73f35dc8-5410-460c-857f-c0a25da57528", "value": "1536:r9UIXOVeWbipbNdtp4OlEFL+wmCWoyntMT55:r9UlVcbpdEF3mvk55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612022, "uuid": "4b1d2999-7082-43d1-a0e6-2f1e858fb6f8", "value": 87736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612022, "uuid": "aeddfaae-be70-49a4-b8a5-af4f1dba11fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612022, "uuid": "574b6eb6-4e28-45af-9a00-7ec102dde53f", "value": "windy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f549b1-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774596462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596462, "uuid": "cbf1c123-bb21-4751-8070-29b62cc3e884", "comment": "Malware payload (Mirai)", "value": "f0552c425a18f7ddefa5e55bcff51559", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596462, "uuid": "b6c296d7-e164-4439-8765-aa6e802c2de8", "comment": "Malware payload (Mirai)", "value": "23e26553871647e2391f505833ba7bc7753e28899ce8480ee986a52bcecc7eda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596462, "uuid": "d32b916c-3006-4f83-bb59-1b009c055cbf", "comment": "Malware payload (Mirai)", "value": "e9d19c7254fb678db32233e61a6ac7e343fb0475", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596462, "uuid": "6c644d20-06c3-48de-8bcb-9ffec5ce81c4", "comment": "Malware payload (Mirai)", "value": "d937cad39eb2a75857790256570ca8a8b11ab89bae35de18714709a3921a7e57756ee1a81037373fb377465786a58e5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596462, "uuid": "a132c4e8-4bdb-42d4-a004-80333946da4e", "value": "T1D1C35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596462, "uuid": "343ef1fc-d4fd-4c53-90de-cfbd8c4eb2e2", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiyBw:VoRNjmj1VGFVrRiyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596462, "uuid": "4765598a-1985-4f99-a088-2b99048f1e68", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596462, "uuid": "42500a6b-9f77-4ebf-8fef-d1b08e9ac769", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596462, "uuid": "7300a8e7-18e5-4337-b6e6-e289e54a50eb", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0af6e6-29f0-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1774624961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624961, "uuid": "989e6197-ab0d-49ff-bcf0-8e06d0eab575", "comment": "Malware payload (NirCmd)", "value": "89396413917cb7689e60bc1b9df16ac7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624961, "uuid": "dbae9552-2db3-4938-b5c0-a104d11e1b07", "comment": "Malware payload (NirCmd)", "value": "253c1bfddf195d031d2b1504624560001961c2a4cb2b780ed341c89bfbca60ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624961, "uuid": "e397c3ce-1d64-47db-9f01-2a0caf86d367", "comment": "Malware payload (NirCmd)", "value": "6afeb7359c9cb214a0e87950db42f302c14f8371", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624961, "uuid": "d1271134-c4ad-4097-adcd-6740280bd41b", "comment": "Malware payload (NirCmd)", "value": "355f3823b8ee0872554f46061a30b4b8106ac262d79735e24ea25d8c3de3f088a864047fd73723d250ea408a0643af57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624961, "uuid": "0d5e0217-83a8-4b5d-bf42-43673f17e7a7", "value": "T104A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624961, "uuid": "0e8da5a4-74fe-43b7-8fbb-f9fdca781875", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624961, "uuid": "d277184a-daca-449b-b980-69a7657c2f7b", "value": "49152:ABR5Tpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:a7TFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774624961, "uuid": "de97b908-34c0-4335-aa76-503c47666a07", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774624961, "uuid": "bb16c4ac-f4a6-4b6b-841f-537cf6c13039", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624961, "uuid": "17932ee0-eccf-459a-8bac-05ddaae910da", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34018768-2999-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774587340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774587340, "uuid": "ad77400f-a914-4802-af33-0e3b56b664e1", "comment": "Malware payload (Mirai)", "value": "508ffeec8af00d5472e0f676e7067262", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774587340, "uuid": "1f4f1872-0cc1-44e6-92f0-e4e1f8802d61", "comment": "Malware payload (Mirai)", "value": "2582c502e4585c6b45d190958b058f8d2d05c89e1b034e69ab292787b3240aa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774587340, "uuid": "a43dc000-3587-4898-8a87-f1de517b66b8", "comment": "Malware payload (Mirai)", "value": "2903a3dc33f79843f745c2278a82b76eff33018b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774587340, "uuid": "fbf33222-80e6-48a9-b73c-146b4a3bb4da", "comment": "Malware payload (Mirai)", "value": "8b9695ebf4dd86054313605e59c31e5f1e20b0732b65cc1140034b30e8156b321cf1d6cca1b5657408bba8c733839613", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774587340, "uuid": "24ce5a67-35d4-4882-b886-3e908fb198a1", "value": "T169268D13B7F1405EE640523A8BB5C791794BEAA124A6032B5F50AFEFAF733900E558F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774587340, "uuid": "76b66736-78b6-440b-8b4d-ba66f6568be3", "value": "49152:aik516Ug+6KqqSlLbA1SvoDBjc4pkLL+8kuh4IPxlP++:ggU56KqqSlLbiBxXGN42xc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774587340, "uuid": "9ab99830-692d-4bf9-ac20-f0c1f2559998", "value": 4439176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774587340, "uuid": "2348886b-8b8d-4666-b0b3-7d98c142e0b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774587340, "uuid": "e744bfb9-89de-4dc5-aea9-c4aef0380391", "value": "wlan.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac51cf7-29ef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774624476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624476, "uuid": "22e11608-cf7c-4e47-a3f0-b7b13f22ed22", "comment": "Malware payload (Mirai)", "value": "dc853c0b35f3a90fd0d5bc4efaefd88a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624476, "uuid": "7468c098-ddb2-4c83-8164-d8f44a833634", "comment": "Malware payload (Mirai)", "value": "25a6eed586da515600bd187e1a162ba14e82f58041462372b1b07e0294d5d883", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624476, "uuid": "95adcb15-2e61-4554-b704-3e0da1fd6ee0", "comment": "Malware payload (Mirai)", "value": "19bd256259647fa5ed8137e09ba0a96e07dd864d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624476, "uuid": "ccc0f1b1-527e-477c-a316-82bc97555738", "comment": "Malware payload (Mirai)", "value": "5b4647c037c2fd3a6a3dfe0547ac9995c750bf0229bb313e4e306dc8ac5ae63bff04615733169f2aad281e25fd4b9158", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624476, "uuid": "2e591b84-8339-4175-a17c-8f9237111d7e", "value": "T154B44B59A8409B95D1D02BBBFF1D934873131F38E2EFB1069D196F646BABC1A0F7A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624476, "uuid": "4697e947-b469-4214-bf38-e04a84545473", "value": "12288:VVnK2Kd9dhjWHC0FhtETKERLY2FP+/1+8u6yOhHC6wY4Shjo:VVnWd9XWHCnzY2F046bCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774624476, "uuid": "d6d88cfc-e066-41ac-8f16-2375acdc005e", "value": 523172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774624476, "uuid": "b78a58ae-6ccc-445d-b196-271f85a25883", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624476, "uuid": "c5a3c63c-5b5b-4d8a-8718-15c678d727b5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83731a81-29b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774597781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597781, "uuid": "8ac9abb3-e952-4b48-801a-8cccfaca6513", "comment": "Malware payload (Mirai)", "value": "f33dd0f2aaa25a3c22561b445023ac62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597781, "uuid": "c2366343-0cce-4df1-a2dc-b59d8da21d33", "comment": "Malware payload (Mirai)", "value": "27111421f6310cf286aa062d6f6c296a87345d61fdf8db6238092f1b0751662b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597781, "uuid": "2a888770-d1e6-4aad-a644-04092f642b54", "comment": "Malware payload (Mirai)", "value": "300d6ef630678a524916e765691df48352d47864", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597781, "uuid": "c5c3e264-321c-4f29-a118-a58834489729", "comment": "Malware payload (Mirai)", "value": "4b3adfa4ddbdf6e254aec231886f68b6cfb1cf7061ee8a1aba9242631915624f7c142bd147cb1ae2ce0d5a642ea9efaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597781, "uuid": "8a31b640-e2d3-4ca6-81d2-9870689f2a66", "value": "T1C0A31982BB43CFF3D91304F141F75A358A31FC2A4836DA89EB75BEE2CA125D16506369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597781, "uuid": "17daae9c-0f3c-4be9-b5a1-49a7f824a894", "value": "1536:4RgNbHIfcHpFUhyti2WV66g8o62rjsyWu0VNQ:og8fEpFUQqsp162cQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774597781, "uuid": "2b767df4-f44f-4a7f-8167-1604f8242b5e", "value": 104688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774597781, "uuid": "411cca29-7231-48ae-8c15-1c35dd4a7c2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597781, "uuid": "74f15c51-b3b4-48d7-a80d-cea0a914db41", "value": "connecticut", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdef54d6-29f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774626682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626682, "uuid": "cba1ed14-0ba1-450e-aad6-a783eb544959", "comment": "Malware payload (Mirai)", "value": "91e163efc1b475d804fef86bed01075c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626682, "uuid": "0ecaa74b-0e69-4d30-9e42-f2e070483b5f", "comment": "Malware payload (Mirai)", "value": "2916d8ad23b8aa55f2e1fcd3519353b8fa81d86dbaeacb8446c27b070e941d2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626682, "uuid": "7245d514-f3e9-4e4e-bd80-f252ba9ea5ac", "comment": "Malware payload (Mirai)", "value": "ffb06261955fbd87e94e11645dda0ad7475c4edc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626682, "uuid": "834df139-afc1-4485-b05b-958eb1ccaff0", "comment": "Malware payload (Mirai)", "value": "8106d8654b1b55c0da218f1216e86cd603edd1c3baf977ac4eced5c85387c8515ec40ca77e99f4cfdc195c0d17ecabf3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626682, "uuid": "2b863503-122e-413f-bcf7-ca27662b06ab", "value": "T1EF04875E6F329F7EF6A8873047B74A24976923D623E1D684D2ECC1101F2025E645FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626682, "uuid": "3a8d2844-b554-475d-a6e5-0411a2f1534d", "value": "3072:ZwrIC6gLybiKMdykZIBm65Ve7+3n9SrE9YoMBONB:iN6gLybiKMnZq7ZSrdoM8NB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774626682, "uuid": "71e99430-e82a-4f08-9bc3-90bd1c94215f", "value": 182020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774626682, "uuid": "3a6513d6-01d3-46df-b579-5ce7dc6f7d39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626682, "uuid": "11e20d8b-0f10-4c0d-87dd-a51caad067ca", "value": "upnnpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e8a173-2977-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774573030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573030, "uuid": "3744f195-ccb1-49bb-ba71-3ff24cd9da1b", "comment": "Malware payload (njrat)", "value": "58a68ad2c81357deb74de83cff85e201", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573030, "uuid": "9dffc3e7-d61f-4013-825a-ab85ad18a39d", "comment": "Malware payload (njrat)", "value": "29e06296bebbc518db6262ae770a75df376b512d4c37b63b3867772f35a10e72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573030, "uuid": "5059f67e-d598-40f3-98a7-23e443e11c0b", "comment": "Malware payload (njrat)", "value": "49c191c80c72737022290e3552f9a18b0d03bd76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573030, "uuid": "bb83846d-8d33-4e98-839b-4f7d8b246ccb", "comment": "Malware payload (njrat)", "value": "dcb1c3caa158d6e3c66eb0a532f865a3b9ab7dbaa4e30df2bffb42c5546c10d8bcae197c06bac557f2c08e251c6c48fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573030, "uuid": "1495e502-cd51-4d33-ad46-8cb6f31b98c2", "value": "T1E5D3088EF696599DC21E0D734CD3101F4EA7C4DAEEEFE6DA19C82DBD5C33848894A508", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573030, "uuid": "2f0f86a4-f947-4c80-a9c5-efc588530130", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573030, "uuid": "7c7902dc-db62-4b25-9cd2-2d515f56cad0", "value": "1536:DqmNXmzTMgnT8gVbkH7tr6B31qHaA9VEHwiEu56SpBpMzTO2PNNLDIsdZrb6FlDr:D6ob4zqHhY9EfeizjPX7Xrb6F5xh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774573030, "uuid": "1aa286a5-95a6-4873-8c88-91de08917440", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774573030, "uuid": "2881c4c7-4ab7-4e0f-ad24-45217022df15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573030, "uuid": "6acb3574-2a4e-4e20-afde-5eb1b25f1e78", "value": "Anydesk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21ecbec-29f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774626663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626663, "uuid": "1773c32c-4dee-4df8-9957-e1f1a5a15373", "comment": "Malware payload (Mirai)", "value": "b5df0f8f8e5f13c938f3eade55589f4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626663, "uuid": "704675ae-eebd-4723-ba9f-eea86157b8e1", "comment": "Malware payload (Mirai)", "value": "29fbbd1d01a99b76034589d4f083c041a159fb0b713af92ef42fc5c2546c214f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626663, "uuid": "55609a6d-9e81-40c6-882e-5acce8eb0cc7", "comment": "Malware payload (Mirai)", "value": "5a581a7a5eb20c1a62dd2c708f11ee56f2789745", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626663, "uuid": "2cb4ec44-89e1-4113-b516-8ebc628279a7", "comment": "Malware payload (Mirai)", "value": "9daeb6b1b214853fc94a69500a41c4d2a238f8f647dbce0e525489a810c3b46c31ed88abcb199d566f0e04761b0f4efc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626663, "uuid": "593d6025-4edd-4be1-baae-ea7a638aca39", "value": "T1EC935AC9F683E5BEF84304B121775B328773E57D602AEF42C36EA8319862511D71A76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626663, "uuid": "5d51b417-63ed-4af5-982b-98093928c842", "value": "1536:xrsoI3jD7Rvd+m7Wpt3Yfc0xaONrSYF4mSqjKSPw88:xrs7jXRVpOt3mZx3lYf8KSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774626663, "uuid": "de801403-8756-4d87-9965-470e27f2a644", "value": 95372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774626663, "uuid": "9aabecb0-f133-40c5-9600-9a623779a64b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626663, "uuid": "38c9a42c-be17-4bba-82bc-a0c764897f95", "value": "telentd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53c98fd-29f0-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1774625030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625030, "uuid": "df7704cf-e7cc-4e4a-9724-cd5f620610ed", "comment": "Malware payload (NirCmd)", "value": "df6c173c50f48c15686ec8898f87ec4c", "object_relation": "md5", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625030, "uuid": "97a17d9d-d298-4bd5-8420-1ccd1a9a8b63", "comment": "Malware payload (NirCmd)", "value": "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e", "object_relation": "sha256", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625030, "uuid": "ecbd10b0-d318-4698-a029-6495e1e003e2", "comment": "Malware payload (NirCmd)", "value": "061142d306576626911ba200ffd36a4bc8470085", "object_relation": "sha1", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625030, "uuid": "8c6eca55-91da-491a-b7cc-401dfeed4642", "comment": "Malware payload (NirCmd)", "value": "808a2e26b0e7899faf8487fe95ce456d8ce4b8754bf20d9882f5adf3ac377e757cb06992c24427653a6331d3b7f99196", "object_relation": "sha3-384", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625030, "uuid": "be2f3f53-5410-457f-b00c-a1490d90aa51", "value": "T1FEA52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625030, "uuid": "c2bf066f-0e7f-411d-8e48-52728c043810", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625030, "uuid": "4a7449de-0d34-4285-a3a5-6639a25e52e6", "value": "49152:ABR/Tpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:aJTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625030, "uuid": "208cccbe-c639-4eec-a4a9-d56a37069b91", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625030, "uuid": "4c2d0a8f-db14-415d-8310-a243cd925423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625030, "uuid": "17e52618-3bc1-4520-a8a9-35688025d574", "value": "17745997042a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e413.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873bdc2d-2985-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774578890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774578890, "uuid": "1a747ec6-2866-4fde-a4b5-27be7381cbcf", "comment": "Malware payload (Mirai)", "value": "58564c23c139677f83fc299aa412acde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774578890, "uuid": "df3985c0-c5f4-4902-86e2-7eb68ceacf51", "comment": "Malware payload (Mirai)", "value": "2ad1a3001db9aab070aaed060b91b0c0f99d105b20ccd0750e61697d35228818", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774578890, "uuid": "a2903846-a1c4-4675-8e02-b10a727ef77f", "comment": "Malware payload (Mirai)", "value": "0c71e803814ab442f82f08fa2bc9981be9b604f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774578890, "uuid": "758be93c-6cfb-485d-acb0-c2e72c7d8e62", "comment": "Malware payload (Mirai)", "value": "4a15f479c6866e7212b34f353c4eef00356f774e8c4982fe7ce89255f1bbac6ce5d960dfd727e8219291485f5113a9d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774578890, "uuid": "536aaecb-d992-45a2-81d4-2c6f982979d1", "value": "T1C9067C413227392FF40A2DFF8D47AF1595288B7489623A3FC369B5607D382B07A57E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774578890, "uuid": "25f7f134-ef40-45bd-8f0c-d67f6b129265", "value": "98304:ZiJInMoOXM+Z6HFZQDYo0a4Gt88c/1HwNZ:ZiJiM3Z6HFZQDzEi88UHwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774578890, "uuid": "3db81b1e-8b61-4456-ae82-d2de490b47ba", "value": 3795328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774578890, "uuid": "069b0652-c91d-41df-acbe-7c4c06bce2bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774578890, "uuid": "99f35b95-6a6f-4c0e-9fa6-1d310081b19e", "value": "wlan.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5061e95-29fc-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774630157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774630157, "uuid": "36871fb0-c900-47df-a837-4e6c93e3a5cf", "comment": "Malware payload (njrat)", "value": "6cc77f4cfb1f4232dbecd72a7c99df6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774630157, "uuid": "76fd3708-f93f-4b2c-b736-2e942278fe3a", "comment": "Malware payload (njrat)", "value": "2b27e0ac82a80a95f243c3f1f55e12870f0d7840b9761cb28d2d32f08c6f9d32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774630157, "uuid": "b8a83cfa-f3fe-4700-b728-87785a1c4606", "comment": "Malware payload (njrat)", "value": "05bf61b58296ca02cc9868ba0119abb96eb4742e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774630157, "uuid": "d1433920-87a3-46f7-82b5-37e0b0ad7eba", "comment": "Malware payload (njrat)", "value": "bbb1b08390acb7b1c5535ca47c5608f2abf1ec16be057e0d706124249d2969a336630ebdb23cc38d73e61b0431a1f968", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774630157, "uuid": "87749cf8-c304-474c-8775-766ee261051f", "value": "T13C25D090B3F4850BE1FF1B75A4B1494D4BB7B9529936D78F09C8A0AD1EB37808E117A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774630157, "uuid": "aabc84d6-3035-4bbd-a6e3-2c0213be1a52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774630157, "uuid": "f19c0475-9687-4b2c-8593-44ce27bf7227", "value": "24576:0F/pQxJzck+uGW/yFoBkkAQfRK7JdU0Ob7nKKG:0F/pQTYjqqanTs17O3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774630157, "uuid": "cc79417a-fb33-49cb-956c-fe1a8d848d3d", "value": 976896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774630157, "uuid": "fd4f8081-90b2-4b9f-b41e-d8a353cb18a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774630157, "uuid": "5b50bd6e-5425-4051-a281-c22eec04df27", "value": "Runtime-Broker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d3cb56-29b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774597787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597787, "uuid": "f238c007-ed67-44a1-8832-b64dfcb56e34", "comment": "Malware payload (Mirai)", "value": "3b9e6c2d764516b65d277d20fb11e133", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597787, "uuid": "d3427136-739f-4a73-81ce-0145144f8d90", "comment": "Malware payload (Mirai)", "value": "2b6febb43bf9a1eadb08c6910276f7192b3e9c8ffb1fcbdb99770657681a3999", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597787, "uuid": "f996c9db-5dae-45a6-9509-9147de58b57e", "comment": "Malware payload (Mirai)", "value": "1cdc7a4d7c11c2f1ce583eee5b09b90983817e25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597787, "uuid": "82f92145-c845-4ab7-abde-a3a17e219d96", "comment": "Malware payload (Mirai)", "value": "05d5e81ed3c50213400a1e32197821197797020f0645e2844bab2e2edade9fb1b8cd221db11267358c1f0362ff123c2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597787, "uuid": "7152cd69-8038-443f-99b8-f46bbcb1b9bf", "value": "T183D3F841FD418F13C5C321F7FBDE46993A1A6B6DD6FA3202A925BFA037864D60E36211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597787, "uuid": "6256f0b8-e0f7-46a0-b6f9-44d05ebfad68", "value": "1536:vSnDBvJydlPpBv4yFAJcd4VJlLTyWksAw210RON4iVuNLnhelPg3wywABQEV/uWh:6DhwdlBBjX49LGWksAwU5YNbVURoA5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774597787, "uuid": "18f71075-67f1-47fd-95bc-71d43574c308", "value": 139244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774597787, "uuid": "eada3542-240e-4ed7-83f5-5a2ecd130ba3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597787, "uuid": "2d47f776-5628-47ef-a5b1-6dc9707325c2", "value": "alaska", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e8d71d-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774596423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596423, "uuid": "4ba122e2-359d-403e-a88f-c4c357ee78ae", "comment": "Malware payload (Mirai)", "value": "568552fd3d988034a22e569c7326ae54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596423, "uuid": "b50c7451-b4a5-4151-88d3-ba0d09fc84dc", "comment": "Malware payload (Mirai)", "value": "2c72d08c353b457f38c23e2b699129fe1f7cf4cbb6355acfc7ff759bfb04db75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596423, "uuid": "04629edf-43a5-4baf-905f-765c636e400f", "comment": "Malware payload (Mirai)", "value": "d938a081f8b7d2fcd9ffe17edaded0c08c1a0224", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596423, "uuid": "ddce2c86-5dbd-4463-b3dd-38754114a27c", "comment": "Malware payload (Mirai)", "value": "90ede64618934dd16c6c79bdcd0e9d6c26c689dcf9f58516da23b3d4c3a38c83d254c69ba9d694c50d0f14551cf462be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596423, "uuid": "77f49feb-1a32-4e00-a70b-c652e88bd4d7", "value": "T11A7302B221A6DD61D5B2803323873D5A79234479037463FDBD79A76FF882E515C0C85B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596423, "uuid": "7a07bf30-8e3a-4328-9d9f-2e6a6536f03a", "value": "1536:18zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWmauorS:izRnwP0bMQ2RijvDZZ1rYGhG13auSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596423, "uuid": "ad3e3509-c07d-424c-b98e-e42229966997", "value": 74780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596423, "uuid": "fe031f97-79c1-4bfb-bba3-5bb71a0e3442", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596423, "uuid": "c31f4faf-6976-4d70-9072-3c18145f56cf", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5098252c-2a37-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774655248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774655248, "uuid": "c97689f4-fda4-4103-b5c9-8398f69d1f70", "comment": "Malware payload (ConnectWise)", "value": "b5348ddf07b849cd73c679d5615ce7e1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774655248, "uuid": "8b179a1d-1db1-4e79-9c22-f340d27a9f8f", "comment": "Malware payload (ConnectWise)", "value": "2ce21659f9b6734d907539896924ecbdd4e10bcb31d7ad2f548c7577563a7d61", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774655248, "uuid": "7e6d26e5-55ef-444f-b53b-ad4813eb3215", "comment": "Malware payload (ConnectWise)", "value": "ba1ef8a8f6fb7dc6c3642637329eaccf47b55dea", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774655248, "uuid": "f5d8282b-9119-4808-9d6d-36637c8e3c0b", "comment": "Malware payload (ConnectWise)", "value": "8de5f1336e5c43b1acca2c3be0a420af71c834e590e627d36359c683092be0d75754e213aebfb8b080d6c5fa6e2b2d9c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774655248, "uuid": "091b4afd-ddd3-42ee-bd1c-15bf2c024087", "value": "T10B46F141B3D695B5D0BF0638D87A42666A34BC109712C7EF57E4BD292D32BC08E327B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774655248, "uuid": "04f0e632-2d77-4780-bd0b-f8d744cfaec3", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774655248, "uuid": "b683a014-2bb3-48ad-95c3-f9851e7fee3b", "value": "49152:/fmLDKJkGYYpT0+TFiH7efP4yfy3Ys6vPHYs00Yrxl/jgq36+hKls/LG2XwygONw:srs6efPRy3BIvY44TnDTGvyEvgVxe7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774655248, "uuid": "cdc2714f-1ef0-453d-be91-403f5a36c6b2", "value": 5670624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774655248, "uuid": "31d8c9f6-b9a3-4d5e-b94c-856b02cbe367", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774655248, "uuid": "cb4df8a9-d316-4199-b8f5-381eed7c694e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65551aa6-29d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774612334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612334, "uuid": "976b5d04-71c5-4ae9-bfd0-c7cd1023a95c", "comment": "Malware payload", "value": "e95923cac22c8000bf5d3496c793f348", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612334, "uuid": "622e6007-083f-42b7-bb70-b1d330d51774", "comment": "Malware payload", "value": "2da6979700ca47740c94446df38096017166eecb4206af33aa1d55c9346593ea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612334, "uuid": "8e744e38-9728-4e74-814c-3978f6a531c5", "comment": "Malware payload", "value": "42e02081b67eda83a43c8fc70e9516a06a13b9dd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612334, "uuid": "13ce4a03-6a2e-421d-be15-e4fb4560cd90", "comment": "Malware payload", "value": "cb68f1bed41a9a63247c70b5cf3cd549d9bbd578f61dbcd7855126373e18b9f6ae2fe8a5e4b6aa0c2f63dcdcbf20c96b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612334, "uuid": "a6766dce-e695-4903-b26f-9e76d3f69c46", "value": "T15D01928821F2307275FAA8E64A335C2C70C590573DDB2CFCBCA5B0DA95D6C00F042AAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612334, "uuid": "25a669f5-e987-4b13-a2b4-9b19338277c9", "value": "12:YkF1kcClZF70S9fFzHFnfFzHF0fFzHFWGLFfBFS8FBFM5gFNFYGLFfBFSGFBFMDE:ZDkH/FbFFzHFfFzHFgFzHFWGLFZFlFBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612334, "uuid": "9e246d74-597f-48e9-99e8-9e7792011d20", "value": 753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612334, "uuid": "62b6f855-f889-4683-8a79-678a8cc4297d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612334, "uuid": "9b3a438f-b660-426c-a0b8-4bc12781d1ec", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe37c8bb-2988-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774580378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774580378, "uuid": "d7234801-b91b-4445-8f18-f8b084ebf9c7", "comment": "Malware payload (Mirai)", "value": "a9d25b793e5b2ce40c01a02b6e57c649", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774580378, "uuid": "718b67b9-ac14-4932-b860-d07f7942587c", "comment": "Malware payload (Mirai)", "value": "2e0bd02336dd85d395ea421a9a5b1495821e207535fbbe22920b8f92cc646042", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774580378, "uuid": "2f17f7e5-221e-411b-8a43-fd284fae393e", "comment": "Malware payload (Mirai)", "value": "6f28e41e8c0364407c1e646bf698126440dbc16f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774580378, "uuid": "74c1e19a-824b-488f-a11d-c5acf6162ae9", "comment": "Malware payload (Mirai)", "value": "d40c1fbdd9b3e4140a6042a39fbc3d9b9bf73f1c5eaba2328e868ab2db4be91eb218425612446ce650b80ca38e722a03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774580378, "uuid": "2fd7e6c4-0d3d-4984-8173-e84634daf47a", "value": "T119B43959A8419791D1D02BBBFF1D934873131B38E2EFB1069D196F646BABC1B0F7A402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774580378, "uuid": "65cd0d8a-9e64-4b55-afb3-c279f38f71da", "value": "12288:543Rv800tHCDasNEeKsRLxV7lly/3/Pg3XWHaa02yN+0Ab0IMoh0JN:m3RwtHC6ixV7gngXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774580378, "uuid": "8ad045d1-71e8-4223-ad3f-47bbf4bb5fe7", "value": 539896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774580378, "uuid": "59c43e54-418a-4562-a755-2b43f7ee5305", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774580378, "uuid": "32a69a49-bce0-4ca3-a01e-e6c1b85202c2", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e8f797-2978-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1774573255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573255, "uuid": "260fc5d2-76b2-43ab-bf43-faafe358edb5", "comment": "Malware payload (Amadey)", "value": "a78a99804a98a3ba01ed01f4857c9d0d", "object_relation": "md5", "Tag": [ { "name": "1456c6", "colour": "#043707", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573255, "uuid": "c074dbd8-93f5-4f36-a6a6-6d59f0105f3c", "comment": "Malware payload (Amadey)", "value": "2e40c440729bb43a4c5e8ba6bcc07b406c59ebcd40f4fc8ca4ab405f721c32dc", "object_relation": "sha256", "Tag": [ { "name": "1456c6", "colour": "#043707", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573255, "uuid": "567c5218-ec68-4d24-9753-e3118e940cec", "comment": "Malware payload (Amadey)", "value": "673dc5eb41d04c3c887e3fb32ac5e4e101da02b4", "object_relation": "sha1", "Tag": [ { "name": "1456c6", "colour": "#043707", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573255, "uuid": "1c6c0163-f20b-4c66-82a0-9c7ca9ebfc9c", "comment": "Malware payload (Amadey)", "value": "adf71d4ed264a603d51a11422da45b0401715e35ac61be5e46654dc5ea57e6f84648ec83dfccaa1e3fce561f1813297d", "object_relation": "sha3-384", "Tag": [ { "name": "1456c6", "colour": "#043707", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573255, "uuid": "aeb04831-e1f0-420a-8895-c62073af7818", "value": "T168557C0BA26141BCD4BBE1789A175A47F775704603709AEB07E446A63F13FE1AEBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573255, "uuid": "0478cc11-5884-49a1-a81a-b4751146733f", "value": "3f175edea93fa7a76a78004d12de2235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573255, "uuid": "bf9e528b-5675-4dfb-b4be-2968a93430df", "value": "24576:mrR0NaOy0mK9yCksn6JCc2YkxfUyamitsDw+mLRbTOnW:mkHmiyCkhh2Bamituw+UBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774573255, "uuid": "247db960-555d-47db-88c5-657f0c07e4f8", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774573255, "uuid": "ce4ada12-e5f7-45fb-91ad-a927f93e622a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573255, "uuid": "3232ec60-3285-4eb5-9055-212d83acc857", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62974330-29cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774609322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774609322, "uuid": "f80a3fc6-bd72-4123-84bd-5e173db022c5", "comment": "Malware payload", "value": "c0dc67a629b840bdccc821ff79b88c2c", "object_relation": "md5", "Tag": [ { "name": "DarkSword", "colour": "#08D553", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774609322, "uuid": "50168329-3078-48c0-bc7a-f95d7204dfb2", "comment": "Malware payload", "value": "2e5a56beb63f21d9347310412ae6efb29fd3db2d3a3fc0798865a29a3c578d35", "object_relation": "sha256", "Tag": [ { "name": "DarkSword", "colour": "#08D553", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774609322, "uuid": "6022f473-4b7d-4976-b175-53cf7b2f4124", "comment": "Malware payload", "value": "69cc60a53b6d1f3c726918777fe7f2c5696f3ef6", "object_relation": "sha1", "Tag": [ { "name": "DarkSword", "colour": "#08D553", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774609322, "uuid": "ba426a2b-62e9-4f9a-932c-c2758aa9a03b", "comment": "Malware payload", "value": "6972454d1d5b6871f49b454a384f1c23e7e17a07fb7c813b24cd302c6edff44e051adeea2702f21074c9502956158212", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSword", "colour": "#08D553", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774609322, "uuid": "5a422e83-e2c6-46d0-951b-f6859c3b10e3", "value": "T126C40844EB9DEC56A2E031A54C1884C575BDC23FA4587CAEFCACF574358DA09C2E8B36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774609322, "uuid": "1a115c21-1014-44ba-87eb-c1fbfff4af95", "value": "3072:SzkhdX0lVOwOjZbFkAmgH2lR9rGidRWiFU8MfsYutcSTwXtlaEnUxsX7XztXOnYA:Sg0GidRI07GSTwdwEnNm1Znf00VNzwTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774609322, "uuid": "b3d007b7-1569-4969-ab74-d987b83c9116", "value": 562332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774609322, "uuid": "cd1927db-b775-491e-a21f-f5aa7ef83c7b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774609322, "uuid": "f210ffd9-5434-4ab1-8bc4-4a2b1f949312", "value": "ghostblade.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c455c8d-2a1f-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1774644853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774644853, "uuid": "571a7f48-0ab4-42ba-827f-10c565666158", "comment": "Malware payload (SantaStealer)", "value": "e8eb6cb596e6c89e2f64d258d92706d5", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774644853, "uuid": "69a4106c-bc2d-4e5c-815a-437982a97618", "comment": "Malware payload (SantaStealer)", "value": "2f3d8bf8174044b548617536c952f5c8ed96896fc7252ae8fd260279cca8471f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774644853, "uuid": "e46a9f4a-a8f6-4cc5-b9e6-8b0c66d059dd", "comment": "Malware payload (SantaStealer)", "value": "eb8a4c27abbf526ee88d6780b0c0758847e1f6f8", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774644853, "uuid": "2f53856c-0764-431a-b399-993ecfa54778", "comment": "Malware payload (SantaStealer)", "value": "0d78ed024fdaea070c2fc65bf464c0c850f2c6b3541f75afa54afc66b82669942461fd01ed5fde5a01f9650658bcf585", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774644853, "uuid": "99eef9b2-ab7c-4b7f-bf32-4d544039dc77", "value": "T16E268D27E2A360FCC56BC1709747A632FA31B8490534BDAF4694CB313F62E605B6DB64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774644853, "uuid": "99d6dcd3-6735-472a-9fec-6203f71ebc5a", "value": "706cbcaa5f85f4fbb9221e2958d5bf6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774644853, "uuid": "9f3fa4be-63d4-4b08-96a9-b9c3b43f3fe4", "value": "98304:T4u/dBp6QRmDXMlSjHPOn3RxjHNqJUjv:TZFCDPQtqOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774644853, "uuid": "1fd9c4e4-a61b-4a37-b76c-b773f0d6638b", "value": 4469760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774644853, "uuid": "087c1fae-775f-44b0-993a-0dd0dc020e15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774644853, "uuid": "fdd875e0-1d49-4d61-aa72-7ec2e8df37f9", "value": "2f3d8bf8174044b548617536c952f5c8ed96896fc7252ae8fd260279cca8471f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "219deba7-29fb-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774629400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629400, "uuid": "18fe7f39-8e62-4ab6-a1bb-02ef608849a1", "comment": "Malware payload (AgentTesla)", "value": "c72a1aec95b82f2f6f6b77fd9542888f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629400, "uuid": "607e5afb-fbec-4b93-87a5-74d01561c76e", "comment": "Malware payload (AgentTesla)", "value": "30829f3086c52d01a07501ea2ef51c0c94ae8045777e117feb7b41cb0743c421", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629400, "uuid": "da557df3-31c0-4fb7-b35a-4c1c2c6bd854", "comment": "Malware payload (AgentTesla)", "value": "e0acbbade5edd9e67737c557a4cbaf089bcede59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629400, "uuid": "0e758c11-b946-4029-a2eb-23fdac5ed7c2", "comment": "Malware payload (AgentTesla)", "value": "e28b83c7554ac592aa41fc6daf549c1bece5d3c0f44f9ccb3e8b69684247cba1b19a09c0fa048dd0cf5a5ecd358ffe51", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629400, "uuid": "58918caf-30db-4828-bf17-8f8341e0d415", "value": "T12AB4E043360885F1CC769B33E52781A92A3848FD51D8658B7BEC67EA2D70B11091FB7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629400, "uuid": "bf84c027-4eea-4b60-a52f-ed7315fa8fdf", "value": "e2f3f8ec66b7e1900c37978aca89d3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629400, "uuid": "2867f88e-c3d5-4810-8a8e-61c9dcc3ab55", "value": "12288:hoLwPbwqDsdGkU6MZDMZsU2k+xeimj5fCTuq:fbwocbMZIZsU2nxeimNfCTuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774629400, "uuid": "95e79d28-f3c8-49d9-82d4-4b95094a1e12", "value": 498832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774629400, "uuid": "fd9e7ed0-e81b-46e4-ae5a-4a15f10ecefd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629400, "uuid": "d28ef8b9-3ad4-47a5-9380-c9a7023469db", "value": "Nuovo ordine n 1557.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961c3793-29ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774601678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774601678, "uuid": "e4e85617-e3b7-4ef9-b1c2-b754ec2d85b6", "comment": "Malware payload (Mirai)", "value": "a1da4ed25eb370c404a8b30405acba9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774601678, "uuid": "4c6027d4-a3ec-4bc7-93a0-86bbb09df844", "comment": "Malware payload (Mirai)", "value": "30b94ad2d9b13c24a5a6a734f2e9932fdf942111d9ce660a108eb4d4de831f1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774601678, "uuid": "4a45a1ef-6a22-4bef-ac17-075df6371e87", "comment": "Malware payload (Mirai)", "value": "e7fcc7d5053f928e41dde8efa98a0ea891535fc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774601678, "uuid": "8e466fa4-2873-4f91-8979-0c212d5ef391", "comment": "Malware payload (Mirai)", "value": "3ea78f5d0722177a85011ac39c64e3f9e2a04ed85cd75aa37153e34563e07ceee984ecce91cc2ecb2dac2f777525163f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774601678, "uuid": "0896f4a8-e0a8-46e1-b374-3d57790bf694", "value": "T16F069E95B645352FF8499E3EC902BF669F3C97350443163FC138A9A86A302F43997BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774601678, "uuid": "ed17b499-38c2-465a-a75d-75c51ed9c3cd", "value": "98304:GHqyeTk9XoLI+7kZxrZZ821VItW3UhfW94M:Z1Tk1oLIZZ8smtW3UpW9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774601678, "uuid": "13d28d3a-09a4-4a8a-8695-ee458d34c569", "value": 3854488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774601678, "uuid": "ff98adac-7e46-4ddd-af08-c0cc9f5be8ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774601678, "uuid": "ae23f734-3c69-4fb2-b480-e291576cfbac", "value": "wlan.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1079c378-29f0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774624647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624647, "uuid": "6ee6f7f0-7f55-46f6-aa11-daa940295208", "comment": "Malware payload", "value": "3e4e3e44e42dd44dd42033043618744d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624647, "uuid": "ba550bb6-6d31-4893-b877-fa245d91ec2d", "comment": "Malware payload", "value": "321a7f927f1b800c3776892d20c5fde739c68ce35fde3d71aeac1a6704a4dc03", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624647, "uuid": "27f06398-e93b-467a-9169-73dad9537c3b", "comment": "Malware payload", "value": "d241a60db4d42c24d39fd0b16ca9d8efecaea5cd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624647, "uuid": "ce82649f-dea6-4360-95aa-c7ce1a48b971", "comment": "Malware payload", "value": "71c4940d978c675b43db63f59337fced9066aa9e02d288712d54fa3254fa80911e2cf8575e31057da0c8b0bfff834d39", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624647, "uuid": "e6342212-f6bc-4361-9252-8a8b8331c019", "value": "T102F01DCA2666D77AA699CE48B0B3483AF01FDAC031E50E4EDD8B1DBE0F41810B114F68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624647, "uuid": "d6165078-2886-47b0-a47b-f5958f320b7d", "value": "12:aUOW8oMHf8MwQLGWcM+O4+ONn7MXwlNUI:YGIGWkqecUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774624647, "uuid": "c57dcffd-9cc3-48f0-841b-da5f79576be3", "value": 558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774624647, "uuid": "5d4f37b9-818f-4336-be1f-dd50b8c89d0b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624647, "uuid": "e9ea178d-ffc7-4b1b-b80b-2ac9150dd7e9", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26e0853-29d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774612033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612033, "uuid": "bf5a92ed-1705-44f9-962f-9047fb9e377e", "comment": "Malware payload (Mirai)", "value": "e295d3fb29c08383e30160fa8bac80b1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612033, "uuid": "b94ec1ea-f914-4f9d-9acc-334f68ba53a9", "comment": "Malware payload (Mirai)", "value": "353f24c618d7e58beb6eca412c5561186ee85b11e8b9a5588854f0d2557cf859", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612033, "uuid": "63306df5-7288-41af-b148-c624bcf7fc49", "comment": "Malware payload (Mirai)", "value": "1c98fc5f8f8c6e164a63b732f1a2b7d932355eba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612033, "uuid": "84395a9d-24ec-491f-9804-2672dff32aa5", "comment": "Malware payload (Mirai)", "value": "29fccc09779df294defbc32206e3628922a35f50f77dfc2e86272212d00a3603204111212cd19536be7f12a51554a74e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612033, "uuid": "11a03ebc-ab8f-4b43-8871-5ceb9a24e522", "value": "T186B3E84E6F319F7DFBA8C23447B39A21975823D227E2C685D19CDA011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612033, "uuid": "813f22ef-0a9c-4a7b-87c4-03103f6ae350", "value": "1536:SEkWiTLiZECcpHOWWJDmmn5Pd1Oe4qPrs9j4Zinyk7+TeVedVPneQBZN01taD:gni50poFfP49j4+7+Te0dVPZ01taD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612033, "uuid": "2aa64473-36ac-4bfa-9da9-230f93183e80", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612033, "uuid": "e3fa4d48-636b-4d37-aff2-6f71c49e8fdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612033, "uuid": "9cd8d14c-3b32-417a-93e2-b0e7f2889c1e", "value": "windy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db499cbb-29f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774626705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626705, "uuid": "9f490024-3ef6-4d9c-9128-cc34c23fbdbe", "comment": "Malware payload (Mirai)", "value": "8bc80a2e8ea17b94261a936d7bcb4ebd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626705, "uuid": "9bfe2da4-8a6d-4c84-a8b2-90e895a78dfe", "comment": "Malware payload (Mirai)", "value": "3599ab10c328dc2f72b47645e6fe7bb413edf4f3ea4e0662f48739cf84bed57f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626705, "uuid": "d91408f6-d2e7-4004-a2c1-4bb23f9cd8bc", "comment": "Malware payload (Mirai)", "value": "e33163e94faad30330b12eaa6b29a17e0cace6f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626705, "uuid": "ee3cfeae-445c-44fd-8a79-9db5112cbba8", "comment": "Malware payload (Mirai)", "value": "49b142913d9ebb76885dc5fc699d4b35988c042e6257724f2094432bc0789aba9366b9f34a8cadf5af646ab4ce67a128", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626705, "uuid": "b8946fbf-3993-4a6c-b56a-c67f64ad768a", "value": "T157A35BC1F683C1F6D85304B16163BB3EC732DC685075EA19EB6A8F35CA33941A627369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626705, "uuid": "9d74ffae-0265-47b4-8300-e732c5f86ae2", "value": "1536:/d3yvUc9ondS0XujWa1GhARWSqG51dxzRJWgVGXoxt:/d3yN94S0+jlA1S1dxzbxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774626705, "uuid": "8626e745-eee4-4a9d-a99b-38861e858bf7", "value": 98540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774626705, "uuid": "ece49664-5961-450f-acfb-69a866eb1377", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626705, "uuid": "e21d6e4e-c283-4a94-a0af-c8b27837ca1d", "value": "httppd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd4d899-2a25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774647565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647565, "uuid": "07c81e08-0ed6-4bf4-a3ce-aebe6a12ce94", "comment": "Malware payload", "value": "e809327751e5ff51291b727e25044327", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647565, "uuid": "9573bbc8-74ad-4dee-9e14-67b84d6413e1", "comment": "Malware payload", "value": "3688ae49032f1e3980cf82ad0cea1ea5d99fa35255f3488307e2daea780b4428", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647565, "uuid": "f7fb5ba1-8392-4e64-88f8-58aad9ecaec9", "comment": "Malware payload", "value": "d7ac2e45ff726597829f0a0bf9ad5f2c7e3d8324", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647565, "uuid": "cb30b7df-0f83-4bfe-a39b-345521f3ceb7", "comment": "Malware payload", "value": "262d60e3b719d92792b1e555c297abaf7295cbc139f5c04b09d6e60ed9f0ce9f5fcfedf799cb9aac48691aeadc56551a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647565, "uuid": "57beff84-4c00-4c8f-b654-74527da1d98d", "value": "T17446A3D97AC457F0A529ABDC8247B4CD0394A17E6FBB580C02E458BD3C1AE1766E0CBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647565, "uuid": "b607bb24-1d6f-419e-b684-389aaa276862", "value": "24576:erpP8gGo3PgxRHjkN9Euz6B0KYGmo+SYxg0mFTwzpsSQ3zq6Z/pxDZASqZ+ZeeYj:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774647565, "uuid": "7080cc12-b504-42c4-ab47-217687aba1de", "value": 5529664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774647565, "uuid": "d8f45898-e7b3-41ff-a984-ced565dfb2bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647565, "uuid": "e45e909d-004b-415e-a6e4-5f8f20d620db", "value": "chrome_200_percent.pak.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f16e7c-2995-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774585892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585892, "uuid": "516d4868-6d96-4c99-96f4-1d639c0d7278", "comment": "Malware payload (Mirai)", "value": "da6f69261f3c0302d57ccef8dde87393", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585892, "uuid": "bd7d7eaf-bbcf-4c14-8c6a-ae2e5c4fb836", "comment": "Malware payload (Mirai)", "value": "37170499de9f3bd1d60bac965a4a56800b07da0d8ce96622cfc1fb01aac6e053", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585892, "uuid": "d593e443-dc4a-4111-853a-56d0a985a645", "comment": "Malware payload (Mirai)", "value": "848243fb3d8956cf2afaadce57d3b3039d43f45e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585892, "uuid": "25c7e5e7-d77e-4110-9834-f3afad366806", "comment": "Malware payload (Mirai)", "value": "b33027e5fff5660f8da5224e78072453a4fb980e6a106a346a7366089fd65e0d9bd15d024efe47596bc205b0c6a8a42f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774585892, "uuid": "645f85b4-1115-4e82-867d-26a79b1fbb09", "value": "T1B9853371801B2F72BA57BDBC7CF51C5A68CA0993D50F6BBE29AEDC5848B4DC04902F58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774585892, "uuid": "a52ff0b0-aa58-47f6-a66e-294288888392", "value": "24576:fDsROwa23P4wmZr9G/TmmbutpZeXbh7AyTgksbx4214dSJjhQQAGweMDNDwpKb5Z:fI6SP4HrBmu1eMydSZuhDNDsE52aTYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774585892, "uuid": "d52300e5-dd1f-4d31-a369-4d68a0bbbb60", "value": 1718268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774585892, "uuid": "a88e697e-1977-4a05-8586-20469e60782c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774585892, "uuid": "93ff80d2-d4d8-4387-ad1c-ca232426cb4b", "value": "wlan.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aafc054-2a22-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1774646219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646219, "uuid": "ae6251ef-3a05-4bed-a4e3-fe3f8f9d5cad", "comment": "Malware payload (Efimer)", "value": "01a031dbbcf4bb8108de28393acf2c0b", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646219, "uuid": "00218e13-4c4e-4895-ad39-bffe6f2d3e88", "comment": "Malware payload (Efimer)", "value": "382b3cfb2c94415156443a00d95174e3cfbe75c6975e3cb1e609bd78d71d8b1b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646219, "uuid": "dd77117c-7f83-46a5-ad86-0b98696f87bb", "comment": "Malware payload (Efimer)", "value": "0e24d1eea77acd8712e29d5641465d739438c6b7", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646219, "uuid": "8d12f4e5-bfe8-460b-b17b-c828880cef03", "comment": "Malware payload (Efimer)", "value": "512437b46e50e50a0a11edabf84ae36dfa4ee50d01982f491bbf4089e564008570a50da3baa9c3793cde5e4fa482b382", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646219, "uuid": "3e5e3f8b-70fc-4ad0-ba98-4def5fa0bcad", "value": "T131D6330454D2B1FED6A3A074FFE06BF0B57934A6523ADC3A6A54C3F4BC874814A1985F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646219, "uuid": "06996e17-46c9-4e51-8605-c9eb060c6a09", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646219, "uuid": "8fdff9d7-9ce6-43a8-9dc0-c0046c26ccb5", "value": "393216:S03GC9IWA8eNYXMCHWUjX+cuI3/PGTAI:S03R9Ip8emXMb8XzH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774646219, "uuid": "cd9399e5-c347-4664-b128-1a532d84834f", "value": 12628254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774646219, "uuid": "fdc9e74c-f958-4fa9-933d-52f69b9d49a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646219, "uuid": "ea7a3b2f-6439-4486-887b-844108d02a4f", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061f397f-2975-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774571801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571801, "uuid": "f82d0b6b-131a-4b53-87c0-1b4bdd2bfd90", "comment": "Malware payload", "value": "1c05e4cd914c08cc5b91fbef4826d163", "object_relation": "md5", "Tag": [ { "name": "britanicauniversidad-com", "colour": "#7FFAEB", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571801, "uuid": "8dd0786c-57ca-45c0-8f69-971bda46e91a", "comment": "Malware payload", "value": "390806eadfb9c5d57aa3e5d7db949be33d87b00778db029c7d27c202fa550bb4", "object_relation": "sha256", "Tag": [ { "name": "britanicauniversidad-com", "colour": "#7FFAEB", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571801, "uuid": "822a3415-785a-4517-84fe-fb4cffe3823f", "comment": "Malware payload", "value": "3375c0fb2011c17703cfbf74d9fc5559a72e332f", "object_relation": "sha1", "Tag": [ { "name": "britanicauniversidad-com", "colour": "#7FFAEB", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571801, "uuid": "dc8c9729-0dc2-4c71-a5e9-543dda51cf04", "comment": "Malware payload", "value": "3bec008cc5311d220220f8c291a66943a44c78a8423d6e28a7676d2c8778f566ced1f257569bc442bcea5778c727ff13", "object_relation": "sha3-384", "Tag": [ { "name": "britanicauniversidad-com", "colour": "#7FFAEB", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774571801, "uuid": "1d211d7b-5297-4870-b096-9fde78ecfe11", "value": "T177254C23F3C6653EE5AA05795B73E220953F6A51751A8C6A9FF00C4CCE2D4402E3BA77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774571801, "uuid": "7eadc3f3-10ec-41bc-abd9-74e420ddd7b9", "value": "18cfd29c5cf72e6a8f85beacd3500aa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774571801, "uuid": "005d6f2a-e23e-4c96-9ba6-7b64c637909b", "value": "12288:NXycdmcval7ynGQI0JmRVz4E6x3VOoxTYu//k:RyJka0nA7Rh4Ek3VbTYu//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774571801, "uuid": "3c8988a5-f237-4a31-8edc-8a03f7a01549", "value": 1005056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774571801, "uuid": "68ea19fa-a9a5-4830-bdf0-1bc03b2fc5dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774571801, "uuid": "832c04f2-4a43-4f93-8a51-928b0ea254ea", "value": "3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca71aa90-2a21-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774646004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646004, "uuid": "b4ac54c3-d3db-42a3-94bc-e93eff7c9399", "comment": "Malware payload (Mirai)", "value": "619af57268f2f32af4310b92c4523d5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646004, "uuid": "44cc9aea-37c4-4bf2-bed3-b5d05e0c3014", "comment": "Malware payload (Mirai)", "value": "3d0e371e1cc84ee64969cb49f4c7ce1edba564873434fa6b352e7bf056ea7eec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646004, "uuid": "cf474b61-933f-496d-82d9-56c6f5ad18da", "comment": "Malware payload (Mirai)", "value": "f44ffb8803a1ccd1414e9ea337b595890395bca7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646004, "uuid": "866e310c-a32c-48df-91c8-2f126f3b6fb5", "comment": "Malware payload (Mirai)", "value": "086856ddff4c3fd751c562dcb7075761d8bc1da99edb922af69c4c5effa3ce798d56d9fb9fc6f8d5e7d53a5fce006cc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646004, "uuid": "19c4a539-0beb-48fe-b4b6-f4d9a900ad26", "value": "T185A36BC5FA83C1F1E85744B060676B3EC732D8685035EA1ADB6B8E35D933941D7273A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646004, "uuid": "fae41eb5-2200-4888-9791-a46448300421", "value": "1536:+10IL20y/SvxvwbzmSDhvSW+QC2zLX5TSvwsUbGoJo:+10F/yxvwbLJ7C2zLX5tJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774646004, "uuid": "e95b0f1f-d7e0-4fe1-a09d-194e425f7eee", "value": 98828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774646004, "uuid": "0d6e1bdb-aead-458c-9940-89a808355f27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646004, "uuid": "a7108007-f494-4b31-934e-c97a12e6eb52", "value": "httppd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da10e6f9-29ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774596208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596208, "uuid": "4dc2a131-4eee-43dc-aad4-357c10a5b903", "comment": "Malware payload", "value": "9c9c63f3d5d33d5cde2ff28aa2735907", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596208, "uuid": "0ec5731f-160a-4a84-a8b4-a8456147228d", "comment": "Malware payload", "value": "3dcf62b7cb57aca7caaac7da81cbd54a2a274d408f0eb83e0ed14838d9d52afc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596208, "uuid": "cd926fa3-7b63-4f41-99a1-9f53a449031f", "comment": "Malware payload", "value": "26f8aed20c9a9d4d97729b86751ea25721ff2d6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596208, "uuid": "6120c627-38ae-43d0-9386-4dbd008f899f", "comment": "Malware payload", "value": "43cdd7da1fbbce5d33161ac423cb76e9d4cc064b606ee774a5580d68e9fd5b48f68577d004277abc933472058d65085c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596208, "uuid": "eeca6aa2-8db9-444d-9826-56fead340ead", "value": "T159953B43E2B351ACC52BC234476B97B3EA31F85811347FAE1964DB312E12D706F5AB29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596208, "uuid": "498a110b-5c31-43b8-b92d-2127fdae6ba5", "value": "791a76d410ad7144fc44910e07c4a847", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596208, "uuid": "763f583e-1c4f-43b4-a9a8-be838ca3f4b3", "value": "49152:cUodfiTN9f57ixdMKb8tvQFrpmIGY5YqDwkV3aqxU2:cR1ijedMRM17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596208, "uuid": "1be84864-8eed-4768-86dd-3fb28084fb12", "value": 1996800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596208, "uuid": "44e205de-8b7d-49ba-a2d8-c20b0cb62af6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596208, "uuid": "0a3959fb-da04-4a3b-bd01-60c7b41550aa", "value": "perl526.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563f5c60-2a1a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774642802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774642802, "uuid": "9e5680ea-7ef0-472e-b9da-744d6e52da3c", "comment": "Malware payload", "value": "0b1f1f573a7d947f468aafc29f6d97fd", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774642802, "uuid": "43c6e0f2-5a0f-477d-a004-1a7e8b2aa881", "comment": "Malware payload", "value": "3e6edebc2da9a4a80507eeb7abf529c9c3a70201927f1ae864f9f257ca64bc2e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774642802, "uuid": "57257f4a-5587-4a86-92ca-f7cd4f9c603a", "comment": "Malware payload", "value": "34dacea9525c261b9948bdca9a3f63a525f32c40", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774642802, "uuid": "c6f87409-ff16-4fb1-b170-c0d6fe974cf9", "comment": "Malware payload", "value": "36857fb86ee2c1cf4ba8dd0ca285de3a1f9712a16c056ad1d9cafdcdcd77acbbca4c8b57dfc1f8e5b6cb8ac4573cfc0e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774642802, "uuid": "90903dc6-c1de-4ef9-b641-3d35355e2397", "value": "T1DC072285FB44E52BC17B8036C5BA5627918B4C128F83D7936D45764C68BBAD8CF0AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774642802, "uuid": "1ef7a058-a652-4fca-ac96-56d1818e240a", "value": "393216:NJuJwaADuRW5Uq2Rt0eLuZBtxvj0qJDursiWcf:N+zWtat0eLuZBtxvBDViWcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774642802, "uuid": "488fdfe6-22fd-4620-bcab-4b90e28bf1ca", "value": 17423890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774642802, "uuid": "18d9db18-4678-4446-bc16-8e8bb6907fbe", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774642802, "uuid": "32e1c5f9-5b04-4bbc-8eec-e84902102b51", "value": "FL TOUR BD.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8425e5-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774625101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625101, "uuid": "a77bf5eb-540a-42a3-be61-964348459d1c", "comment": "Malware payload (Mirai)", "value": "79ed55cb51f79b82675d30d88e81f321", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625101, "uuid": "183222f1-7e0c-41bc-a666-e51b04cbefaf", "comment": "Malware payload (Mirai)", "value": "3f0f9e048070dad1a8e3aa56185134701cf69cf579ab5ab6a53350dbc9e7d043", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625101, "uuid": "3497bd9c-9e1f-495b-ab83-311bfeb05f7a", "comment": "Malware payload (Mirai)", "value": "6b239a271c45455c4d3fec11885117718e0394ef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625101, "uuid": "37f541d7-61bc-4db0-8f53-3590ac674914", "comment": "Malware payload (Mirai)", "value": "370a211503fb944097a6fe95e99cf1a90e1aaba49a8c76186feac33bdeab1b43bc469bda9387ed7f8d1119cd4d19c799", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625101, "uuid": "788e4048-ff6e-4057-a802-9cd4dbe8224b", "value": "T16682CF3051AB74E5CBE14431EAAE8EC6971A0BF8C1FC36D316486F78894210221F97DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625101, "uuid": "aff7aa23-af37-4843-a69a-5b09cf881dad", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMa6yhymdGUop5h5lI:6GV0P6+kom0tVAoNvm+to1Rs3UoznlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625101, "uuid": "49844b70-9488-4493-94e0-045669746713", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625101, "uuid": "0d936880-6c48-4e09-9ced-dcaa379d6c00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625101, "uuid": "03d87eb1-0d4f-48ad-89c5-5c771377844f", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b937de2-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774596399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596399, "uuid": "4b70aee3-9497-4c12-ba8c-c5df87f7fd55", "comment": "Malware payload (Mirai)", "value": "1b4354de9d85a2430b6362f055331bba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596399, "uuid": "778357a7-95dc-4205-bd02-759e16e25f9a", "comment": "Malware payload (Mirai)", "value": "3f627119aee81a21ebabbbbe2e2ed465a98707ce6376f11e2eb4349261dbbd91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596399, "uuid": "004d802e-d768-413f-a1b3-3dd17b305a9d", "comment": "Malware payload (Mirai)", "value": "c853a560b0bee321e20dca2485417aa32f68b39b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596399, "uuid": "8b70089e-ae5f-4d4f-81fd-6175da04c7ec", "comment": "Malware payload (Mirai)", "value": "3e9527e8db6039a789d61ec06214539c40c7d16ee681ebee351d95c75f2228b15b22d5b3dbe190fe9fd3558ea94403ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596399, "uuid": "b935b707-797e-43c3-89f1-a3df098136ce", "value": "T1755302521AACE82ACEE2D5390B7840E687D859B45492501E53CD78FC8A06D7CFADC5CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596399, "uuid": "c32234c5-065d-4527-b4fb-72691f74a882", "value": "1536:Mdcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/uVZmHAQA:MaHJgMo8FwOA4zUFGUO3UhAXmgQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596399, "uuid": "91a0fdd4-7c6c-4892-80a7-ce3ee36c8d5a", "value": 63928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596399, "uuid": "c9f5f1d4-3ca8-4023-9c69-01d90e0c25a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596399, "uuid": "45e8a501-aed6-4592-a4b4-49d455a2a86d", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69bf355c-29b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774597738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597738, "uuid": "9414194f-b8ea-4b23-a85a-b2c2ec09931e", "comment": "Malware payload (Mirai)", "value": "faa9e79adf9fdcd6be4ce13581b9d8a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597738, "uuid": "14429892-1a80-462c-95df-1f85329386c8", "comment": "Malware payload (Mirai)", "value": "3f9e3b8acf70dc1fc178cdecd755eb9cdb8f8367e2a8ec884aa181932392dce3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597738, "uuid": "19911d5c-c1e6-473b-bd32-16d5f7d66d54", "comment": "Malware payload (Mirai)", "value": "f9ff1d0add6623f1351df2fe964bb6b889481895", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597738, "uuid": "d00e4a2a-4c32-4257-9037-085208c5853a", "comment": "Malware payload (Mirai)", "value": "2806c0b2b827cdd7b2a701e980186043f9e4ca9b10fc488c8acbfed237946fb5bd342f3ab2da94d7452473edab1f1eda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597738, "uuid": "96457401-5130-4ec5-bdaa-434cf1441b65", "value": "T1EBE30A06F9519F12D5C321B9FF9E425937132F78D3EE72029D24AFA0274A8FA0E7A115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597738, "uuid": "c901358f-e605-41cc-be29-56f8d2fd93c9", "value": "3072:vviUAfoc2GZXkEr2NraJp3ASfM+aRptijtYb/m:Cnx/ZXpr2tajhM+apijtE/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774597738, "uuid": "96a431cc-997f-4084-968b-a3e79aac0591", "value": 155756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774597738, "uuid": "aff067ff-19ef-48d9-ad41-6a846234ecec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597738, "uuid": "2b22a337-1122-4283-a56c-4561ff1c44e8", "value": "arizona", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12cea487-2a26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774647843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647843, "uuid": "ab410a20-2284-462b-84b8-df8a64990ead", "comment": "Malware payload", "value": "428b387f7aead0378ec42073de7cf01b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647843, "uuid": "f2177625-0461-4872-8ec2-3ea923ce79e7", "comment": "Malware payload", "value": "3fb70248e9db2bfd2d8d4ad60b752fc3fd9b442b58a30f8239da561e82a791f3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647843, "uuid": "bd63a698-9445-4412-9553-4e85f0379b64", "comment": "Malware payload", "value": "29a3e29ed3026080d7225b59118b9931615fffd2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647843, "uuid": "81e9cd75-9182-4dc7-9c13-a2e306971f66", "comment": "Malware payload", "value": "8b8cfcdf4f0533006dd803baea1f1b50a50c30cbfd9d507f81d6d3a61fa02a728b4be439c43a1480025a904126138d5b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647843, "uuid": "9786a876-d3ec-431e-82d8-44f2bd465810", "value": "T1BEC358E713D80AAEAB9089D7C549760754EAC17B2C5E1288F9E25607F13F920B726F70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647843, "uuid": "ebc8a3aa-c569-42c9-8b56-bd6abcdb8a80", "value": "1536:uw93S/7yPsd5LUPR+OjOJKR3qVfSdMhC7FN3qIXJNgWfHcrvQRo+pJaOLL4OeTeD:LGRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774647843, "uuid": "0ba5ca6e-ce8a-472d-946e-d6c1c2d2d8c9", "value": 129124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774647843, "uuid": "0ddf896a-92c2-4d60-89cd-ed7d6d7c7f59", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647843, "uuid": "23980773-5a00-466e-a124-7b28b7beaa28", "value": "index.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74181415-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774596467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596467, "uuid": "afb4a313-67fc-4b89-9c2d-571af38da49c", "comment": "Malware payload (Mirai)", "value": "c92f958fdc734b878393af63721e7c86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596467, "uuid": "db432660-d5e1-4b14-bb6e-ecf52e130f1c", "comment": "Malware payload (Mirai)", "value": "405479f576b39e7a5cc7de3039e5d7f6c5c7ba6bbcf3e41c625019b06015fccb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596467, "uuid": "f8ec51fc-d3e8-42bb-a5e4-56bfc00a5ad2", "comment": "Malware payload (Mirai)", "value": "c896ffe27f417a3ef26bd1d3645d35dfd60c4df1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596467, "uuid": "4b24766c-08df-40f2-b18c-55c4ba084c39", "comment": "Malware payload (Mirai)", "value": "3fd8358c17a7ebd12056f4264e73c67a86cbe96f2677635d3ed8b7561723722898676bfd9e57d4840c6333f8b301ff34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596467, "uuid": "55c33409-47d2-4e28-ad8f-e8eb17d2ba23", "value": "T112F34B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596467, "uuid": "23157692-9718-41f3-831f-bd0934f43828", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziH2fam:9FJMgWPZr8IaCWReS1WpPeH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596467, "uuid": "42d3eb09-185e-4183-8900-b64c1ee1cbaf", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596467, "uuid": "76b91fc4-465b-4692-acd1-cb42bc386d9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596467, "uuid": "986d2754-5b70-4283-913d-1f7348432879", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1a7960-2a23-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774646893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646893, "uuid": "41dc68e7-ff0c-4dcf-a607-8b89d9e01595", "comment": "Malware payload", "value": "b0a4773c766d5781da7aff9aaa161e5f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646893, "uuid": "9319e26b-01a3-402a-844d-59046d269192", "comment": "Malware payload", "value": "415807633a3f8987e0a918a3125b1453f1405d94290527692912304c1a6599aa", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646893, "uuid": "84d11de0-7926-48b6-b204-652cb6b7aba0", "comment": "Malware payload", "value": "2b2099bf03132bf77e2de2d2e25683e30ce2ef68", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646893, "uuid": "6d04bf3e-bdda-4dd7-8e9e-a4156e3ed64d", "comment": "Malware payload", "value": "9eb0ec2a217980c757a4fa0af4e44b01ead526fe8467a70bb8da4a407f53290686d43e4e515d4072f548fd8a9b02c149", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646893, "uuid": "bd5ca285-4e4b-44bd-86fb-838243ba7402", "value": "T152D340DA8DEE84F88B6F6034416F5C02CA8E55035A1FC6417A9FAD423F63EA570ED8D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646893, "uuid": "0b7fea30-e77c-428f-982a-cfe0e9345c29", "value": "768:vf4V28tTVRJmN8+iOBjkn8fdXjzna0gkhihzynNnSTkkE/Bb3xCUDz6BjPkvxE8O:IVRei5aNJbBIZ8QR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774646893, "uuid": "5b9dea88-a282-4059-9872-fe34bb84a867", "value": 132411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774646893, "uuid": "b97eafb9-7c39-4ad0-9ea6-e14ba0a9d672", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646893, "uuid": "37dfc3e7-1f2b-4458-9483-be1daedd4a5b", "value": "Client_Omega_Archive_365.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9f5d8d-29d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774611997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774611997, "uuid": "cca919b3-cfbc-4535-8aba-05d8db356a23", "comment": "Malware payload (Mirai)", "value": "e0b2103bb8455736f95f1c0440afd109", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774611997, "uuid": "9708ec53-fff8-4135-9688-74448a10a784", "comment": "Malware payload (Mirai)", "value": "41ab613297a4bfc129b837dbf4e8391a9ef34ae9b5cc3c1c19be731b85d71c1f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774611997, "uuid": "b4444891-3747-46db-a0c0-ca79acc8eac9", "comment": "Malware payload (Mirai)", "value": "ee02434c7eace372edcb08d8ce785295ec0e2de4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774611997, "uuid": "f335ac84-4a62-4d1a-9764-9822b4a0083b", "comment": "Malware payload (Mirai)", "value": "b2f5adddf68bfd4494586ba9e03f68686b394d8d377e33bb0417f60373534131854cb95573e73158e6d4a2784b4a0d2a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774611997, "uuid": "95786b99-183d-4318-b8aa-7a0176187f8e", "value": "T15043F22EC45C1CA8EA98C03C2DECB3495DB0D005FBDB95E48745564EC983BFEAA64DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774611997, "uuid": "560e5c3a-197f-4833-a48f-4631437d1c6e", "value": "1536:2GIsYa2RmMEH6D1IqZdHXXCbgOg5R/GQRHPi8nouy8KyX:2GIK95q2qZRXog5R/GcHKcoutn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774611997, "uuid": "f82bd2df-4d38-4e19-9a2b-39017f8d0dda", "value": 57248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774611997, "uuid": "efd663df-0ec2-45be-bede-cf02acff2a48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774611997, "uuid": "11e90d33-f3fd-46ec-8e8c-69ae57ec60bc", "value": "kurayami.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc5d2b1-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774596456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596456, "uuid": "c96bbe69-8efb-4ead-8195-8af895fa523e", "comment": "Malware payload (Mirai)", "value": "1d2c40395461ce4c554221379b6a3bc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596456, "uuid": "0fd14571-3797-4e6e-bd3b-2dd4148614a9", "comment": "Malware payload (Mirai)", "value": "41c892a31397d7617247359007e1ec1bdae906d7fa82c57fdc149112f73f1d1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596456, "uuid": "d5c139da-c421-4d81-b121-22794aa4df73", "comment": "Malware payload (Mirai)", "value": "312e5198e2ff141c04b616f29a4220087d093b37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596456, "uuid": "782cd505-cedb-443c-b6f6-92fef6856310", "comment": "Malware payload (Mirai)", "value": "ccecb731898d519a118d38b7ea901fc899041501489e28e2926a47ed999208253ea207cbd3bd0cea5c22dcae835b0afc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596456, "uuid": "21113c94-139f-4fff-9a6a-15b8e8710708", "value": "T1C8D35C0A79D270FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937DE05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596456, "uuid": "2fd417af-47ff-471e-a199-0bb56b5beb6d", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQK:yIRfe3xvvSrlvZZ7UK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596456, "uuid": "73619b49-f833-4440-b09f-be53de9885f8", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596456, "uuid": "c2fe9ab4-4865-4d6f-8edb-096497880700", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596456, "uuid": "fdbf35ad-4562-496b-9214-cf000cd1214c", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4e1777-2980-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774576726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774576726, "uuid": "93cc76cb-f336-4391-bd55-75047579d952", "comment": "Malware payload (AgentTesla)", "value": "ece93a6f380860c41686b4bb6f156c46", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774576726, "uuid": "656b811e-564c-4426-8ee2-9c1339982a7c", "comment": "Malware payload (AgentTesla)", "value": "4222fbb27743589921239b17395be10064e2b1fdac880ae4e86f7d2411eb27aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774576726, "uuid": "3bc12ad5-8be0-486c-bdf8-d25f386af26b", "comment": "Malware payload (AgentTesla)", "value": "7843ddc8dfd32e4e10293da196f0f38c791c6237", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774576726, "uuid": "4a35b28f-14f1-4232-a4d0-d3d45c623005", "comment": "Malware payload (AgentTesla)", "value": "78b6863522ba445ccefc9b8e1e19b48c06c3671a27709900c04f344a1cd0e95f8a0c7dc1e43e8fb48d3ee5975bab3bc1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774576726, "uuid": "ec5f1da6-c810-453c-b381-a3d0ed40adc3", "value": "T12865024589C47FB9DFAC162D80FE160DA3E04D8A6019B94AEB73FD4ABFE7A0051171D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774576726, "uuid": "17442ff2-c3bb-41d1-8053-4e98372979a7", "value": "24576:633oDZC+HEZilHthPGEOjF/+AWsFnQcPpFZCOih:63WZ3txGrjF/+ZsyUfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774576726, "uuid": "478bc1b1-f57c-4e52-a5c4-21bd4142273c", "value": 1516070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774576726, "uuid": "0bf2d2e8-8eec-4b8c-9fef-95cb773c706e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774576726, "uuid": "27d34380-e8f9-404d-80d4-1e309259049b", "value": "Offor Request.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1007eb11-2973-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774570959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774570959, "uuid": "a0771f60-969f-4982-8147-0425fdf5a31f", "comment": "Malware payload (SalatStealer)", "value": "0ae1d01dcb1c5c54d71b38ff13e92db3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774570959, "uuid": "6464e7e7-6786-408c-b1e0-4b8c70c4ea51", "comment": "Malware payload (SalatStealer)", "value": "427cc06361c9ed6e4fbfd8fa0b09c5735ad9a07396da005cf9789aac03f47474", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774570959, "uuid": "e38af7b0-63e9-4816-b90a-7b596f513b3f", "comment": "Malware payload (SalatStealer)", "value": "aaf4e7a680fbe36d50afbd087d728ac1c82511ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774570959, "uuid": "5185a303-0b08-46a0-a0c0-8a95fa67130a", "comment": "Malware payload (SalatStealer)", "value": "68d06f57157c0f1567b7593e800a26ec77ad7428c9130b0822049b9ef00885fccfef453f47dcd4d9e41c372abe5e71c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774570959, "uuid": "c894b74b-76cd-47cf-a266-d9223931a8be", "value": "T110C66C01FE8B98F5E9035835446BA23F63315D048B28DBD7EB547E2AFC776921C7A209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774570959, "uuid": "501b55bc-1e4a-4773-b7bb-63131c58528a", "value": "49152:efjF6Lj2dBFJon5+jXtz+SzG74Lpxp6QT2T41jEnyKxONJf8v5lf2p0A7bhunMAO:Y56Lj2Qn0a3yKYf8TMZQhky9ez8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774570959, "uuid": "42e3dad0-c7ca-4823-86a0-4a2a89fafc30", "value": 12109312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774570959, "uuid": "d36a0d10-0c6b-47d9-a641-875e52547034", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774570959, "uuid": "471a1ecb-d726-45a4-8770-408b7a60c803", "value": "x427cc06361c9ed6e4fbfd8fa0b09c5735ad9a07396da005cf9789aac03f47474.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b183f719-2a25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774647680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647680, "uuid": "ae99414a-8f2f-4523-bb97-1441efad2a28", "comment": "Malware payload", "value": "f32dd17a62b50ad4b92e4bdde18d92aa", "object_relation": "md5", "Tag": [ { "name": "5-8-248-245", "colour": "#8543B2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647680, "uuid": "656b5a4c-5605-45d9-ae23-33e28eb63e46", "comment": "Malware payload", "value": "43cf0deb28a692d9a5458c6cd9c71148e02cf1b375fc50ab1ae04a6b7cf9938d", "object_relation": "sha256", "Tag": [ { "name": "5-8-248-245", "colour": "#8543B2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647680, "uuid": "9f86dd51-3edc-4186-aaf6-002923ab3601", "comment": "Malware payload", "value": "36211488a5592ebf373442d5221f00c2d380ff52", "object_relation": "sha1", "Tag": [ { "name": "5-8-248-245", "colour": "#8543B2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647680, "uuid": "2bf3aeef-52b4-4849-a072-4c39ae2dfb04", "comment": "Malware payload", "value": "acd976a8539a6f69887581fb1075de39eb9582ddbddaf5c980537a6fec575c0e85a91f8212fba6c92f1dd26a709192dc", "object_relation": "sha3-384", "Tag": [ { "name": "5-8-248-245", "colour": "#8543B2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647680, "uuid": "533d0aa9-3691-4c53-8e8a-5c32a137c7b7", "value": "T14CE65A9221C7E1DDD463C13EC94EA5FA919F7CE2C73489D31161BEA63932E82F526B10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647680, "uuid": "3d432eaa-8dd0-45bc-acd8-29d3ec1d3f44", "value": "98304:HkTaqEtT8F/uwik02TC/2EiAkmydBe+DmksnB6ziY1tMdoC/zsRJPWOZ+01cNlK2:aEl8FFik0AyRyPlmujC/zNOZ+cczK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774647680, "uuid": "8fad836d-b1ff-4b19-8b1f-86aff7bd1043", "value": 14066490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774647680, "uuid": "f0ae0085-5dcd-463f-960d-c6266fd779db", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647680, "uuid": "4a58a31f-53c8-42dd-aac5-013b1aef9e92", "value": "first.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366fa5b6-2989-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774580472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774580472, "uuid": "c0637d08-e70d-47a6-b448-8d286ae5e953", "comment": "Malware payload (QuasarRAT)", "value": "937852a829b28b4f75db1ec3c5136b11", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774580472, "uuid": "4f8a8cd2-d774-4b92-a9e6-39c26e2bd346", "comment": "Malware payload (QuasarRAT)", "value": "4587bf40060edf7f1978dbae81bdd1571217e9ca041281a18347382da9a5382e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774580472, "uuid": "2b18b53a-e8ae-4357-8265-569e9ca892dd", "comment": "Malware payload (QuasarRAT)", "value": "e2222c2e40c77844802b50cf878aece187e04fdd", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774580472, "uuid": "e971d26f-6846-47b6-a770-1040a7dc9ad6", "comment": "Malware payload (QuasarRAT)", "value": "21ec29c03ee103fc5c4e9a35d97e7af40f93344b681473758ac554cc654065288d242d771e5701a22e8c38cb8acf52fb", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774580472, "uuid": "e74d5797-b333-4dd0-b395-89ec2aacce7a", "value": "T1F185021589C83FF9DFAC5A1880FE161E63F05ACE5426758AEB33BD46AFE7504020B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774580472, "uuid": "6cf16d49-fa55-4e57-a043-c9802081c29a", "value": "24576:vbkJiK3NZ4kAP0O8yaRauUBDzY/lF/fK4X8JgdAvgydh7EP8yVJlOYM+:gF3fVAP0OSzgIbqohy0BlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774580472, "uuid": "e6bae6c7-1a58-427f-8f1e-1b1b7b73a4aa", "value": 1797216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774580472, "uuid": "5cee0038-00d1-422d-93da-8e279aa6ef7b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774580472, "uuid": "a5a8af2e-e283-4eb2-9583-61898ea4f775", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5466577a-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774596414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596414, "uuid": "3b19a089-6b98-46f1-9ca2-d703a5a44ff4", "comment": "Malware payload (Mirai)", "value": "1c5d870c8489732a2759f22a789aed1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596414, "uuid": "23642ddf-407d-460c-8af6-fa8199c82e2b", "comment": "Malware payload (Mirai)", "value": "46401229f879d821617bf4dc1183c652f1877aa2f33466c6a5c18fa9a31c85d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596414, "uuid": "8629583b-61e3-4493-ab10-0b9f33d4354e", "comment": "Malware payload (Mirai)", "value": "fd97befd341e39a755ada25c418c997e0e3dd4f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596414, "uuid": "cfb2acb8-27fa-4d65-be3b-ea3cbcd224c4", "comment": "Malware payload (Mirai)", "value": "2c7e07797c458282432c059e09920c50d25f8362d0d1e91f2c106887b4f0d472102634cad7b7baa059ff664ac297e1b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596414, "uuid": "adcddd5e-069d-4858-8cca-5f6cb436c766", "value": "T1FD04392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596414, "uuid": "7f7697ee-a247-43a5-9a42-1be68f9622cc", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55wGUXS:7eJpJUVD1A8n0YNgEJi5aTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596414, "uuid": "172ec358-d1c3-40de-ad8b-3356c134cbbf", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596414, "uuid": "6086d4f0-c792-4757-a1a4-6b4854c21c15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596414, "uuid": "b7d9bcf4-c0c2-48fe-9a08-ca5b80c7be64", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ec404b-29c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774604770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604770, "uuid": "567ef638-cd65-4ed2-be09-2a0b9a8f0190", "comment": "Malware payload", "value": "549f1f73e8be56ff2f952843dd0873d1", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604770, "uuid": "19b5baff-3f0c-4605-af7e-8ac840118cfc", "comment": "Malware payload", "value": "4647707f5c01c2e8135d2bf95860422144d29fa36d83543a34a283b44a27e1b7", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604770, "uuid": "2749e4dc-7759-4e1d-93b1-87f1ac43aa66", "comment": "Malware payload", "value": "fa97a8a1c3e388bcb54766727582f38bb63a5740", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604770, "uuid": "c3d54f53-c27a-462c-b2a9-cb84cc97343e", "comment": "Malware payload", "value": "edb7189440742f0d549d285660816a250a810642926b8b4d8967a2562026d6c518f596afb7326b22aa3305b660a706ee", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604770, "uuid": "4b4488a1-cf42-44cf-ba58-6113be8b5d22", "value": "T10CB2BF002BED1205F37A5739993DEB014A36FF429E22D26C5A60ED5C2C7EB909830B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604770, "uuid": "86b0a7f2-b017-4a69-b754-df0b431e2e1f", "value": "24:9xY/xP5Rf4bsd9gBsLVfdphwAkf3/FP8YgnLVfdaK79fNM8ybxPt8ybx/SkvlAn:9xY5Y9fPFGjR1Ibxxbx/SElAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774604770, "uuid": "c36a1cbc-31b0-441f-81f9-6ace1656dc3c", "value": 23787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774604770, "uuid": "badd0ee9-4b11-449e-8a87-c0a00f37d4d7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604770, "uuid": "aff46bc4-e448-4343-a30a-d46a53a1771b", "value": "Scan_001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef0f6ed-2970-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774569937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774569937, "uuid": "28f53a50-462a-438a-9b82-ac1d1695de3c", "comment": "Malware payload (SalatStealer)", "value": "0eef27b6976ff46422b99dbfcb33198b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774569937, "uuid": "1184fccf-e8d4-48f6-8d0c-eaff63931a0a", "comment": "Malware payload (SalatStealer)", "value": "467f3098eae7aef523743bbcd69efcd80e8839dd6babcb721de313ec2e08d86c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774569937, "uuid": "ffe36020-4729-44ad-8a2e-52e8cc2fd51b", "comment": "Malware payload (SalatStealer)", "value": "0585b981ad27a2715ae0b6250d77fedcf78a2f79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774569937, "uuid": "880f1ee3-c3db-46e7-80bb-e462801bbbb3", "comment": "Malware payload (SalatStealer)", "value": "3a91796d23fa4b541500884cb98ae23ca8db4cc985ed4c89ff3a2ae2767320c563bb4a8079782f5dc948f8c78424212d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774569937, "uuid": "e51cd093-cf27-4e61-ac11-aa346d378285", "value": "T121C66B11FACB54F5E9035831406BB27F23315D048B38DB9BEB187B2AFC7B6A1196A705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774569937, "uuid": "1bcd94b7-7cfe-4dba-be62-49ff8260084c", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774569937, "uuid": "99213437-e886-4e63-af52-56f37f5f20d8", "value": "98304:SmMys7+TRd6KiPrcKum/1a+L7T46G2IfKEg:G+mLrxba+3TS/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774569937, "uuid": "fe7a82a7-0a43-47f8-918b-182dbba11292", "value": 12574208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774569937, "uuid": "5f5df257-f472-411b-929a-0afc63387cf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774569937, "uuid": "99a2948e-4b08-4840-8b4c-59f6cd6d436c", "value": "nixwarecrack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab29a06-29b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774597793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597793, "uuid": "505cc0b6-1a08-495b-b1dc-f5cfb5a1681d", "comment": "Malware payload (Mirai)", "value": "fbb4b00db8f6f3f3d5e3725731814c47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597793, "uuid": "1c59837b-b5e2-45fe-9916-5ce36e17e764", "comment": "Malware payload (Mirai)", "value": "46831dae03c26030c63b02df4d7aa4e0bbf403d2a07590fca5bf20d1adeba246", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597793, "uuid": "ceda60da-87f1-4757-ac69-8ff55a9ad51f", "comment": "Malware payload (Mirai)", "value": "ca018287d5cd64323047671a5f7e480198340d40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597793, "uuid": "7e6ead9a-d811-4cde-a6f2-cb58e55ac42b", "comment": "Malware payload (Mirai)", "value": "f3388f6a7054513cc602a38115ffb9f6653655e0f118c9cf901a1b06909e51f9d2188fff1ea575a3a96360c2c695f327", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597793, "uuid": "b229c651-ce58-42d9-ba47-82602d24adc1", "value": "T17B14C80A9F520FBBD86FDD7702EA0A1128CCB81B16B53B757274D924F64A58B09D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597793, "uuid": "148a223b-1aa9-483d-bd9e-6c5ad0e245b3", "value": "3072:7samiuq2y98hfjybh6jVqY2LKYRwqrf2k:7samiuq2y98hfqoqDKYSex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774597793, "uuid": "2f55dc3e-e29f-4e56-9f83-7373739f7945", "value": 191240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774597793, "uuid": "6db9cc1b-adc4-41f2-a593-ddb4414c09ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597793, "uuid": "aea9b242-a1f0-441b-88c0-2fa5bcd418e4", "value": "georgia", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ae507e-29aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774594705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774594705, "uuid": "1c7a25b5-4591-4f6d-a460-dc27f8fa9613", "comment": "Malware payload", "value": "f195852975eb3ea22d14a3bd9516da3a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774594705, "uuid": "edf6efb8-f403-4a62-b98c-80a18667c908", "comment": "Malware payload", "value": "4690a4e58bc7d3b04c902fed706bca4126b7c9f0ddc5e9697a70c9455e397aa9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774594705, "uuid": "f77982b9-de7e-44ec-bde1-9041aa5aa85c", "comment": "Malware payload", "value": "142f3eb1dc08e2c7d6de7da9ede22201557b03ab", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774594705, "uuid": "96ff08da-e5b7-4065-b1fe-193bc2a4e368", "comment": "Malware payload", "value": "4cff742b0e433c8976571403e742e41ec5b5c7bd771bdf6897e052f6d054f4d7e69f75432e9e2daec48796df5247e027", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774594705, "uuid": "a6486a2a-e792-4ea8-9e3b-9761d786fbac", "value": "T180925CB506497CB9BBC0CE799F3C7F0CAEE582C42129E39DBA1F39705A2065DC609359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774594705, "uuid": "d19466d5-1c67-40d8-bbe3-f00b5fc640e4", "value": "384:kxncuxOLnVYMSozsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:kKuQL+ozsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774594705, "uuid": "0dc91d4c-aa36-4ea1-8a8a-729ff5d3c3d9", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774594705, "uuid": "f7310877-1aeb-4b3e-b261-bcf4aa269bd9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774594705, "uuid": "4a95677e-c2ee-45af-b476-3087c471e02c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d78928a-2978-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774573156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573156, "uuid": "f7885636-e31b-46b7-b4ad-e70e1a13651e", "comment": "Malware payload (AsyncRAT)", "value": "ba68b602ceb3274273271f31b244e8a1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573156, "uuid": "367cb92d-5f3e-4884-b459-3f694d7e7c1a", "comment": "Malware payload (AsyncRAT)", "value": "4744145968ad6f247dd79c63c57551eb9988adc12584249d023057f6f9bc2341", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573156, "uuid": "84265f79-fee7-434a-9178-5dcf00cd62ce", "comment": "Malware payload (AsyncRAT)", "value": "ca31e07727c27113db784e0d7f969726dc7f280c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573156, "uuid": "8b6f30bf-f99b-4329-b33c-50aa36051e70", "comment": "Malware payload (AsyncRAT)", "value": "cd26b75488463f36e9aaa73f3426bd69e770d5e0d7708e108713a202530f2d94752977aa65b853a0caf830279e82e5bd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573156, "uuid": "f5cb0c4d-25c8-4cb7-9208-2689b7be7150", "value": "T184736D1837E54215E0FF6FB09CB1B666D735BB1359039A1F30C90E863623AC9CA516FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573156, "uuid": "8a043141-a612-4000-8e83-322172ed8b58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573156, "uuid": "7a37d7d0-480b-4678-bf6d-689062b79d6f", "value": "1536:nfShp/1oXdEe63wta1tNVq0bpUO1D6QnklWNuOfzU06FkoMdS1EAd8IIu:flt6Ata1Rq0bpxkl1Ofw06ZEgEA6IIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774573156, "uuid": "2bd98b9c-e124-4156-954a-073ca23c7741", "value": 78848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774573156, "uuid": "f992a5e4-1163-40eb-8570-84ff916c6cc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573156, "uuid": "6e97b4da-4b47-40fa-ac88-7f6057104198", "value": "VLC Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f01d7d-29b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774597837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597837, "uuid": "bda57d89-f658-470f-884e-15827225382b", "comment": "Malware payload (Mirai)", "value": "f6d1e9ab0a93715ee4d5e6143dde017a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597837, "uuid": "0df2ec7e-2b57-45ed-82d1-47fd3fce8714", "comment": "Malware payload (Mirai)", "value": "4752d2ba51d8232545b2360b1e533e132b9f51bbce2a717a79582de7b0a4c624", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597837, "uuid": "91a50cf1-23dc-4ca0-b6c4-ba4725405218", "comment": "Malware payload (Mirai)", "value": "a6ecf6db5a5e9a590d2b42d27cba596d8e52cc1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597837, "uuid": "38cc5f60-c71b-4711-a56d-d4f9e3f36d2a", "comment": "Malware payload (Mirai)", "value": "25896098082fe16764ca1657b63ab613ec0726b59a644c344723d282f019c9bf880c8a9fc32b5ab78aaded8e72947076", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597837, "uuid": "f9cfccab-182a-48a3-9091-84b4a2cb8556", "value": "T18E165C62BC90CA62CBC066BAF75E829C73135B75D2DF71068D14473437EBA5A0E3B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597837, "uuid": "810e84c0-5af9-4d93-ab7f-5bb60daa9e23", "value": "49152:V7oLw6F2+5xaZSzi2MYmX2QQtBCI/JrvxKo6Zrlpa+vLz3cCPy8X:JoLVF2aaZoiHYmfy7J1KosDXH3cV8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774597837, "uuid": "95beffa5-35a9-4eed-956a-d317bb70414d", "value": 4061004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774597837, "uuid": "b8d61838-53cb-422a-9a08-6cece1059018", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597837, "uuid": "9ae108e8-046a-4ef0-832b-97b5364334c4", "value": "wlan.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257f496b-29b3-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774598483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598483, "uuid": "6d4f842f-523a-4899-a039-383f25df2680", "comment": "Malware payload (AsyncRAT)", "value": "b5fd8935f3b8f2d8810efadeb308c47f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598483, "uuid": "5f14b39b-eb69-473a-b384-5b7702424b94", "comment": "Malware payload (AsyncRAT)", "value": "4763e3ad120388a6536ad74e4c3d5dc915cc5367addc5fb11194a4947f4d2349", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598483, "uuid": "e6caf408-363b-49ba-9c96-101cdda11766", "comment": "Malware payload (AsyncRAT)", "value": "8451ebc3a2952e4c55cc5ac17ab8272082fc808d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598483, "uuid": "a231af62-026c-455b-bc19-477c2e31b7bb", "comment": "Malware payload (AsyncRAT)", "value": "38365757e07a552108dc4a4752913a70c961c1f077acdee2c065cb8aaec62064a60bb3c3af545a3ac9d99a6118844fad", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774598483, "uuid": "e5e2c468-b66c-4e98-93fa-f29a76323209", "value": "T1C9B4F1845ACC7F798BB4112F687A6205E3A14C89700C6545DFA2FD9EFEF7A00612B67C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774598483, "uuid": "a22a5c49-755e-4da4-9f46-993f1eb140b6", "value": "6144:+QQGHBy1dcu6OQfBJFYKmyZKf8UvQu55wJV0o/MzG1Ma7Nr9u+IeizZo55qeZ1Zk:g/dEBPYKmKa/n5aJbMqHrE+FoopZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774598483, "uuid": "79146b59-7b72-4f94-9933-a43c59d7e7c6", "value": 524518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774598483, "uuid": "eca64f21-7d87-4fec-b6f9-680cd9e37f1b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774598483, "uuid": "99f7c7e9-a63b-48c3-9427-85d496a42df6", "value": "Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc50a75-29c7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774607090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774607090, "uuid": "56b2b3ab-4203-4c52-809e-b4a729066666", "comment": "Malware payload", "value": "b006542082f921520f1f98819eadcecb", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-21514", "colour": "#0490F0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774607090, "uuid": "17645ef2-8137-41fa-be06-4747a275a23a", "comment": "Malware payload", "value": "479fd5e5bd5566a0252acd4ec29c5abc0dac501d0d6e9f316612b52aa48a3587", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-21514", "colour": "#0490F0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774607090, "uuid": "ccf7adac-a9c6-4e0e-b7f5-a5dd85df0834", "comment": "Malware payload", "value": "a631fbe4544c1febe65b450c418e1c1b7261989f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-21514", "colour": "#0490F0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774607090, "uuid": "d1eadfb3-56de-4ee8-a8e0-1749114195af", "comment": "Malware payload", "value": "a77d2773fcabdfb26b76e0de2bb503b0c85504da7ce496a8b3617440ca24a60e0479f0e426e768f72db884d61c29f2d0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-21514", "colour": "#0490F0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774607090, "uuid": "c3968dc1-c1f4-4250-aa67-7ecd82f5bc56", "value": "T1A7C553B898224959D615695F0387BD1820AAFC432AF314E28F7EEE795ED9DFEDC07004", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774607090, "uuid": "d52f6eff-a7cd-4118-b9e8-4be94d8d9d2d", "value": "6144:7UugegRKmQKfSFYysPHwyciGYdRa5GUoEF2NbtqS27I:I/RzwF+PZdRa5QEK47I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774607090, "uuid": "23361839-de74-46bb-ba18-73bb363e1e24", "value": 2683823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774607090, "uuid": "31f7719e-4442-4607-818d-ed4bca6fdc08", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774607090, "uuid": "04a4902f-08c1-4eeb-9eb5-fa819d3b6eb6", "value": "output.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202b79c3-2978-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1774573133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573133, "uuid": "33205fd9-1721-41f3-b746-5763feb63ca6", "comment": "Malware payload (XWorm)", "value": "22885f81a98018dcdb4d8198664c82e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573133, "uuid": "e5b9fbec-5074-46ea-8bd1-babbc76b52c3", "comment": "Malware payload (XWorm)", "value": "47e63f7b23f5b2dc490c963cfccf55904755c16707b0ddb63b4e4897b98f5824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573133, "uuid": "0d259d36-dcda-4958-a1c2-972524bdf515", "comment": "Malware payload (XWorm)", "value": "418c0116785cef14b0d63ec5d902a3e9fd19dfe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573133, "uuid": "67f59873-19d0-4ebf-9d8d-d70b97011923", "comment": "Malware payload (XWorm)", "value": "f81e4f291f3786001549b694f872a5acc52d80fdc57c6e0b901392e794b9f6513866178708bee989e7cee791d13ee499", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573133, "uuid": "d4be5760-6ec8-4f0e-9bdb-83f355bea2d2", "value": "T190A5BC2D3B07438A9738C3A8BAC687449E30A5965C6F978DF9FE708F0CD3A48155B197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573133, "uuid": "65c2d43c-a4ed-4e40-8bb2-a73e7bf0a7ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573133, "uuid": "fda09107-1186-45e6-bfb5-9f40a907950d", "value": "49152:QMmP0NbPxMRWaK6H3rl58cDR1EFxBx5G1EFxBGV8Kr:QMmPCj6Rbv74cDLo7xko7GCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774573133, "uuid": "84368252-a848-4da5-93e7-204037a0a63a", "value": 2231808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774573133, "uuid": "43e6de3e-e6c3-4fbf-947c-b9560dfe79c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573133, "uuid": "d8282b6f-54da-4574-afe8-c77462d1dbc7", "value": "sewi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327cd4a9-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774596357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596357, "uuid": "fd610c01-29c8-4f13-ae76-122b5497167c", "comment": "Malware payload (Mirai)", "value": "274a1c47eab6440b9ebf0e0bb855c856", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596357, "uuid": "cad2f6b7-be4b-4b41-89ff-7cfddfb192ed", "comment": "Malware payload (Mirai)", "value": "484d1d2b5cc7d45631f9f50ae3d11985ed186f7442bcb449c9508cd994d88013", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596357, "uuid": "c5b74efc-e280-4514-aa97-bdf0ab148d4c", "comment": "Malware payload (Mirai)", "value": "f1a3679d0debf0879a71a8b16c7d3c8ad7023c48", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596357, "uuid": "113f5688-befd-493e-b816-50557dd4813f", "comment": "Malware payload (Mirai)", "value": "481adcd2bbfb152aaa9d698626e387ad8e5892df92361d38c5ac12d0f82621eefad44dc40953acf28fd53f71b2e5aede", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596357, "uuid": "a266fc46-9384-4c96-b7e0-1fddfc4de514", "value": "T1525101DF0104CB32EA4D854FB7F4B1746D4BAC82B6DB8A04E949089D6FE6D4DB395E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596357, "uuid": "54195986-b9fc-4d36-b468-c8017d7c63e5", "value": "24:/xwCzC2JMlb3bbiBJn0nuZxuE+uEnE2EhEITRu606bwoWQQQJ3JJUfJ/c1z1hM3G:Bu2JMZLbiB58uZAAcvy1tbwc5hM3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596357, "uuid": "dfd19e3e-4ecb-477a-81c6-17ba98e116f9", "value": 2881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596357, "uuid": "c4995d54-9532-4ca7-9eac-05f43e92a183", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596357, "uuid": "bafa98ac-9af3-462f-a199-3b86ccfdb31e", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e1bf7e-29f0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774624901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624901, "uuid": "3ca58d8a-f4ab-4831-98c6-3fde1c42dd9f", "comment": "Malware payload (Mirai)", "value": "de00e2789d8ecaccfc20fc70b0f38706", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624901, "uuid": "f4cc952b-28c8-4db6-b5f9-7a6c9f8bfe7a", "comment": "Malware payload (Mirai)", "value": "4897019f7d7f09bba05c9cb7eb9215c0cad257b1840ea752cbc90fae3b2fb720", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624901, "uuid": "276a7a4b-c8b9-40e1-b4dc-cd9ad8e90c47", "comment": "Malware payload (Mirai)", "value": "202a0825510578976cd4c0c5bc361262bc5bf3d0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624901, "uuid": "6a1f7de6-1ab3-4712-b82f-5935af379bdd", "comment": "Malware payload (Mirai)", "value": "6c6144834eb233508d2955452119ca89442440d7a186d8d32ce1236df7dc4a326b6f167313f169ba00c7f619b1915693", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624901, "uuid": "b863ea5f-eb1e-4e07-b1ec-fbafe037fb15", "value": "T1E0834B47E687F9F0CD4205B8206BFB35D837A8332131DFE7E7D4BA5799A5202A05226D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624901, "uuid": "dd77073c-848c-48c2-b41e-f7b5570cb207", "value": "1536:PyN1fbfUbfGu4RhMmXcB3KQwytYd3ZuSD7z6limOkt:Py74rmcBejtD7zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774624901, "uuid": "48654f30-dc84-4a51-8bbd-0a58ad3020aa", "value": 82520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774624901, "uuid": "878b0990-6f0d-4f3e-a764-aec7d9dadccc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624901, "uuid": "2cb1f688-54d0-47a7-859f-bcd114102dea", "value": "nullnet_load.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7424ca-29ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774623804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623804, "uuid": "01460d76-42a6-49ec-ab64-50d087a428d3", "comment": "Malware payload", "value": "77b4a2e8cb0219b8bd1e058c355377f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623804, "uuid": "402ea1f0-cd2d-4a6d-83b6-d20e9aacff95", "comment": "Malware payload", "value": "49ac33c4c846fabf17a1a499ecab9ccb4bc036722797fdd09dc6063c0c6526fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623804, "uuid": "e881ef33-3ed4-4645-ac3f-9df79241c25c", "comment": "Malware payload", "value": "e3fcccf1191abf0cf73ea0c259648c71fc0f088c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623804, "uuid": "f18f1aef-2696-4707-8f3e-af68fcf739d4", "comment": "Malware payload", "value": "e49d1a0ab1d8c6f0a44e97686d3ee39f6a0d2d99ccfbf39efdc3e3608a7d960e378039eed378cf87562a73ca64a576bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623804, "uuid": "b5119baf-946c-4414-9d79-cbef54752c72", "value": "T14067AE15AF8825A8F516FA74CFD1A232C2B279524761D0CB0A99D206DF73AB14F3E70D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623804, "uuid": "20838063-a82a-46d9-b27b-5709dfe3e454", "value": "e67641de3309fcaa8960eed45c74a35e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623804, "uuid": "509901ca-e3fe-4b71-80d1-76fe74ba6192", "value": "98304:Nfk9+0mPm3YyYtvsa2Erck7qSIDLipQiyAUtAbZJ0XPL:hkA0gttJcBTL5iy6NJsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774623804, "uuid": "9c9fc619-ee7c-43e5-8de7-4dbd6589735b", "value": 29813248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774623804, "uuid": "ee2923d8-a9c3-4c48-9d20-ec9ebf402aa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623804, "uuid": "05ff592a-1fdb-451b-81be-4524ac567e52", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a92f87f1-29d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774612018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612018, "uuid": "be75348f-a489-484f-bfc4-2120fd7325b2", "comment": "Malware payload (Mirai)", "value": "163866861b484eb1d8b38d5a30a21b57", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612018, "uuid": "eac298c6-2069-40c7-bcb2-1555fa073a10", "comment": "Malware payload (Mirai)", "value": "49ff904780dd60776c9069362438bd67578b6369e9ec73a4a4655b368024787a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612018, "uuid": "def07032-2307-49ed-9644-e212c046ade4", "comment": "Malware payload (Mirai)", "value": "0c3f565844c0d9df6ce7c5f2380e3b7845da2c40", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612018, "uuid": "e8b23393-9dd7-4dfe-a75a-d7f712775105", "comment": "Malware payload (Mirai)", "value": "171cbeca0dd3f9d284dc43beffa3a97015ab180923033a737c805d33e6f8df09984af278f51746a806f3f7015505fa85", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612018, "uuid": "a6d40dbd-286a-40e1-bd06-96e1b28cfae3", "value": "T1C8B3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612018, "uuid": "37cee572-72a5-43c1-8ad8-35f1a9b0b79d", "value": "3072:Ddub7djS5HEC7gBjmbhRhFczcmVRh865xG:Ddo7djS5ECBbozcmVRbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612018, "uuid": "cfe0caf9-5d70-4e72-9d3d-271eb12c1ccb", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612018, "uuid": "d65d5062-4683-4cc5-b0aa-8eec1799d9fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612018, "uuid": "7f84c1cd-df06-4e40-8061-854ac39ed272", "value": "windy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a0332e-29f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774626647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626647, "uuid": "e23d3b76-d874-4d31-96ab-bc6d1ee278be", "comment": "Malware payload (Mirai)", "value": "4ea2f4e57761f3baf2267e047ac30d1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626647, "uuid": "47a6c009-a7a5-4f9a-b209-57cd936fd5d6", "comment": "Malware payload (Mirai)", "value": "4b4062f35f1d987a0e486321a11e364de9ce979799961da5879a452c51e0b410", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626647, "uuid": "6cc766e3-adcd-4146-bffe-ae9de418e1a5", "comment": "Malware payload (Mirai)", "value": "c3df4978fd1dcd66c762ce251f86d880626ca904", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626647, "uuid": "62f72a6a-8c91-499c-819a-a483d5e0f227", "comment": "Malware payload (Mirai)", "value": "3cb044531564c0c2add0da2aa73af5467e4e91a56f530d8eb0021ab57e6f0d576c03ef0382cadf18487610c381463789", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626647, "uuid": "542a040b-a179-453e-9bf5-07d71d1212ff", "value": "T135D34C0B74C094FDC8E9D1788BEEB126D972F56D1278B10B27C9AA321F4DE205F6DA11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626647, "uuid": "a40c97ea-6e32-43bf-a849-c03bc61f22d4", "value": "3072:XXl27wYgvvQierIQUhuE1YQ3nIdfzAIf7lJYulvPcAP6AUV:t2IJmfn/vPLP6AUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774626647, "uuid": "49de950a-e940-426e-a109-5a39b918f0b5", "value": 141640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774626647, "uuid": "d53335ea-8973-4b82-807d-6f5d02c2d142", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626647, "uuid": "20582b2b-980d-4031-b26b-3dc1c70c62f8", "value": "sshdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db7493f-29b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774597798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597798, "uuid": "e3d3e337-7233-4faf-9a14-1cb4f39c1d1e", "comment": "Malware payload (Mirai)", "value": "a7d007a37ed8b76608b631f371335815", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597798, "uuid": "285cb0e7-2143-4c09-aac3-213bfba6ac97", "comment": "Malware payload (Mirai)", "value": "4bafd0db45b44a978092247b4178e3775ae19153f7c6d981fb7780d9b0d8e82a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597798, "uuid": "581a8cad-244a-4d1b-9028-1b6a4f311345", "comment": "Malware payload (Mirai)", "value": "b99943af3a73ed484e873a6c5372ac079f0a98c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597798, "uuid": "030764e1-3ecc-4f1e-bee5-4ac47d648f79", "comment": "Malware payload (Mirai)", "value": "0a00980fc58cba887dafc715ff968c3ae59aa415f61fe96a7e71f21979efb1985e1fa6ce83dc29d34668ddf8490f0b39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597798, "uuid": "642c2c3d-9451-485b-aa4e-bc37f1d1e115", "value": "T18C04871A2F238F7EF269827047F34E30975976DA26E1D684E1ACD5142F202DD641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597798, "uuid": "328fcca3-413e-45dc-82a7-246fb78589a3", "value": "1536:GRdx0G/7aNMMNoiizFMY+TQY6dfM6BN3yDt10JzeZ2zTENdR70RNMFDTNbEhPKGw:GRcyGyM6z3Ct10J1Ti/TPEZK39AA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774597798, "uuid": "3c332ae7-646c-4bf7-a937-e6576dbd4760", "value": 187144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774597798, "uuid": "df580740-1ba7-4420-bc72-5362f1daf61d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597798, "uuid": "eae44745-1213-469d-b867-c4c9a0a0ce00", "value": "florida", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9532306b-2a23-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774646774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646774, "uuid": "fd728a09-ad94-4e0b-827c-8cd6030e3748", "comment": "Malware payload (LummaStealer)", "value": "1d51c9b1ab6aac7fa39a411485909f64", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646774, "uuid": "d378c688-9736-4cea-8cc7-a7decef96516", "comment": "Malware payload (LummaStealer)", "value": "4c0c6352090348991ba6247494f04985d0a60180878f442f2ec9acdfda309b47", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646774, "uuid": "013201f4-4892-48a6-90d8-8081982881f9", "comment": "Malware payload (LummaStealer)", "value": "4f5fd898fc0da902765a0abca0b64981f09aa2ba", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646774, "uuid": "af368aec-4dd8-4ca4-8da4-dd8d9a89b7c1", "comment": "Malware payload (LummaStealer)", "value": "ae2d3e244012c140147337b0c66053ec41a6449ab40c58880a7fefcd229009322f1b5c1df9653fb3e6d4e4b50fd0bc76", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646774, "uuid": "b74c4be8-b520-4e92-9728-b99ab71c66d5", "value": "T1CD853A00FD8758F6E402973755AB23AF2734A9090F36AB87EB88367DB9762950C36345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646774, "uuid": "b424a7f4-c727-4b8a-8e31-5f4c8aad9fa0", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646774, "uuid": "a90915bd-ebd7-49f9-b57d-fb3f74ca4516", "value": "24576:+Bqu7UJIk8gg/L/OPBPQuN53YNCadnCRXM63TJePlx6af0k8+yhJog8M+kYiRXIz:+w6E57aS/jidPnKp4bB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774646774, "uuid": "c0a74b23-505e-4586-b571-3ff70724cacf", "value": 1762968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774646774, "uuid": "4cb68a40-7794-4437-86c7-2435697b2443", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646774, "uuid": "289f9265-3454-4237-9f48-0509d7d32d47", "value": "mX2a6r74F7ApMrbCFZVj6aMv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccbbccf2-29ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774596186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596186, "uuid": "91494925-68ed-476e-a1d7-fe58781e2bb0", "comment": "Malware payload", "value": "542e2b74d360f4cbfab7f016592cb78b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596186, "uuid": "3d685595-d378-4d68-b4e6-1d88e8ce0cb8", "comment": "Malware payload", "value": "4c56c8e4ceba2744fc0871be73ba985d070ae7033507fc6c274782e15432c2fc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596186, "uuid": "466b2e3f-5b28-404e-bced-05ca3f59526b", "comment": "Malware payload", "value": "1dc9b393e775f24164bb20520ec4a9154c3f86c0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596186, "uuid": "13f7476a-03c7-4b19-9282-32c3c8c5b250", "comment": "Malware payload", "value": "d212c17a590c4f42ec94a37af08bc52e8de53faad200329c029aaf3edb7a7b3f30cc1a0ff21208202eac3473069f398a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596186, "uuid": "4356c90f-2032-425b-bbe3-67e166a1334b", "value": "T1A9F523D9169DC036FE947FBE7B4226F9B57051D250A8426B82BB28D0DDC07EEB25804F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596186, "uuid": "843ef0fd-3104-43bc-8372-aa158defaad0", "value": "49152:vX9rlSETAuD36ekh1yIkPb8pqt0OGpRwzWz7ePpToOPeA5/dDLek5sL:/bSETlD3ru1GSqt0ZpizB8OJhL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596186, "uuid": "2b768349-e833-474f-884e-980b59dbb7d7", "value": 3451161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596186, "uuid": "d92c0bf7-f6fd-42eb-8930-ce966e5205d4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596186, "uuid": "80c30fe9-ed01-450c-9f3b-20861855a061", "value": "\u6df1\u5733\u5b89\u80fd\u5361\u822a\u7269\u6d41\u6709\u9650\u516c\u53f8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ceaba7-29ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774601684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774601684, "uuid": "a5f775b1-0d12-4fbd-86b0-915aaf4baf69", "comment": "Malware payload", "value": "baf49c69678c85043be3699093128848", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774601684, "uuid": "e6a2e5b3-46f7-4cec-a7b6-69debc7b2522", "comment": "Malware payload", "value": "4e48bfd6f19e40bd9dcfa797b861d8acf5c8a59c418b2c790029e29fe41a2796", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774601684, "uuid": "5c71f821-2959-44b5-ada1-50b52dcb1b40", "comment": "Malware payload", "value": "fd82fda7254362b299f4dcef35c6e55794653f82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774601684, "uuid": "aed47a62-4e53-4fde-8467-2aa062db1aa0", "comment": "Malware payload", "value": "de3c92fdf33ed9d30017c13a1feb022745194086df8d4fd59e71db9959aad3354908abd6d16230c0ee542f340ccfe02a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774601684, "uuid": "fc7ae57b-1470-4740-912c-4ef1c09e955a", "value": "T1E24423A39C560A7FF7C066BEA51411C6E2E069B10D2DCA5889FD97FC08915BAACDCD30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774601684, "uuid": "739babd8-15f6-49c0-8256-18cd10a19710", "value": "6144:ju//HKcG2wchSnsUNMzdaCCDUox55Qw8wRe8VoxI20cU01W:jEKT2wcEt0JCgox5Kzme8GxVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774601684, "uuid": "bc5e8fc3-ed6a-4429-930c-187dc16c2098", "value": 278268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774601684, "uuid": "9a2d0c24-d31d-46a4-a642-ba97b7ce3b5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774601684, "uuid": "10900ada-63ac-4175-8b03-1f91b2cbb039", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5deca6c3-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774625206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625206, "uuid": "6ccfb1b6-0283-40a0-8f27-b1b50064c0b4", "comment": "Malware payload (Mirai)", "value": "3ac89eb4c1a63534c282d3750e00230f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625206, "uuid": "cc938169-87c4-4787-9ea6-7b68d5310c83", "comment": "Malware payload (Mirai)", "value": "4fa80922d45b306a9114572fb8c9fb2e58b0fc5f9a6d0cc6fc6e68667dd227b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625206, "uuid": "2ed6bcb7-976e-499a-91da-fb9c7573db63", "comment": "Malware payload (Mirai)", "value": "fa3d4480e5ae361f69d7587afbd0ff69eb5bb42a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625206, "uuid": "e06a8b19-193a-4fb4-b134-7b4b48c2d942", "comment": "Malware payload (Mirai)", "value": "efb82d576e012fd5d1248d5152a9552c6ae5ec25d99fe894990a5b548d77539942f380787a848e1449d91f6004bbabfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625206, "uuid": "3ed01af1-61b0-4be6-9c49-57a491b6be05", "value": "T1C9334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625206, "uuid": "1f9e1bc2-67c6-4a38-94b8-e27bdf2a78d5", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8Two:ivW3jdQGqt7Y+Z+zN9cGgI6bo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625206, "uuid": "b818e831-ee5a-4a99-9aad-aa590d9801a6", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625206, "uuid": "01ae70a0-69f6-4ff5-a6f9-886d6c4fb871", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625206, "uuid": "0c1099c2-ef92-44b8-afc9-894032cb8381", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2466e530-2974-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774571422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571422, "uuid": "6393f24b-7304-49bc-b7ea-d2946d515331", "comment": "Malware payload", "value": "d0ef420150cd017cdf496e8439b10d5c", "object_relation": "md5", "Tag": [ { "name": "britanicauniversidad-com", "colour": "#7FFAEB", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571422, "uuid": "202f25e7-e0f6-4ed3-8106-982c1db852dd", "comment": "Malware payload", "value": "4fdab1d74cb10744bc3e9d6123d45abb0a2dc7f0fe7958ac39b38571ccfcdd56", "object_relation": "sha256", "Tag": [ { "name": "britanicauniversidad-com", "colour": "#7FFAEB", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571422, "uuid": "e65e555d-3d25-45b0-86e0-bb7619e3b150", "comment": "Malware payload", "value": "8b02b3a350e3c4b17f4daa6015249f2dc6d88d96", "object_relation": "sha1", "Tag": [ { "name": "britanicauniversidad-com", "colour": "#7FFAEB", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571422, "uuid": "535d9544-6b00-4e06-929c-5ee74476dc7e", "comment": "Malware payload", "value": "ed3be1f990d67988c257fb1c2896e155e5056e8adedced471c1d17376f32fda42c3836abaa985a25c873ca7a7804bac5", "object_relation": "sha3-384", "Tag": [ { "name": "britanicauniversidad-com", "colour": "#7FFAEB", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774571422, "uuid": "06e51096-c4f6-4216-b32b-6dfac779fb81", "value": "T14ED533347A7D047B1134E8FF541BDEF8176F07DDA1AEB021A379BA5E132498939221B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774571422, "uuid": "e5a576b0-746a-4d07-b87a-6617d7100c10", "value": "49152:TW99SJhmTWa0yf7Fpuj9kr2hV74ypN/vPG8qoazLPUYwdosTqLYLqv89DrCoXY0:5UTxOj9zVhp5vPGeczU/ue9DF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774571422, "uuid": "6b968d1a-6c41-4071-b487-97938f819586", "value": 2939117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774571422, "uuid": "de56b0d1-e09b-4190-9f8d-93280304c339", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774571422, "uuid": "941da4ef-3ff2-4a6f-a4ba-d03791a33f67", "value": "4fdab1d74cb10744bc3e9d6123d45abb0a2dc7f0fe7958ac39b38571ccfcdd56.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3919ff4-2977-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774573058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573058, "uuid": "e5b92fd6-6196-4b59-9d1d-db65c070e9e4", "comment": "Malware payload (AsyncRAT)", "value": "3ca4db5a99ca3679bed1d3d5ea638eb3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573058, "uuid": "8d609097-382f-406c-8bed-74a183536649", "comment": "Malware payload (AsyncRAT)", "value": "5059c7f7ae22b97af2c728a147573a812f0b7232cfdbcbb0a56335be8863376e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573058, "uuid": "d22267f8-71eb-412b-8467-cfc6d1177750", "comment": "Malware payload (AsyncRAT)", "value": "97ebb7d7b9ac6ea5adcdde3d4d61c36a40ef50a4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573058, "uuid": "97862eaf-1f56-44de-8faf-2f5918763a5b", "comment": "Malware payload (AsyncRAT)", "value": "b3520a8074d8fcffc90ec8ba33b235a22e05b82d5e50447d171736d628b1b97c7174f003b344b5bcc78880ef7b65fdb0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573058, "uuid": "276b3b0f-f962-4e6a-ba1f-5b4a6ecb6559", "value": "T1C5436C2877F6823AE5FF6FB51DE23162D239B31769039A1F24C4129A1713E848D417FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573058, "uuid": "a5e217ce-4d4d-4dd9-83e9-3adf023f745d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573058, "uuid": "bef10de6-4dd6-46c4-b1c3-730f4f0e7aa6", "value": "1536:o3epAJSRMFEClDa9zzbYItFJYcyLZHjOEOYTx6:ooAJTzlYzzbYItQZDjOYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774573058, "uuid": "f28f74b9-89c9-4f12-bdd3-8d7bfecd5632", "value": 57856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774573058, "uuid": "e715f0d0-d2e7-40c2-9386-0628b6dc904b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573058, "uuid": "7e008632-f6b8-43d0-9c21-5f27e9fb2846", "value": "dv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad421825-299f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774590120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774590120, "uuid": "84ff57ee-2d3c-46cc-a26e-2449e59ef3d8", "comment": "Malware payload", "value": "b30ae4036682a6b32fd866cd1b364e6f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774590120, "uuid": "78eb18ca-af7b-4cbe-81ed-e99c8da74ea4", "comment": "Malware payload", "value": "520051d1832cb092adad999b9a81bdc8082271da899b5ccf0b013cce655db9db", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774590120, "uuid": "25fb3017-2d88-456b-991c-97e6c81a5ce8", "comment": "Malware payload", "value": "9651a03fb33d9512c0f964f885901762fc51c991", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774590120, "uuid": "e46a7e40-ca30-4931-8f33-57bd07824d53", "comment": "Malware payload", "value": "1879aa2e6976463b271af915c940026338a5d52b0f588f3c01ce6ab4d45085d2ea9a5c5afb9787747875c19db90bd09a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774590120, "uuid": "18d5bc63-7160-4caf-b996-38c139132e28", "value": "T1ADF00E0B3026D79604F30C2D65EAAD97FACE5107DB11BA82302FC12B4F0605765EACCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774590120, "uuid": "559c22be-ad4d-4d41-8c0f-84a83a3cd93c", "value": "12:0G80QpcaxBW3EGWCCGQIhDW2wqPxKMINq5gUYB9hD9F0fyrh1i:0NWrWNGQgW2wqcM8KgUEt9F0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774590120, "uuid": "afe911fb-e6dd-47af-b8ab-b6842d528666", "value": 525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774590120, "uuid": "de3e536a-b470-477e-921f-00a116b9c8a8", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774590120, "uuid": "6f31325d-9982-4ea0-8cb5-bcb3350bab8e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "739ebb76-29c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774606345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774606345, "uuid": "546c8f51-d73e-4d08-8600-07bbab72143b", "comment": "Malware payload", "value": "65d42056f48f16bc098f157894341895", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774606345, "uuid": "37a1cf89-264b-42e5-b103-c69533328acb", "comment": "Malware payload", "value": "520270adf2f2f69021713dfaf5c961d88ba8b06a54d85c68b73bc590ef0ef206", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774606345, "uuid": "089815c3-db45-401a-b002-f1efaef91b5b", "comment": "Malware payload", "value": "0e60e7aa2833e51fdbaf0495e58b203570492e28", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774606345, "uuid": "5ae0c343-bce3-43e7-82b5-448b8e23738e", "comment": "Malware payload", "value": "b18be172bcd2243f2e758dd0013ce10f7e131d83459b15a3ac9797db032c0a82fcc708c6c995fb579acaa4ba04534571", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774606345, "uuid": "67a58df5-5063-41d8-b4d9-48bbe1990474", "value": "T18472F33824324A47DD226285182FF41E2AF3F64FB4D8C8F15677C3B7E272B496246679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774606345, "uuid": "0c4b279e-093a-462e-8f04-03c8e3a2261d", "value": "192:G8U6fN8eXiY2rN7vQthf6phgN3bRhYDyJcLf:V7fulY2rN7vQtV6ngN39SLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774606345, "uuid": "6826fe27-04b9-41b5-b47e-9efc2220313f", "value": 16816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774606345, "uuid": "a40dc6a9-b4c1-4fb7-b99e-4ea81d5540bb", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774606345, "uuid": "f8519c16-c78e-43c5-b2f0-e3880562d5ab", "value": "cori.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a6e6db-29ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774624487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624487, "uuid": "80b84604-0d59-45ee-848e-dac03b1566e0", "comment": "Malware payload", "value": "f75e922f91c60d37f327d402459995c2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624487, "uuid": "3e18ea21-b157-4dd5-8ca2-d14074473680", "comment": "Malware payload", "value": "53a9a68387c211ed7e901d98fb2b44437627ec68acbe9f7ac399e5fd0e37026e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624487, "uuid": "afa2fd80-ff1d-437b-87f0-6d374d69f3b6", "comment": "Malware payload", "value": "de7e6b1dc325b9ad63fb0d4a3bc62fffafca6772", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624487, "uuid": "c3423c31-7171-484c-96bf-b5669f50211d", "comment": "Malware payload", "value": "55de860683c0d509af44ddaa01b872546274b06f325f4710cf445dc5237734111e6271a1162ee6bb9a6530bd3a55bbe6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624487, "uuid": "42d4e50f-e99e-4b09-b6d7-f8131078c174", "value": "T150E4F50A6E729F3CF37487314BB34B24D6AD62DB17B1C585E2ACD1151E2024E592FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624487, "uuid": "b06fdb4b-c1bf-4c7b-9134-c6f4cd8d0206", "value": "12288:1eiLUhD9J2ikFBymcYXt5PKlUo0LzWM749:1eiLUV2ikzymcYXt5iACB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774624487, "uuid": "c1362caf-4bbc-4478-be39-929fe997624c", "value": 667516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774624487, "uuid": "89ad774f-9eb3-4bd6-990f-65306adb84d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624487, "uuid": "293c6944-9268-4006-b35e-37689888d012", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f206a6b-29bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774602552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774602552, "uuid": "f9504d5a-ab2b-42d2-8ec3-46a7f49feb81", "comment": "Malware payload (Mirai)", "value": "95d1c6a2e0ccae91dfdeaad50cc925c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774602552, "uuid": "9bf5a0e0-aa58-4388-8cc8-37321bed0eeb", "comment": "Malware payload (Mirai)", "value": "53da985fb464478cc0b30b6e0fbacd07a53fda438f9de2726e83e495fbbb5441", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774602552, "uuid": "d31bc7ab-a177-4085-8a75-d0f186c92576", "comment": "Malware payload (Mirai)", "value": "a5d65a5aeaf4a295c98c2f0871618f6ba1160636", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774602552, "uuid": "2c5d3835-f49d-4d1e-8ac6-a32e39a0deb9", "comment": "Malware payload (Mirai)", "value": "7d7ff5599f42564db90e357196eb6e0b66fcef93661b3f140043d424383aefb71e45c7e93432b99be257fb5679952c35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774602552, "uuid": "1d999fd8-bf13-4d28-8874-c766966d186a", "value": "T16AA533FD7C4374BA5652DA225B1A78981CB811DC9A7801C57E9D07802EBFCF01BA2E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774602552, "uuid": "fafa61f3-47b0-4fde-8524-3b7268cd7503", "value": "49152:83mRAbcTxIfTI25arAD1mR5xZH6dboQDMKBhB2zIdbSN5x+2ax5LG:Gmgc4TncImR5ja1oyRhBGWbSNPcx5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774602552, "uuid": "6c508044-6698-4831-9800-1108f802e94a", "value": 2167920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774602552, "uuid": "4fcc0e6a-4766-4e90-8253-f620823761c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774602552, "uuid": "1931cebb-d97f-4ba9-8d86-3da80bb1ccce", "value": "wlan.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887415a5-2a2a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774649759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774649759, "uuid": "3a8df3ce-7425-4e27-b79f-17fc302ac622", "comment": "Malware payload (Mirai)", "value": "52a5f3726a710bdf329170bdc1677f15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774649759, "uuid": "03e54b50-e4c2-4000-81d8-c22234e658e0", "comment": "Malware payload (Mirai)", "value": "54a1900acc4f7ca582c1b028e75c0a14fb3aebdb7e9cfd63570497999831ddcd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774649759, "uuid": "cd4fd838-7841-4c99-b442-723ace90b43c", "comment": "Malware payload (Mirai)", "value": "aedf924d7953800c3cab27d60ab278352c4deba5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774649759, "uuid": "9698ce9b-4319-4f4e-9c88-a106dd86a9b0", "comment": "Malware payload (Mirai)", "value": "972acd6d6f023ace49547c8d1af9387b50fe66f01cd715c039eddb2588eff565c6115f140fa8119f5110c1ec2c462b5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774649759, "uuid": "d2739541-004f-49a7-b5c0-6001198b42a0", "value": "T1F404D60AAF910EBBD8AFDE3306EA0A0234CDA45722A53B757674D528F54E50F49D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774649759, "uuid": "4422fe27-eedb-45db-9afc-8b3cfe9159e3", "value": "1536:ZwBr0SNi55UP+B4qRHSsR5AQ1x73Skfvz+ml/3nndBWfMBUui0SAxPgBfh1Y0kgq:ZCr0B5UParRlaml/tBRBrxIlhSZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774649759, "uuid": "7e0b082b-8cc1-4211-a5c3-4b8e1b64cee6", "value": 182020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774649759, "uuid": "4138d7c8-79df-4ac4-b081-30b571314fbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774649759, "uuid": "c73672fb-5779-481a-9315-6af840b25692", "value": "miniiupnpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0e77a1-297f-11f1-a769-42010a9c0008", "comment": "Malware payload (RevengeRAT)", "timestamp": 1774576111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774576111, "uuid": "400fd4ac-5f38-4d3e-af8e-67da9ec07282", "comment": "Malware payload (RevengeRAT)", "value": "1ecf540c1326c4dcdb73fa7dd02582db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774576111, "uuid": "9c90bf2d-9332-43c8-8ef5-2168dc8a05a5", "comment": "Malware payload (RevengeRAT)", "value": "54a26884f7cfeec3d9a374dddafae55820eb0cee8facb98778eef7ea61ae47e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774576111, "uuid": "3c89bd3c-c193-42d5-8b7e-2b5f20175783", "comment": "Malware payload (RevengeRAT)", "value": "dec56f3039eb8e25862323976c39a2680d12622a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774576111, "uuid": "5ef46a33-58bb-47d7-bf83-c494ef747732", "comment": "Malware payload (RevengeRAT)", "value": "0100cbe027ccad198d7e0c07ce965c1d264ae4b6c728e6c970cb5ff03c668ed6fd10580a1892b2ac987a8db272c0bc3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774576111, "uuid": "1ec51451-fe71-4013-81fe-2d605cb9b547", "value": "T1B5A46BE0A790C920C85B597498378573A273B28EECB9870D3D85BF5B3D6239741139EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774576111, "uuid": "8f2145df-7913-4341-9d83-8c9a26952713", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774576111, "uuid": "603d30c7-016f-416c-b9ae-11e8b9f47b43", "value": "6144:pU523E+UZ1v7c6WEnzz2tXr5LigLSoxZ84xjwPyqeruDA1+y:pQZ1vg7A2tXr5LiboxZ5ZrgA0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774576111, "uuid": "ae4fe829-ed3c-4609-9b5a-78115c29f1ad", "value": 466640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774576111, "uuid": "ecf26ee6-d63f-4606-95d9-5bb5ac8d623c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774576111, "uuid": "952e1140-b77a-4ac6-9631-2e7f99890e84", "value": "54a26884f7cfeec3d9a374dddafae55820eb0cee8facb98778eef7ea61ae47e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359fdd16-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774625138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625138, "uuid": "81922d6a-9c68-4dd4-8651-f6ad5eca9308", "comment": "Malware payload (Mirai)", "value": "c42fcff341a384f99f60cf08825fd02e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625138, "uuid": "f20b165f-1353-4c8e-b750-cf95ce30e909", "comment": "Malware payload (Mirai)", "value": "5535e5fddea098cf5306f59c85989aa8e6615d0036aa3e35e43579f99efb9cb3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625138, "uuid": "1ff0f9f0-4154-433b-9561-47ad9db18404", "comment": "Malware payload (Mirai)", "value": "cc8d429c48369706e398e621bad592500ed8de6a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625138, "uuid": "f0caf927-2f18-4eaa-a2d8-2ccfe03e0630", "comment": "Malware payload (Mirai)", "value": "ded4bd861c8e265f0083353db2eb5c07888427897fa06bb0589ce2bd5d3dc335e30bffa841fc0641530399ab54afe206", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625138, "uuid": "23fb921b-af35-4051-b851-d1927bdf7e85", "value": "T12F336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625138, "uuid": "a22010f7-7462-4b8d-a1f7-f9651c8486e4", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625138, "uuid": "d256f8a9-ea0e-4d08-94d9-d0831d65fb0c", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625138, "uuid": "d4436553-ce5a-4bc1-b6d5-75fda552c8f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625138, "uuid": "561cd7ba-244b-4522-b852-c410d54f5726", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b346be8-2a24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774646998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646998, "uuid": "0b416084-91ff-4316-b7d9-7338cbf3f058", "comment": "Malware payload", "value": "ae89db36336750fb87ea78a8d0ef0b83", "object_relation": "md5", "Tag": [ { "name": "77-238-236-29", "colour": "#446042", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646998, "uuid": "e89a43bc-8338-4749-86da-c7d7d0ae4481", "comment": "Malware payload", "value": "558116769157ba364b2a6037b0756e78b8785e5b62d8d97e0b4ad9d8bfcf09c3", "object_relation": "sha256", "Tag": [ { "name": "77-238-236-29", "colour": "#446042", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646998, "uuid": "ec57c761-b813-46c8-ac92-bf0832bd5148", "comment": "Malware payload", "value": "90c22c96594c52ceafa551c563e60fdf2f5c332f", "object_relation": "sha1", "Tag": [ { "name": "77-238-236-29", "colour": "#446042", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646998, "uuid": "2e8e371e-8cab-4d6b-8aa4-892222f5812e", "comment": "Malware payload", "value": "e89eef80cea1204cda7ca62f93e86b819d2ec40bb30cef2109472d6d9962316622226ba052bf0ff9fbcb5505c129f88f", "object_relation": "sha3-384", "Tag": [ { "name": "77-238-236-29", "colour": "#446042", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646998, "uuid": "788d700d-61ca-4bab-9d3d-83a8f81145b9", "value": "T138955B11FEC764F1E403163259BB22AF23399C050F36AA97DB84797DF9BB2D41826349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646998, "uuid": "1fa7ebde-3e97-4551-94d4-840bdc210a43", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646998, "uuid": "e1d54649-b715-40be-adaf-e003460bcbb6", "value": "24576:NanWkw4EZymTFzVe29jcpCDlHYwnJEFGaXZaaDnxOvzYqmh4bFa3Ev5:oAII9CYE4bFau5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774646998, "uuid": "bbbdfb37-dba3-4196-85f0-1af393a3068f", "value": 1912968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774646998, "uuid": "75be524b-53aa-436b-a6e4-b70f9ca6f1d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646998, "uuid": "611b3c9c-71f2-4f55-884a-e10c31b5911a", "value": "qgB7ZMYQE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9eb668-29b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774597743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597743, "uuid": "ac063fb2-54bc-4ec1-b1fe-612d81738f16", "comment": "Malware payload (Gafgyt)", "value": "f9f6cbc3f323f67a144370cce8bc61a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597743, "uuid": "deb0fef5-9dbb-4645-9724-2e27bce107f1", "comment": "Malware payload (Gafgyt)", "value": "567407079429b656f934d756da30eb0d1f2b6bf3e0765c67b7095e6ea4ce316e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597743, "uuid": "e20e9497-cab9-438c-808a-9de804644f35", "comment": "Malware payload (Gafgyt)", "value": "9efa5bda102b7dab74c83348b66634e7356b32a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597743, "uuid": "0afc1114-bfc4-4c4d-bedf-6c1e8ef3d845", "comment": "Malware payload (Gafgyt)", "value": "bbfcce0ba090b18fbb38081ed53a834c93660848d3af57bfe6501f8336077a351d579761cb8ff6725ebdd136563f9f9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597743, "uuid": "c77ce190-58c9-42d7-a9a4-4cb0061cf44f", "value": "T182E3F842FD418F13C5C321F7FBDE46993A1A6F6DD6EA32029925BFA037864D60E36211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597743, "uuid": "6109a6b2-8096-4323-81f9-3d0786f31cf5", "value": "1536:z0ON+iffYIRCpx7AaAHO4VKmFTfecR9iA0EOepjaDPui3lZWwywe5o2rdaQOgzpZ:b00QIGx7QO4pFzecR9xLAWeNAJ8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774597743, "uuid": "cb21fe0d-00f5-416b-97ba-0fdf6f4d67e5", "value": 143340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774597743, "uuid": "5009345a-e1fd-40a8-990d-d610209abb1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597743, "uuid": "be0d0d03-3cf3-4947-924e-716f58965b55", "value": "alabama", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99dfef96-29d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774611992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774611992, "uuid": "0c6fc97a-82d3-48b1-babd-8d97e35a758b", "comment": "Malware payload (Mirai)", "value": "c34e983960b02007820f8fb7d57528aa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774611992, "uuid": "f65e245e-003a-44b4-a9a1-e5b2011a8caa", "comment": "Malware payload (Mirai)", "value": "5711653c446f73fe1646fbdccc5e3cd9e7df64dd0916ae52ddc9587296a71972", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774611992, "uuid": "0ce9bb00-cc5b-4b83-bff8-5b68bdaf66ec", "comment": "Malware payload (Mirai)", "value": "33885a7cf6ea121adfe188a8dec8a7273c6bb26b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774611992, "uuid": "6178cc32-4586-4e26-88e6-9694b84ca927", "comment": "Malware payload (Mirai)", "value": "23e28086b2c90bc7af091ee90373e0a3dd7c9a6dbc8245953cc2d034b6ee280b5ff93aac64c1e1a90e4bbdcfa7e66bd0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774611992, "uuid": "00696359-0aec-4ee9-85b7-27f7cccef323", "value": "T1F17302F9070488EECD50AAF746FA8B661F410DB92082CD40E5A6E6B21BC75743DC7DE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774611992, "uuid": "3b1d8e69-2760-43c4-8211-e5fb99ac20b8", "value": "1536:d0B3b87urwemjU1Fh+V3z6HdTSPzy4JTJeSesSg0uqTDBaVJuq:dwweV+VGHdTyf3esTqfQVQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774611992, "uuid": "01a1a4ca-8a08-4260-bcc4-4ac0b834489f", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774611992, "uuid": "850b5833-2d92-4d22-944c-97a7ee6be1aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774611992, "uuid": "2a072952-cfc8-4d69-8e3e-6e58b7c520b3", "value": "kurayami.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a4c725-29f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774626699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626699, "uuid": "4d96f540-6920-4225-884a-4f4bb7eb69af", "comment": "Malware payload (Mirai)", "value": "fccd049bfc81c7771bb2c6a4078e3776", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626699, "uuid": "632d2a2e-d8f8-4249-9074-cd5dbf87ea86", "comment": "Malware payload (Mirai)", "value": "572d96f8d6747ca3d15ee077779a89a416587a20529f651c4fa7c4ad063d89fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626699, "uuid": "d6c1161a-89ab-41f0-9693-73ad34b429c7", "comment": "Malware payload (Mirai)", "value": "099b3c1ca31c0a5affe0d41013c4a18bc9af9744", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626699, "uuid": "bf784b89-0b02-4071-937e-c097e0725f44", "comment": "Malware payload (Mirai)", "value": "549a48f2ad94b81a3fdf993364627e69cbeb165065d3ae163c0ed2f95a7ad83c477758825f47e8ccac35a5594a587d50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626699, "uuid": "abd4b94a-8ed2-4e73-98f6-77fb1d8df65c", "value": "T11B04D70AAF910EBBC8AFDE3306EA0A4234CC945722A53B757674D528F54E50F5AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626699, "uuid": "9a6679b0-f48d-46e3-955e-371255d0cd12", "value": "1536:Oti1/LaSkRlL0/4n6DZjgeAz9RHYaDdcJNRvB98a+DsD00BynD0TyyQJOs6eRImk:oiXkRlLZkZJRP8IZKpykz6aIsXmBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774626699, "uuid": "374dde67-b3ca-4f4e-8bcb-5554e62260ff", "value": 182020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774626699, "uuid": "8b1b0a1d-a6fb-4198-9d06-bc3ddeaa867b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626699, "uuid": "41f3ad1b-1b67-437a-b5e9-3c8c9a0f96c7", "value": "miniiupnpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a261e9-2a20-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774645375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645375, "uuid": "076dc837-4bb3-49b3-adc1-bd7c0f0cf09d", "comment": "Malware payload (Vidar)", "value": "cbe3f9d0797778960ea259f7d1233261", "object_relation": "md5", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645375, "uuid": "2414258c-c440-4a0c-befe-2b55b5e386ea", "comment": "Malware payload (Vidar)", "value": "57d23d43341a9a717d72fbdd5a58db44e39290f045882582f1c2bebb034a9588", "object_relation": "sha256", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645375, "uuid": "6687d503-ee90-4e1f-bab8-388bf83442d6", "comment": "Malware payload (Vidar)", "value": "fd7166f72ae4f4ba05ff5c4b31cebd2fdd5c3a30", "object_relation": "sha1", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645375, "uuid": "7d89b7d4-3230-40ff-b4d3-f112fa6b480e", "comment": "Malware payload (Vidar)", "value": "c2274b8a41292714ccdb06d43368ec27ba90a2f3b1d7ab24654e69d65522de85db799b127e022ceb6db768778d8bb596", "object_relation": "sha3-384", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645375, "uuid": "d47e409f-495e-42dd-aebc-0aafd57c7768", "value": "T13D856C1BBC9504F6D0AAA73688B32692BB70B8090F7123D72E9076783F767E05D75748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645375, "uuid": "e3b7145b-486c-4c66-8a60-554e8b7de569", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645375, "uuid": "c94543b8-1bab-4dad-baa3-cfd03637690f", "value": "24576:3mVCjv22R4L8inBVNMIQN12DeleNK84HTwh3xOa:3mVS+2aLpBbMbdzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774645375, "uuid": "86983474-b051-4939-877a-dd99304ce9fd", "value": 1810072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774645375, "uuid": "126d0ec1-1668-4d07-ac8f-37def3c49ffe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645375, "uuid": "4810af97-c992-4f6f-adce-778161dc5052", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6514f8e3-29c6-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774606750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774606750, "uuid": "bcb2df0f-da1b-4423-9114-117cc0cfb893", "comment": "Malware payload (LummaStealer)", "value": "e4e2f336b49315180dd91c017cf64d34", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774606750, "uuid": "c5c91e8f-f80f-493b-9b5d-87f50deb491a", "comment": "Malware payload (LummaStealer)", "value": "581b531ede203446cb81f721e2ab1fb12c879a9a7d7768102bbd6a514df98292", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774606750, "uuid": "c621c927-c318-47f4-8144-2fd08a6ca7cd", "comment": "Malware payload (LummaStealer)", "value": "6ba58593fae2819aa0ce5b066c4c54388129453f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774606750, "uuid": "d8ae858d-3884-4315-9b71-e74b47222dac", "comment": "Malware payload (LummaStealer)", "value": "9f7141475360532e792d7257e515439c2fbb2a7ce1efce37fdb334460f3a95ea526acb174df57d86d25f115194eddfea", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774606750, "uuid": "4043e534-6a3f-4328-a8a7-da9b298538da", "value": "T1A5A56C01FDC749B6E902573649AB63AF2734BC050F32DA87EA847B79F9B72D11822705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774606750, "uuid": "6aaef7e3-d352-4bb6-b023-dd85fa3528b2", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774606750, "uuid": "d7215194-a161-4076-bf9a-02aca39ed18c", "value": "24576:+4BsxjlqzdgLg/Li1MTGRmMZutO4NzJXV407AEZ7GdZYnWGN8Fq7QFuZi5o1rN2J:+QuOaVZIjkv0IixS/iCgjbPp4bN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774606750, "uuid": "51bc18a6-d29b-4e7a-8496-0ced0b731784", "value": 2137752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774606750, "uuid": "155738cd-fc00-450d-9c26-e3f9255b2273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774606750, "uuid": "e43ddd32-7c7f-45d0-b549-7e7060d34243", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0aab80-2997-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774586602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774586602, "uuid": "453e7a1c-4033-4033-bbd7-3c2f0358dbf1", "comment": "Malware payload", "value": "f7a13f6682b19152afc0b1f76fc1b92d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774586602, "uuid": "b2cd7c16-0ac6-4883-9a96-4b31f1b80c5f", "comment": "Malware payload", "value": "58c45a9a27340029a0480d9f27701d98e0ad7304a94c223119083b1d303d878c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774586602, "uuid": "8704464a-39b0-4291-a8f6-1dd5ad0f5087", "comment": "Malware payload", "value": "1b372f8548934e58e6e425d35178ae6c54c0ab4d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774586602, "uuid": "20aef1e1-2129-4403-b8e0-e0fa259cd84a", "comment": "Malware payload", "value": "fa79ba7c0a2b12541ca61540c468a4768775faaa82362da15c698f403123c0527c0000561349d530d5e9f84b84b2f1a0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774586602, "uuid": "28ebe9d1-ede3-49b3-a688-94256b1a9e73", "value": "T13CE61981E75D7932FAC8FAFC5B5D0705B72CD5A46321CA5A392D80289FD7BA178320D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774586602, "uuid": "8c002ea2-4edf-4105-b4ea-958788e6eece", "value": "98304:e1p75iK/wuFhQK72DSQ/FfbHcuZeAV8u0+8NyoHmUDcEYmy6V39:eDtiK/wuUS2DSYwlYmy6V39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774586602, "uuid": "04953f19-097d-4b64-a4c3-a51cbb364a11", "value": 15260928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774586602, "uuid": "635e8c20-5ebd-4004-b0a1-64e95bc09004", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774586602, "uuid": "1c18c766-bb5a-477d-9157-1797c860dedc", "value": "UpdateHelper.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966b4468-2a14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774640333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774640333, "uuid": "8e019b52-d1af-42f1-9ead-be356cf9ccbd", "comment": "Malware payload", "value": "85825bad50ab1228514962733584c041", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774640333, "uuid": "dc0a37c9-fa60-448b-91f0-bdfdd1ca5418", "comment": "Malware payload", "value": "595355daaa6aad284090210cd55c4a2e276c5263c83d2b202e1486d347af3701", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774640333, "uuid": "9a76f7d5-f177-4c9e-b741-1db8c77aa2df", "comment": "Malware payload", "value": "25504f0bab3d46ccbfc425bfba92cfde63f06577", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774640333, "uuid": "ae9c3f3e-898e-4309-8c14-6b7d9679fc3a", "comment": "Malware payload", "value": "fa3eb0a98caddc9e0800652fb32efc0756e0643f64043e30ac2e2785bb923cb1522d2ba32069dfebbbfa6447e28486a7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774640333, "uuid": "3dbac5ee-9abe-4675-ada1-06022936d916", "value": "T166262343EA98D837D2A3923281F98507B9D4020156D4F7772EA4E44D8FE3E215B2AFDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774640333, "uuid": "b2fd209e-509d-4684-bac3-b4692e9f0f07", "value": "98304:eKgMGsJ39M1Ur/+MdCzyxk4i11g+9JhX6+P1BWjI3C4ImK4u1a7Y:DvS1IL21/5RRCEKxa7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774640333, "uuid": "21769de3-2815-44ce-b6a6-8ad5b9c50042", "value": 4631421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774640333, "uuid": "2bbbcb3c-e77c-4913-bd94-7bdf76d961a2", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774640333, "uuid": "f2c9a34d-b6dd-4a2e-af58-79e765805117", "value": "painel cheetos.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6756d58-2990-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774583666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774583666, "uuid": "f5c7050f-3b18-441c-b2f7-4fa5784f35e0", "comment": "Malware payload (Mirai)", "value": "5ae03c4ed3986852fa74c0eaa643f679", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774583666, "uuid": "63e95afe-828d-4325-adf9-55aa2792830d", "comment": "Malware payload (Mirai)", "value": "596c8f7ea651baace8a5e9cfcc29417f56f3b424e7d088cbf8609a256773b084", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774583666, "uuid": "d99e53fe-befc-4e2e-8137-4600441a3628", "comment": "Malware payload (Mirai)", "value": "61a65c5c656f976c3a9a1f660a1dd12cada39a99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774583666, "uuid": "8311b5b0-93c1-48c0-9633-eb179d383ac9", "comment": "Malware payload (Mirai)", "value": "56bbfe1b1d5b7975064977b0a943a25eba6c7760a20a407b6a1057799ba7425b42da43dc60a42c5e171c01c9c9b1f500", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774583666, "uuid": "646930aa-628a-43e2-bfdb-f36bb82ce06d", "value": "T1290429517E419E33CBD0677ABBEE42CD732223FCD3EA7112EE015B16369642A0E36552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774583666, "uuid": "8b9516d2-2e87-425f-bc25-11e8c275e44c", "value": "3072:Wt3KlG2sgIYUrhgBHhJcklRZakFtw7sSA8kHpnDAZTkOdeynO53JlvmDiebisWoB:WtKlG2sFYUrhaPlRZttw7sSA8kHpnDAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774583666, "uuid": "f817ce2a-7869-46e0-a2ad-585cb0a6320c", "value": 187448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774583666, "uuid": "27e353c9-4382-44a0-8cbe-d34b3bf83312", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774583666, "uuid": "54972d79-05de-413a-b037-25bea6062572", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6abc9b65-29ee-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774623939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623939, "uuid": "96978501-4be3-4b2d-9a02-8e104c528ec0", "comment": "Malware payload (ValleyRAT)", "value": "7ce00a79b13f725e6cf1db3b68a474a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623939, "uuid": "0563dd27-af8e-4ffb-ae1a-a1760e8f1332", "comment": "Malware payload (ValleyRAT)", "value": "5973d05643897671584fae16c567ba9d1aab5e30e6ea8ad5fbe7e60c4005ac07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623939, "uuid": "28d803b6-8d3d-4b55-856e-a490333ed708", "comment": "Malware payload (ValleyRAT)", "value": "abfd60aa1e03d6a4d5bfad00015a7e3b49cd735d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623939, "uuid": "ed718859-7275-4fee-b72a-dd9292ac4c89", "comment": "Malware payload (ValleyRAT)", "value": "7f07aecfc21b12ce4277cc4994481ad1cd1e3b9d46dc7994ea2a3c9b3499c4a4dc28a32a3992882833b82504449bf27a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623939, "uuid": "9330aaa8-8267-4515-8feb-a3c54a7ccac8", "value": "T1F6F58D83B2B65264D5B7C23486A7951BD6327C078F206ADF125CB7592AB36F01F3B318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623939, "uuid": "0b367f30-895c-4c1b-a6e6-c502def807d8", "value": "ab50176ee807a81cc981b662024eb6f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623939, "uuid": "e05e1376-cac8-4edb-a4cb-3175b22ffc55", "value": "49152:HW5VdGzBRCIsK1O6PKb05skN7TJDPw9f+cFfbJsv6tWKFdu9CwPTvG7ApHFhh6Df:+7WvV5m+0bJsv6tWKFdu9Cwix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774623939, "uuid": "9602c96a-30a7-4df6-a059-79dda48ce3ea", "value": 3564032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774623939, "uuid": "710f0b1d-89e3-4849-9507-0931d1624a31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623939, "uuid": "552325f5-7c15-4654-a77b-65f69cec419a", "value": "3\u670826\u65e5\u540d\u5355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6129a0fd-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774625211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625211, "uuid": "7dd16dd0-c6a7-4ecf-96fb-93198da38627", "comment": "Malware payload (Mirai)", "value": "399bf2b37528494395bf825846f5f4e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625211, "uuid": "35de523c-51f6-41f1-9029-71de80ad47e1", "comment": "Malware payload (Mirai)", "value": "5995e239d293171bd1e6f2e2c06371bf73745aabde1dbcddec737e06741a295e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625211, "uuid": "b9e1bf82-181b-4801-8b27-807e1d20c8e1", "comment": "Malware payload (Mirai)", "value": "76757fa1b17129ac8198b07fd97d49be59fc9b17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625211, "uuid": "6e955077-3f90-469f-b3b5-abe10d304a42", "comment": "Malware payload (Mirai)", "value": "02e059b9e0360f8f3a2dc233989649a4ec555f587192ed008411260f86ef39f1c03897d631ea37d5d44e41d9d0adfbbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625211, "uuid": "98c24ea1-ef76-4f55-97e5-e5b012221191", "value": "T1312309C8F443D9F9DC4A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625211, "uuid": "9288b363-c3f2-484c-81a7-c2828db37866", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AGAZq/4Qw7bn2i9e:Gv4QPfZfW5XTOeoEz0qAQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625211, "uuid": "8f851778-a924-4a23-b6a8-1118e8c65a51", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625211, "uuid": "387925e9-2b59-4659-8876-f2ebbf65522e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625211, "uuid": "fd738078-e561-4918-93af-1ac2873836b2", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d99335-29ed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774623560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623560, "uuid": "e90bc687-7cc1-40a2-b3a2-1e812b9883eb", "comment": "Malware payload (Mirai)", "value": "45f28da25eb318a4bb3b0eb0578ce273", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623560, "uuid": "ae3e3dc3-9309-49c0-9ed2-e3d4b46aff51", "comment": "Malware payload (Mirai)", "value": "59fe51af4284824ffcbbb4c3c45a53bf2038aa762d90dfd9163b9440bf221c89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623560, "uuid": "0554213a-f268-4896-944b-b6cd14ca2e39", "comment": "Malware payload (Mirai)", "value": "5aba171cc362e8041fd4fd172ba86e7011cf39a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623560, "uuid": "ce67733a-3d5e-4b2e-b973-0084361e4b8e", "comment": "Malware payload (Mirai)", "value": "ead592a03c7c3100d7f9298badcd9b1d2d1a0ea714ca873f33fdc92137ed3b27664907bc816f6861adc848e8068b69f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623560, "uuid": "e2bf1d1d-233c-461b-924f-ea500f8885f9", "value": "T102431891B8819A23C5D4137AF56E56CD372123E8E2CF7217DE214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623560, "uuid": "138d05bf-b572-4ef7-b204-b33f5f9ff66f", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774623560, "uuid": "4c52d8c6-a811-42b5-81ac-1b26b51bc8c4", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774623560, "uuid": "c1f3280e-f841-4e22-bc2b-bc4cf6e32e7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623560, "uuid": "a1d07184-ea56-45e7-871e-4cde860e1bc5", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53568b41-2a14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774640221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774640221, "uuid": "aa8f427f-bcad-4b0b-91c6-45226eb8cec6", "comment": "Malware payload", "value": "7f542ae6eb826dbcadd42212c14f5e54", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774640221, "uuid": "25e3065c-0bb3-40ab-98d2-7472a3136187", "comment": "Malware payload", "value": "5c8e0662fb1cc5f8e849456bc0a14ec12fb25d11eb837edb963f686e2bc3f3b9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774640221, "uuid": "b69cb8fb-e78a-4746-839e-b16d9683e198", "comment": "Malware payload", "value": "4377e09823af806f21b5caf03e9c845edd9a4706", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774640221, "uuid": "e62a02be-ee01-4c9d-82c2-66419984b8a8", "comment": "Malware payload", "value": "9a3226f26f4ed5b146bbfcc806cbd126aa1e73832300fb718f4e5aea0cacdee31840c91a702d930229ccc0a107d86d29", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774640221, "uuid": "1e285b07-47b1-4b50-9890-51c6f221bf09", "value": "T1E3163307EAB0F976D39A7DC268ED4748569B06E1F3B805A46C1FF092F2056CCAD10E6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774640221, "uuid": "48ab956b-9390-488f-b765-e37835c5929f", "value": "98304:VekgXPEYVZ4Ot6MJ3XY5yyutpSbS3U8+YAOiYMAIVKw0GM4:kjnL3ogTjoNpYEv0G/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774640221, "uuid": "5652c7a5-568c-4161-99b3-427e7187b667", "value": 4320037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774640221, "uuid": "017a5608-add1-4efe-851a-951a0e17d0d3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774640221, "uuid": "314e1758-522f-4f75-9cec-bbdb2d61ce52", "value": "5c8e0662fb1cc5f8e849456bc0a14ec12fb25d11eb837edb963f686e2bc3f3b9.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4658c3-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774596377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596377, "uuid": "2d503a33-bc3c-45ab-9ddc-584f16adc6f3", "comment": "Malware payload (Mirai)", "value": "7db0bccc16a80a59502b8b972d28f1d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596377, "uuid": "591ea0a4-4517-4303-8e8a-80b9312cd59f", "comment": "Malware payload (Mirai)", "value": "5cf489b1e70926f2ad7a737196ffc28f19a04d3f092971ccbaa95e9c3ce54576", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596377, "uuid": "642f3bfd-c7a3-4201-9371-7d1684266e43", "comment": "Malware payload (Mirai)", "value": "967bcd870b209c19a5af1aeeecb77bd2e89f21f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596377, "uuid": "14854a81-7517-403e-a34b-d77a297199b8", "comment": "Malware payload (Mirai)", "value": "df867bab595efac230e4e002c330235723e97445998a29eb9905809a5167e4a650209cac3b72994c0bfc4931e484debf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596377, "uuid": "57aa9b3d-c64d-456f-b348-38726bf430bf", "value": "T1B4D3B021E4006DD1EC2129F578BA96B80350EE700BDE1582EFFDF95E647BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596377, "uuid": "3c3ba61f-6bc2-458e-9420-73d12777d6e2", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xp:PiySSGp+PMmT7zMplP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596377, "uuid": "b50d04a9-7d68-4c4a-adad-731d4478c64b", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596377, "uuid": "7fb187c0-6f18-44e4-9676-e3c481e85de4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596377, "uuid": "cc39e175-0e7c-4981-9b44-4a178caba138", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f566d0-29a1-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774590987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774590987, "uuid": "7222db94-d9ee-42ba-ad8b-9a06be49b1e8", "comment": "Malware payload (ACRStealer)", "value": "414e213506632eb8f0a50ca923ec35a3", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774590987, "uuid": "114b3011-e504-4b24-a4c6-2466a3d2c2c3", "comment": "Malware payload (ACRStealer)", "value": "5d18862be945808282a45e8d6ef0e1dbed106db8fdf6e24e12b1fdc40d63cadd", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774590987, "uuid": "997bd80b-dca1-4698-848a-2c519deefe09", "comment": "Malware payload (ACRStealer)", "value": "df14c9a80cfc1095870779163eff849fc29f4b7c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774590987, "uuid": "e63d0400-46a0-43ac-b792-5f2ef0c88a20", "comment": "Malware payload (ACRStealer)", "value": "fd9d57be4b8c6e105d093c5c8d1ec127e96cbfb1e191b5aa7df3bbe0f927d000b34b486ccd88abbf003aa7c619a3c4d7", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774590987, "uuid": "29d05558-218c-4fbe-a640-beb094fcbc3f", "value": "T1A7365A4BFCA219A4C8AA913485B74257BAB17C051F3163DB6AF0F3251F327D01EB6B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774590987, "uuid": "54e47766-8698-4bb5-96d7-6f076d51db17", "value": "534141bbeafb0cfa024f8b6830c176a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774590987, "uuid": "b8666f92-624d-4510-b957-b90d5e7e0583", "value": "49152:QEbDdvOhy5Lyv58PlVcBpAOQvczzSfe2ZC4WTjSwBeo47Qcipkk6Vc:QER6j9zOWuov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774590987, "uuid": "d97971d3-b042-49d2-8a6a-f4b57b47d0ce", "value": 5197824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774590987, "uuid": "36365cb1-32c9-4501-908a-b865e05a55f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774590987, "uuid": "e452a29f-b159-41f1-a528-1400bd4f3a65", "value": "SecuriteInfo.com.Win64.MalwareX-gen.28196229", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38949089-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774625143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625143, "uuid": "fdbdc2d1-d126-4f23-9459-64ed87a2c30b", "comment": "Malware payload (Mirai)", "value": "6e01f6315650c5019aae7a3425faeab9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625143, "uuid": "615b47b3-cf41-49f0-a3b6-4fc8d7a18d0f", "comment": "Malware payload (Mirai)", "value": "5d2f519e2d4ee2b40dfd17745df91b19fac2bb2e8aed2e01ab25c06d0a404bf1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625143, "uuid": "542b5188-b71a-4fed-bf38-d0f2cebe1b42", "comment": "Malware payload (Mirai)", "value": "45cce0d23664da604cbf8a33ce76577743cb38bd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625143, "uuid": "70fce850-c215-4b12-b741-7f35f35b4802", "comment": "Malware payload (Mirai)", "value": "29714294dded7b37bed43d46f64cb052c78fbbc97c9284ba723f89abca79eecce0157eb3ea3ddc9e859eace0ea9dc0b3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625143, "uuid": "de7bd5a6-5919-4831-908e-470b7068688f", "value": "T179432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625143, "uuid": "7f2001c3-68d3-42bd-bae3-4ebe45a47700", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwH:RqtmZPuutfbltZFBSJsBcfDSTFI+BEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625143, "uuid": "42d1d7b5-094e-440f-9f8f-7ec79629f840", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625143, "uuid": "8ccc4ab7-1680-48a3-9b3c-0dd90de8458b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625143, "uuid": "4744733d-0aea-4ec4-815a-992e46bd6d59", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c66041-2a2c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774650586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774650586, "uuid": "b2d54ce2-f6a1-43d4-adc6-75565014f09a", "comment": "Malware payload (Mirai)", "value": "30d50f15008f181c5cdb13b207d0e056", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774650586, "uuid": "9e6561f7-1f85-4358-a2fe-872451a10bc3", "comment": "Malware payload (Mirai)", "value": "5dbe1fe7e6fb6230ba7421576067fef73546906a39252a6b85232728e28bf2bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774650586, "uuid": "6bee89ce-98f7-4bc6-9800-f844c2062e5b", "comment": "Malware payload (Mirai)", "value": "507f1f6e411f0194c48fbbfc72e1ad2e8ca541ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774650586, "uuid": "3bf1b288-b756-49e3-a5c5-450bfa3a4445", "comment": "Malware payload (Mirai)", "value": "9bb2c55e73ef18a7bd98e44239dbb15ca524aa12ea70ce046dd18e5b402feeb4880158c3ce2124bf9bbd18700ec323b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774650586, "uuid": "02da26b8-34d5-46f5-b5da-2d5d026776bc", "value": "T18FC35BB2D875AF98C614D1B4B0B08F7A2B639AA481871FFE15ABC3758043D8DF5057B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774650586, "uuid": "10527652-6aac-487d-869d-67b011650ff2", "value": "1536:t/upLpOJfnOY93XKACnKoDbBdDoRKi99WDi700Z//8dxT8R:cpLufnOyKAHoPoAq9WG70IMdxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774650586, "uuid": "6a1b30f0-1125-457a-aa04-4f935170bf6c", "value": 119024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774650586, "uuid": "86ba3fd2-5e74-4a11-b43b-05887cbcdd45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774650586, "uuid": "60c7aa6d-bf0d-446a-837f-1b78ed622516", "value": "udevdpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8044cc82-29bb-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774602071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774602071, "uuid": "60806c79-4c5e-495b-b894-f7cdf8d49782", "comment": "Malware payload (RustyStealer)", "value": "9649c7c09fa8474bdd88ac14196230d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774602071, "uuid": "9ee59ea0-23e4-4b37-bba7-1f13e2f7254b", "comment": "Malware payload (RustyStealer)", "value": "5fa5a32476d1e677e544e27d795a8c627b5ed9adf210d5c9b9626c1173115a62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774602071, "uuid": "64b951ec-4b35-4b5b-93cb-9e1b88e6d5d3", "comment": "Malware payload (RustyStealer)", "value": "ea1657f1bff3bb0639cb292606d1e988fd83393c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774602071, "uuid": "96613743-07f2-47aa-9cd3-70871323d869", "comment": "Malware payload (RustyStealer)", "value": "32feb84365500d943fe226310d313d76f90a5d3e1f4db7b9b1bcdb981d44555ce22c65f9295bdab46f3850afb54650be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774602071, "uuid": "6024224e-b8fd-4560-8cbd-db5f2acff24f", "value": "T13FC61603F19A40EDC01DE076DB57A222F6627C490B6467EF27D04BE33F66AE06E79644", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774602071, "uuid": "1fe6c4a5-3f02-47f5-bdf9-dfe8fba8541f", "value": "eea387c133b5fe0fe273a9524ea12de8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774602071, "uuid": "50c174d9-75a3-447d-a4f2-c16e27cd0d94", "value": "98304:epZ1zYTytGTOh6c/NARDPwvT7CUs8w8+bUzBEPaZ/Kwn+C4CyiPDmM94:ezptaOh3/NAFA7Cv8uPaZsC4CrPDme4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774602071, "uuid": "45499694-dbd2-4402-994f-d46130bbb7c2", "value": 11909352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774602071, "uuid": "803f02f1-fef6-48c1-84ea-6c0c3f5f806d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774602071, "uuid": "32a19e0e-91ba-48b6-8741-ecf3acb6894f", "value": "NovaViewer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747392c5-2976-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774572416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774572416, "uuid": "fb3e47d7-3464-4279-a136-a2e7b5d7b5b2", "comment": "Malware payload (RustyStealer)", "value": "59b95eb1f172aed63984159382819b3e", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774572416, "uuid": "6cf4e860-8b82-43ba-9248-40a61bedbde5", "comment": "Malware payload (RustyStealer)", "value": "5fd590f2e574058ccebc379e90fd40f4e10f9ac41af17dfff7ed42447d35c377", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774572416, "uuid": "5ecaab48-e293-41f7-ad24-a0edaa29e1cc", "comment": "Malware payload (RustyStealer)", "value": "8e52e717d9e7113cd8cf52693139acb2ca0826eb", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774572416, "uuid": "1edea982-6967-48e7-bbc2-eae926bc1ef1", "comment": "Malware payload (RustyStealer)", "value": "695ede30fa8940bb7e42028f9bc7ca0cf458a3e220fb6419777a2560ea36accedf7afc938f2898a7c131c8b93678e221", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774572416, "uuid": "1276f1da-ddb9-4a71-b0d1-9518ed38d520", "value": "T14476BF786204ACF6FB2E923BC5962CDD07263772178BACC974B861C11653A75FE3AC44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774572416, "uuid": "51dd4ab6-368c-4100-96e0-3ea2f923b078", "value": "f2208eda4fdead9ec7d3fe1e23f5c204", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774572416, "uuid": "c690df4c-1c4b-4705-8349-e35fbcd56e79", "value": "24576:z5OW49JF+sMy2vldrIu8HnKah/BF/lc2ess6FLfYZ5wYRM+zPwSWQpUVtzV1H37P:z5OW4zF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774572416, "uuid": "3337dbf9-952f-48dd-9451-081160e4796f", "value": 7307407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774572416, "uuid": "addd7984-2898-4caf-a11a-b84164b9f517", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774572416, "uuid": "c49ab1ea-ce2a-410e-af8b-c67465a2209d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf9403c-29fa-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774629281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629281, "uuid": "1bdd234c-e367-4c97-bc1b-320b758e44e5", "comment": "Malware payload (AgentTesla)", "value": "1c90185d9c6e0c5b71ba97f17cd45dcd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629281, "uuid": "95e405d3-97d1-483e-81fc-36c79927e1c7", "comment": "Malware payload (AgentTesla)", "value": "60d7ecfa5459d57946bad25c71577ddff454bde012fd802d340830a6a6a4d94f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629281, "uuid": "e525efba-3229-4f87-9db5-d5f17a567ee9", "comment": "Malware payload (AgentTesla)", "value": "e8c8b6bebf1cf4d99518d2ce1917e42d12b08978", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629281, "uuid": "f203132f-35f7-4b7a-a066-d84a2c0f40c1", "comment": "Malware payload (AgentTesla)", "value": "6bd9abb0014b09f414e4ea82fe2075c9bd9d77ac025c2959daf0d0ee15d2e448ddef1ea8849b976b299946572ae9ea2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629281, "uuid": "1da43323-6a3f-4b25-bd5e-32372e90c555", "value": "T16094C043370885F5CC7A9A32E52790552A3808FE61D4664B3BEC67EE2DB0B510D1FB7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629281, "uuid": "d1d6c22b-8a6a-4b1a-8d31-24bc4b6a983a", "value": "e2f3f8ec66b7e1900c37978aca89d3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629281, "uuid": "2244c6da-e3ac-40cc-8297-b0a40bbea9c4", "value": "6144:BMBaOmEYWswbLTHw9qDeYOJPMSmUAlifj9gZmnuR7cwDYHmLj4ioJK:eoLwPbwqDi1+xp7FGmO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774629281, "uuid": "68557ee4-c1b1-4824-8d97-721ba3da244e", "value": 420728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774629281, "uuid": "d25ccee5-3826-4a8a-8225-2c8ea79282d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629281, "uuid": "1376eaad-d1d4-46df-9060-4a70e9994b26", "value": "image009876543210027032026_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea67c48-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774596350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596350, "uuid": "8a8579ea-8239-46c3-a9d9-6c7ce79553ca", "comment": "Malware payload (Gafgyt)", "value": "319ea341973f79a0767d607302d0fc05", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596350, "uuid": "3c55958d-c682-46ce-aee2-c01b2b52156b", "comment": "Malware payload (Gafgyt)", "value": "60f401afeb6054e531916adb8118df45fcd7d4c1d166ac28197c67ecba2ba60c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596350, "uuid": "63199d6f-eae8-448a-a94e-71c21d4adf03", "comment": "Malware payload (Gafgyt)", "value": "7f53cbcacbc25f28c848cc5e56a4dcafd06c9734", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596350, "uuid": "b352adc6-bc95-4996-af69-42b7b4e37201", "comment": "Malware payload (Gafgyt)", "value": "d13d50864d0e6de2cfeb6e3db29e9e96e0ca959db10d6f51f9d93aba583374fee05592c86917f77a6429b21fa25a811b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596350, "uuid": "4fe1027c-f0ae-49c4-8165-d9644618f8a8", "value": "T1C63184C9083519D40A579E80A9B186C5B90BE7D0BA948EC7E7C61D7170BCDD434B87DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596350, "uuid": "5045d19a-0a48-41e7-a553-2815ebbba6be", "value": "24:uzjzbssHsMwB8Xxtx+Z0LMTLMwCctGuXusSuX47zfFhQsBPOqGxIY7FDbad6F:CDQDidPS7cd6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596350, "uuid": "55c9a90c-e522-4365-b211-f6e399cfbaf4", "value": 1815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596350, "uuid": "e3a1ae1d-826b-4784-8b30-1f6a35cdb497", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596350, "uuid": "00595104-05b4-4d18-9599-91e2824fac34", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2481f483-2978-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774573141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573141, "uuid": "5942a5d4-8481-44ef-a1d7-f91ccaa9f0b2", "comment": "Malware payload (AsyncRAT)", "value": "4a98eeb6de1ff69bae3f12708d0e37b4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573141, "uuid": "27d2b500-dea2-499b-b772-53c35d4e0602", "comment": "Malware payload (AsyncRAT)", "value": "62522a9318a31a63059dedc328ec307f17dbec82069bd0d0d2ed149c6e53b68a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573141, "uuid": "541d9863-d76c-42df-a2b1-ed507d128b5d", "comment": "Malware payload (AsyncRAT)", "value": "2aa7c492e887dce618967b8e74460264176bfc12", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573141, "uuid": "07e4781f-ac7f-4086-aacb-2fa4c7d13dd8", "comment": "Malware payload (AsyncRAT)", "value": "f2391536120b654ddfb5a93c8655f0f618e5b5bca3c2254aebbff0c0cd75ef1262645dc8dd3c68da0ef9fbb4dcba9745", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573141, "uuid": "c980fff0-1096-432b-b66d-8ed610c4c1bc", "value": "T178738D083BF94519E0FF5FB088F121A6CA36FB135903951F74C95E8B3627A85CE416EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573141, "uuid": "3d0bfa96-6eaf-4626-9691-b0e4ae97bc7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573141, "uuid": "6deb3e73-a61c-4a13-9d84-37da26bb2eba", "value": "1536:25wj5PIT8QlIWL+huPtmTb/cvEC6HOw/47yW0hdS1EAd8IIc:CyDjuPt2b/O6Ow/scbgEA6IIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774573141, "uuid": "b2b881e1-f102-4b0b-a3d5-b6014a4a9be8", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774573141, "uuid": "71431af3-112d-4dc5-a1b3-647a9be911fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573141, "uuid": "a8d4efcd-4c85-4dc5-9196-5c02ae88f387", "value": "supercool.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79db5606-29b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774597765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597765, "uuid": "d4638f32-9ca4-4fb3-9336-df4ed71861db", "comment": "Malware payload (Mirai)", "value": "d7336db37d48a50f4c2dd6e272a755f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597765, "uuid": "ee9cb260-3dca-4877-99a4-820dd9e8ac3c", "comment": "Malware payload (Mirai)", "value": "63ca83fdf2cda2de3b68672cf07128a9ad822c6a255342d0cc1ef1767532569e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597765, "uuid": "7411bb28-6f50-459e-bd5b-6889502fd9d4", "comment": "Malware payload (Mirai)", "value": "81528ca5c24982290e5e3afbb7b829b78c06ae2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597765, "uuid": "67cbe6f7-a599-40c0-9e94-015b3d903cd0", "comment": "Malware payload (Mirai)", "value": "fc0041bbd46fe80a5ac8e9254297edd04c7f11ba72c59efb851b1b657d02f2a68e4977bcf10cc3b11f951223f56e341e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597765, "uuid": "aa793748-9c78-42a5-ac21-40de5f4289e9", "value": "T19CE3F706B70D0E43D1633DF02B7B2BE0839FFD5228B5E680652EBEC992719B21545ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597765, "uuid": "bb6304fa-54b3-44cf-a52f-a43ecfff700b", "value": "1536:+Ikkul5/w9iTpxit/0Rghflwv6IiGXT3seWEyvAT1LHVDMSVTinWqOCmazzrC:+IkkKl5TpxS0IM6I7X7WYTRZWzzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774597765, "uuid": "aabf7f27-b7cb-4fc9-8fed-eb9a63d1251f", "value": 147552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774597765, "uuid": "6725d629-6573-40e6-81a8-f978433bee46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597765, "uuid": "cda1683f-14d9-45ab-88e9-f1dcb956e867", "value": "idaho", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8744a6-2977-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1774573043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573043, "uuid": "d0087861-c179-4c68-b988-af10637256fa", "comment": "Malware payload (XWorm)", "value": "d841feb4ef9f30848bee147845c5f6be", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573043, "uuid": "57da9c10-cf0d-4167-8efb-c1f92b3a58be", "comment": "Malware payload (XWorm)", "value": "640f0e4525b611aad00193c420db1dbb81fdba0abf0dca1c94ad7c032e040568", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573043, "uuid": "4432719f-7d49-4776-94b4-8a1f35d8287d", "comment": "Malware payload (XWorm)", "value": "4836c9ff71abc2080fe274f30947dfe44055e762", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573043, "uuid": "f14a2a2b-fcf9-4ec8-9244-afa484108a6c", "comment": "Malware payload (XWorm)", "value": "a443ab8dad3c72657e5cd2f28a130f3b09316bf39a3efe19ef5ea675db1ac9d77a9dfa8a87dad870213a4d91e2656860", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573043, "uuid": "514dc2cb-4692-48cb-9f5f-c9b0a39bfb43", "value": "T117A40FC21480E7D531BD8AC09633B627A1B31752BCF495A40EB5FD6DA9E7A408F2C1ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573043, "uuid": "28490e5e-23c0-4770-a993-e77858700e11", "value": "6144:fVCdBQcuJptYfbYEnth2UN4aEJT7f9yUmm7oD6tx8vilAnFlVR8/0QlWb:IdBcpOztDqH5L9yfuQvilAlsdkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774573043, "uuid": "47710f39-5b9e-4a52-ba46-19ba01ce3b75", "value": 473668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774573043, "uuid": "64f3581f-ea3c-4fbf-8be9-b3134ffe67f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573043, "uuid": "3fd43406-b902-4667-8126-a6fb36c49bdc", "value": "d841feb4ef9f30848bee147845c5f6be.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf9e8ea-2977-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774573074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573074, "uuid": "764cacf8-9996-4d9b-9f8c-acedc5e445b4", "comment": "Malware payload (AsyncRAT)", "value": "bb9c8329d7f5ca5d374cd63adfc221d3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573074, "uuid": "0dee51c7-08c2-49c2-ab62-74569f8745dc", "comment": "Malware payload (AsyncRAT)", "value": "641c690cf6026bf7ad475985c06a1d7d73621ca25332328405a207a342fb61df", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573074, "uuid": "caa4ae29-5e2f-4d99-a7d9-b4366d6a496c", "comment": "Malware payload (AsyncRAT)", "value": "26cb439b80de12938e4756dd2889c130c8330bb0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573074, "uuid": "9d3d12bd-9a9c-48a6-881b-8d87581fff62", "comment": "Malware payload (AsyncRAT)", "value": "cf6f01d77a50550076c6edae35969e3384f480d0abfb64aaf152956f34a44b09b2ac22e880f5d9449446b82601b2d37a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573074, "uuid": "58b27ac5-c922-4780-897a-835f708cd566", "value": "T13614123A0C4D7DC62E9BC5385C5520B30C86651B35F0899A996ACE3B7CF74E2847B35A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573074, "uuid": "fb3cceed-fbc3-4a06-95d4-e088d6ecde8b", "value": "3072:XRfZsk3qaEfQtsyfR2xWfGHMj+vBFi0cYZqaeRr8QqCt7bJ63EaLkFy9VlM:XRfuGHLfBa80csqau35xrFyzlM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774573074, "uuid": "6338d23a-c0e0-469d-a456-9828d9d60326", "value": 201001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774573074, "uuid": "0e0fa5ed-4e63-484d-a36a-51d99d6eba9a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573074, "uuid": "8952865f-8cff-4c4e-b83c-6b16fce16c56", "value": "Estado de cuenta.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b5cde63-2973-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774570978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774570978, "uuid": "a32bb8dd-987d-48c7-bbf1-1febaa118357", "comment": "Malware payload (SalatStealer)", "value": "d2c123c0f34f36b5515f51e77a5a63df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774570978, "uuid": "f3f56161-bcb1-42bb-86ba-7012364e3992", "comment": "Malware payload (SalatStealer)", "value": "643c19575b6dae70de7f1dee35012bdc825c9eec9e0799e96da22a8dd85a40c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774570978, "uuid": "17b8139b-9396-481d-994b-4798a10e08d1", "comment": "Malware payload (SalatStealer)", "value": "a1e3707460c4b724becd491fa543d6041d35b37b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774570978, "uuid": "bb21a793-ed27-45b5-b375-bd7333b3d906", "comment": "Malware payload (SalatStealer)", "value": "fdb72d0d608653f7c0266e67ac7de1ba34a36e498838b44d6ef29469fcf712b3e5c3201f27bf7fb97e75832efd246657", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774570978, "uuid": "ba9fdd0c-6748-475b-a29a-1436ffd05ed1", "value": "T1AED6334562E505F3E9F7D2399B72E091C2623C146F22C99F17E0426A3F172F2AD397A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774570978, "uuid": "1bd4abd6-44a8-4d11-9e94-e60e4cad5056", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774570978, "uuid": "caffc8be-26d1-4ab3-a585-b2ff35ede37c", "value": "196608:M1rDVm0SwaRR3o8VkNTs81tbW897G6x7eovq5XMP6PzFchBHsHsoq1bRjMFn:aU0UP3oFs+1bdq1B7IHsHsoq1bpin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774570978, "uuid": "fe95bf74-db82-46b7-a448-133f2ec82a01", "value": 12933632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774570978, "uuid": "2d12cf62-96e2-439a-bf20-fc17f977d3f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774570978, "uuid": "0e0b2539-faff-4783-ba27-98dbb2185995", "value": "x643c19575b6dae70de7f1dee35012bdc825c9eec9e0799e96da22a8dd85a40c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8155e885-29b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774599066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774599066, "uuid": "59acf6a9-4fd9-4068-b4c7-8deefc658dc6", "comment": "Malware payload", "value": "b0bc60957a3314a3875f63a4e03c56f8", "object_relation": "md5", "Tag": [ { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false }, { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774599066, "uuid": "0f43190e-ce7a-4ee2-b62e-ee47cbc452b2", "comment": "Malware payload", "value": "646656858a13660bc3f20914b97f1d107d749678c74869a83e2bae16cc19fbb2", "object_relation": "sha256", "Tag": [ { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false }, { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774599066, "uuid": "a0d209eb-f4dc-4bb7-9b06-39adb2a74e0c", "comment": "Malware payload", "value": "49592f63f0cc9d62528587f9caff481b4df51abd", "object_relation": "sha1", "Tag": [ { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false }, { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774599066, "uuid": "d202dd51-3a48-4643-a170-23fe5d71258d", "comment": "Malware payload", "value": "e9ebacc3b2e032f76afd2f83c183ee6b2fe0a76c60a907711b3f915f48a90beb75103d2a51e9d8faa7162641ef88030c", "object_relation": "sha3-384", "Tag": [ { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false }, { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774599066, "uuid": "edeb2c51-ad81-463c-8db2-6abeff7a7578", "value": "T15B95F0523651FD7D029693B16E1646F0A46ACA40CFDF8597F24DCE88A14EC863AF93C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774599066, "uuid": "07971c8b-95cc-4e5f-8f3a-cbf2ec56feef", "value": "12288:+4Sv4rgt1HUu51WXLL8ijQ+p9etP47nK0cmudDUhnI5A8QfM4B/JvXlLLQZAYCJ8:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774599066, "uuid": "ad10fd98-e85d-4520-9461-15fb7135c817", "value": 1928186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774599066, "uuid": "ffedcca5-b848-4c66-ac01-d8b25b8c9a1b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774599066, "uuid": "c212306f-ff1c-4662-a636-1b1d913ea691", "value": "sitecustomize.pl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ccb39a8-29df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774617393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774617393, "uuid": "badb7d1b-8ce2-4dff-8ef3-32be8a4ee6fe", "comment": "Malware payload", "value": "55cb46398290e9854e3a8685b3d4e985", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774617393, "uuid": "96e11347-6628-472d-99e0-2bed842182cf", "comment": "Malware payload", "value": "6533f1457eedc39476100bdbb90be854461560b22e6ea99317e053eed9dd326b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774617393, "uuid": "92b7d225-9724-4340-a7c3-8028fa31b056", "comment": "Malware payload", "value": "458a04160b785201898d36ceb817398ae7990067", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774617393, "uuid": "9937e098-1fff-48be-8e2b-d9e4b021da1f", "comment": "Malware payload", "value": "d7c5d673f3ba2692f801ff272678962c86ae0ec9507d40c80f8e3e32777d28249934d4fb37f8a59b48c461db28fabab2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774617393, "uuid": "f5dcc1ac-b7e3-404a-bec7-991740c5bc64", "value": "T17373018337D6A042C6FF48B216DBD50314B29E4285724F6E4D12FC3A1F965E482AF51F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774617393, "uuid": "c25dd9a9-7cff-4d6c-93d1-a19b4d268f64", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774617393, "uuid": "c9aae1a6-7d2b-4729-b2c5-1436a44efd9a", "value": "1536:RjogIvPTr3t3wYujhlht9gOmUrabXYNBalr0y2uC7v46R4UM9tPtVY:RNeN3w/jhlhE1Z8Nig9Jv46Rh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774617393, "uuid": "55135952-be29-491a-8343-df2bb409f15b", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774617393, "uuid": "03cbd19a-76e6-4302-b65b-510b9da209ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774617393, "uuid": "d44298d2-626f-4b05-9017-50bc783f1397", "value": "i.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7f8a61-298f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774583011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774583011, "uuid": "053225fa-03ab-467f-86f7-c0fe4cd61f85", "comment": "Malware payload (Mirai)", "value": "3b547a0c4804cd5ac55a347c1dd136c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774583011, "uuid": "14efe69f-41f9-4fde-a76c-eebbdaf8e500", "comment": "Malware payload (Mirai)", "value": "6878d3afd51fd10ce8e541ceb46ac826b748ee26bcc061f611b5808a7bcf9074", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774583011, "uuid": "270528ed-b239-4348-9873-5f0581165972", "comment": "Malware payload (Mirai)", "value": "b61937843ceda7941fc01e2b469395ec1d56a226", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774583011, "uuid": "c623fe01-b7d2-491b-af00-6b4ac316fed7", "comment": "Malware payload (Mirai)", "value": "a14bbf04d3e4dd41534c5d5956a6bed77db590f25fc1f16f3c9825771363694447dd8fbba89689f11f4f82951324284c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774583011, "uuid": "0087f99c-3c82-42e9-96a2-b62587262831", "value": "T180464845BB2C0923D6530DF0993E83D5F3263B4381B1A22B6B0F67473179936A6DB789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774583011, "uuid": "2b6b6774-311c-473f-a5d9-4dc0db82b547", "value": "98304:W9Jpkd2EgO0/liVvcNeAkqzjvNgjkixzaOx/cgGe2ag9TgYaEj2xi9CwO9vAXPgC:x0/5tR24CXVbh7H83L6jrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774583011, "uuid": "05df8438-f2e8-4064-a40c-36eeab3b8f39", "value": 5530764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774583011, "uuid": "ac04378f-e32e-4147-8961-aa2add9c2a76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774583011, "uuid": "536cf49b-b520-4a65-8857-840c5609f23e", "value": "wlan.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b49116a-2978-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1774573179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573179, "uuid": "709f0160-aec8-4c96-8ad7-3ea32b817708", "comment": "Malware payload (XWorm)", "value": "9a29e5693057d5d3c3f2b5faa51e267f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573179, "uuid": "932648b1-c0df-486e-887e-497a978f0816", "comment": "Malware payload (XWorm)", "value": "695eea1a3959c54d262414bf1133593d076634137ae3a1a7109c013f40430d9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573179, "uuid": "3ddb743f-d5f4-4d85-9f6a-30b3f15ecac6", "comment": "Malware payload (XWorm)", "value": "69b1c48ccdfb326d8bde9a7c0b05b3a57b75aa45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573179, "uuid": "a1fc2718-20e7-42e7-8774-3bb728e39bf7", "comment": "Malware payload (XWorm)", "value": "c4470500f43ecce9f5f0ac3c907bf849dd77c1d9a94803bd796cc96f462ed7d3db2d17adc83fe3263927f7fd550dcc99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573179, "uuid": "da1b0e65-d5e6-4639-9115-2867832799b7", "value": "T16C942352C274A666F1464AB017E3F1E4033FAE86BAD35FB7D05D72B3C47006245B1AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573179, "uuid": "13c4353f-a7cd-4aec-ae6c-2ecbf75a6c72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573179, "uuid": "10db6991-5416-462d-8526-2d25a4ac11b6", "value": "6144:yQCZ2RQQ4pdbtFK+w6sX6y9koDXyujWlyk0GRTwjwCf6j679R60J2t7Fd2HlLjgk:iNnC+wbFDC8WlykdwjwBjPrhwLdyXzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774573179, "uuid": "68cc8821-e542-4434-8825-b2990076be8e", "value": 433152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774573179, "uuid": "b2835743-ea24-4736-898d-5a631826bcc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573179, "uuid": "86afdb59-40f4-4430-94f5-607086a16800", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e154dc-29b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774597760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597760, "uuid": "ea7f4bdd-43a3-4f93-b541-ffcaf1837598", "comment": "Malware payload (Mirai)", "value": "f819ec0f76eb3c781149f52ce105f962", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597760, "uuid": "15103a09-ea00-4aa6-bb77-25dedfc37a69", "comment": "Malware payload (Mirai)", "value": "6ab1f75873cc848ba44f0280545bc605dad3631deacac546f8f67da0870b296e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597760, "uuid": "2478ca95-7d00-443e-8eb1-bf6f016e7f54", "comment": "Malware payload (Mirai)", "value": "1d371f2d9a0126d7dc9b668a44aa161d42e77550", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597760, "uuid": "1af05c37-1409-4a00-af76-642f919cd805", "comment": "Malware payload (Mirai)", "value": "267d9384aacc92a5a916042708360c95d122ce919fb018d2b721260dea12bdd8871a1acd53fbd1a8236c0b749d08658a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597760, "uuid": "f7b5bf52-732a-47a2-af13-ced7d6015706", "value": "T100C30806B9429F11D49735FAFB8F425433536FA8D3FA71019A249F6123CAADB0FB6112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597760, "uuid": "4a25487b-3345-468f-af91-5b15874c3092", "value": "3072:D1o6ox966jEY9ax8fpZAvcWrXanMXgMcEzYW:W6C96c79ax8fpZAvvPXrcgYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774597760, "uuid": "f77050d0-f9d0-4b54-96c9-665979e0af50", "value": 118380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774597760, "uuid": "067c80f5-99cc-4cfd-bcc1-272e6ba942cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597760, "uuid": "25cc5fff-bdd9-452f-bd7b-63b81cdc1d6c", "value": "arkansas", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70383c29-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774596460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596460, "uuid": "2b1f959f-31e8-4089-8c8f-af7eb7a56c3f", "comment": "Malware payload", "value": "5ae4a8d3fc8dccbd9c2624b53a8b767b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596460, "uuid": "165e8cab-1e3b-4391-99b9-a9101ac26c8b", "comment": "Malware payload", "value": "6abf3015d8956e5a575c3693469d67060ecd854c6e88ef46f82f57567e3fdc0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596460, "uuid": "2e3822c2-70f7-4fbb-bff2-6fc469752a39", "comment": "Malware payload", "value": "28521abc001af8f565d8eea895899518b8599f51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596460, "uuid": "aa338916-2f4c-441e-afdf-e1236ec3c46f", "comment": "Malware payload", "value": "cabe6afcd08070de0ce02ada6b2040e671871c4811773e0655b0adcd3c521db4eb1bcaa2b18ab2fd4d3bc72a1c47cb20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596460, "uuid": "eb3efa0b-55df-4c80-ba4d-5560e1455a50", "value": "T1B0164A17FCA545A9C0AED2348A369253BA717C891B3123D32FA0F7782F76BD06979704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596460, "uuid": "5345b646-3c80-4408-aaae-19098bf4dc25", "value": "49152:MdHfBmvblyq0RA6sq45EgTr0qmRKV11wJq:EHCLG2EgcJKFwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596460, "uuid": "2fb0a551-7413-45be-8069-d8cdf6fd31bd", "value": 4186264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596460, "uuid": "59d6760d-9507-43a5-bec6-d6fece6bf025", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596460, "uuid": "0bc559f0-344b-41ba-a285-8cfaa30413fc", "value": "agent_linux64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd42723c-29fc-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1774630144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774630144, "uuid": "569cdcc2-cb0d-4241-bd60-597274e673a4", "comment": "Malware payload (SheetRAT)", "value": "aa0ac865600b4de79ec929d32818091b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774630144, "uuid": "a03fb536-fe30-4d68-a139-61caca9a5700", "comment": "Malware payload (SheetRAT)", "value": "6deb819e86135c8972df618b29c34b5c304468ce25bcec8371d982964ffe41f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774630144, "uuid": "f49cfde6-04d2-4141-9f5c-9d5f16e64699", "comment": "Malware payload (SheetRAT)", "value": "1b96ed850c4205d31e30abdb249d2f3eb635d390", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774630144, "uuid": "d5b3e121-1bfd-42cc-b972-cb71c78d8926", "comment": "Malware payload (SheetRAT)", "value": "f28f84e51542eab426ae44bf0a42f3d842dfcdda5eb697826d1a3ad8f551351d5f6dd43e25087b7c16ad4e7e24bc6db8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774630144, "uuid": "bb6339e2-d38d-4855-844d-5a45bada2d4e", "value": "T126B418253FE48E00D495257ECABE3A09CB16E4F125026347370AF6A14D459EEDE2D3EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774630144, "uuid": "c5a16e5b-e42b-4c2b-82ac-749c079275fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774630144, "uuid": "4815526f-bcbd-4842-a6dd-f367ee207c47", "value": "12288:CQpRZM0CcrcRVP6powXqjZLqTlb0x0ZKTfPdUro:9xcRVPmowXDWxrnur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774630144, "uuid": "dae740ad-498a-408b-8e65-01da6d014595", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774630144, "uuid": "5be90cd7-08f1-4fd1-b0da-debeed152eb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774630144, "uuid": "62af0a30-c0b0-4b3d-ab9d-b747d0c88815", "value": "RuntimeBroker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf7b557-2977-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774572697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774572697, "uuid": "ebdc6c98-ab8c-4371-be46-cabf24039194", "comment": "Malware payload (Vidar)", "value": "19df18b072b29d78eeb29b07f194f15a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774572697, "uuid": "429869b0-107b-435a-a758-b6ccfe021a6f", "comment": "Malware payload (Vidar)", "value": "6eafbc6ececd35c9ab305453fe7175e8eafe6f4d08004b5d88227e00845c6c16", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774572697, "uuid": "e40481b1-aecf-419a-8b13-a217ccd3dc37", "comment": "Malware payload (Vidar)", "value": "25910d4a3a44e9acf8a7d86556f25cf034517336", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774572697, "uuid": "d05283d7-3019-44cc-ad53-47a2045ad19e", "comment": "Malware payload (Vidar)", "value": "cf5cf39250ae319c425487a2c55c286a14f8b5d9e361095edd3dc6330972516ac633346e68cd090ad21bcf3a059584a3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774572697, "uuid": "7e112c27-e141-43d1-b405-f69052477124", "value": "T1042423D65486902DEBFC50715B0387D8A988182D7E77593F248C39937B27A3B3E8683D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774572697, "uuid": "c76f78f1-c7ff-4366-b252-e2e32aed4256", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774572697, "uuid": "8ac76be4-4417-46fd-9eec-7d1626bacd8b", "value": "3072:rZnF2X9jXd8X0TF/P5MaQRIHTPKL+lcKfUmb/8RrzHlapVVH20e/QinBi0ME15xy:rOt0gFn5nr8lK8QSnkVVHW5MiaPIeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774572697, "uuid": "cd33ea2e-fcf6-4e15-bbcd-c420e37f5a8a", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774572697, "uuid": "c386123f-7d97-4cec-82c2-a1dd385c0e7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774572697, "uuid": "590d3f11-243d-4254-b914-717d1414e9de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a76f260-2977-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774572909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774572909, "uuid": "f94501ea-ad3b-4082-92b1-bc894553749c", "comment": "Malware payload (njrat)", "value": "c01747a2974d0bcacea3da8f9b2a468d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774572909, "uuid": "e6bbfaca-9a23-4569-b1e0-d911fe570a1c", "comment": "Malware payload (njrat)", "value": "6eed49672111dadf1a7b5e507aaced87ecc59e41536b0d6e9ed88153dadbf0b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774572909, "uuid": "bb80b4e9-9c1c-42ef-be7b-5a2bdad51e75", "comment": "Malware payload (njrat)", "value": "19a87cbecaf717c44529e1588b6d4d09ef260017", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774572909, "uuid": "6603ebe3-35f9-41ae-a0a4-dc56c8224c20", "comment": "Malware payload (njrat)", "value": "f37b2e95d5e3caa82e3d24bc7c999a9a947f1bfd6a15685daeb9e22bec3a54b062b8334e8bcf7604985efaf7cae71683", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774572909, "uuid": "384b8a5d-811e-4095-8d03-2fb78eec6141", "value": "T14EB2194E3FB98856C5BC17748AA5965003B491870423EE2FCCC564CBAFB3BD91D48AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774572909, "uuid": "f8b483a5-e45c-4758-9c26-c5018b66ba48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774572909, "uuid": "41f67759-0e4f-4c62-b800-dfa2a2057429", "value": "384:ic6ze6e1PAhJVzC3tC1im/BsTx46PgZ0rap9HBmRvR6JZlbw8hqIusZzZFQ5:Ce9EJLN/yRpcnuGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774572909, "uuid": "23d7bcbf-51ff-419a-8cb4-cb91364c8da5", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774572909, "uuid": "23341152-68f8-45c1-9443-911c6f7f426d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774572909, "uuid": "11ab594a-e8b0-47b2-9576-06c9e2e6cb60", "value": "C01747A2974D0BCACEA3DA8F9B2A468D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b016d9-29fc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774629974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629974, "uuid": "a310cf76-74a0-4270-88cc-c2b26554bdc4", "comment": "Malware payload", "value": "e2b107ee56e9b0cfe5f707a184137498", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629974, "uuid": "349d3c1a-2a6d-4ad4-a93a-922d97f09402", "comment": "Malware payload", "value": "6f56b45241303d3b0ba0d9fb6732f76bf14ce83a467b3947aa6669d623de3d88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629974, "uuid": "b2ad9935-bc0c-4482-9dbc-d1a45c5f60b1", "comment": "Malware payload", "value": "90ac911c5998d3c721a5267d4e2c26ed8213ef50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629974, "uuid": "8b28c259-e79c-44ec-8e39-93934c5be955", "comment": "Malware payload", "value": "cf48c2141e15bee654e2646ae50ca781bd4b010f2bd9a2ee6fe87826331d575c0a8e6bbdc5e92bde681b8b2df48d3431", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629974, "uuid": "f5637755-cd51-4250-b68d-db502c9f9bf1", "value": "T188E60115F7D58132C1A15C3391BBAA27637DD98B23A12ACBC741B9B96F733D072312A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629974, "uuid": "35a937b4-2e5d-4a3e-9ced-f1b7ff93fc7d", "value": "cdf2338385bbf26ec9ce2289fc7f2d64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629974, "uuid": "c620ae56-4269-4e9e-ad8c-aa3c9cf65e78", "value": "196608:RGvN3eETMNoio+YINbJGY036tgRpjsYqFr6WBF4cjrIQ/p+llv0sNWC0E2:yN3eETMN9DxPJtAps6W344kQwlM5E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774629974, "uuid": "670eea45-b478-44ed-87f1-8958150709eb", "value": 14994831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774629974, "uuid": "bff17ad9-a6e5-4b83-8b7d-236350820ed0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629974, "uuid": "5c26b966-3258-4e50-b7b5-f13e60b83027", "value": "WIN11HORROREDITON.PEACFUL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17ddbcb-29f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774626715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626715, "uuid": "f7460c87-7f41-4983-a034-450138f8ee38", "comment": "Malware payload (Mirai)", "value": "3f2d73f62a41f1aa09d49857ed198435", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626715, "uuid": "fd345a5a-dbe2-47e8-a680-249ec806f2c8", "comment": "Malware payload (Mirai)", "value": "6fc756dbe94fc900d6331d8c28a2539952443d6223af0c5b734f04651515b42d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626715, "uuid": "f13aef04-e7f9-4d90-ad8b-39ba6efcd6f9", "comment": "Malware payload (Mirai)", "value": "b9f76a37335ca0d30f37da8a97b6489402f51058", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626715, "uuid": "1833e071-a3ea-4d50-a6ce-cb04c029d880", "comment": "Malware payload (Mirai)", "value": "0a6a1911afa8b93c61abe61f583a27729379711ae3e7ecdc629b4b874cfca3bef50d806f35944bf26fe44baf7ba1006a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626715, "uuid": "0b25a2ae-9e01-497f-badc-0b5ebd753de0", "value": "T1F5E30846F8819F12D5C111BAFE0D524E37231BB8E2DE72029D246B717B8B9BB0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626715, "uuid": "b28ddbe1-f277-4bc1-a6d3-66d9bd33a79d", "value": "3072:inIdkhnQA+oIXSr2jaWFyuzvgIobR//Cp/DHiu:in+aD0XSrgaklEIobZCp/7iu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774626715, "uuid": "92a2cc2c-b0c4-48e9-9313-b1f68f4d3163", "value": 148112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774626715, "uuid": "6bca09f0-09b5-4dd3-b7a2-00ef1421f846", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626715, "uuid": "74e74566-1a23-40c8-b562-12b44ccacbf5", "value": "systmed-login", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca2b9b7-2a26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774647887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647887, "uuid": "7ac69c63-cbf2-42b2-9a36-f36483013bc6", "comment": "Malware payload", "value": "9c608a0ca3194b120ab8f9b315bae44c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647887, "uuid": "a97c2f23-b5c7-41a3-8529-9cce6f037b16", "comment": "Malware payload", "value": "704e3edf8c6fddd58319de4378dad7502fff9ed71a0c41abcb69ec328b9a31ac", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647887, "uuid": "da75dbd8-ba64-45eb-99fa-b94822aa4693", "comment": "Malware payload", "value": "77e221481a197197ad2adc99766295f24812b85a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647887, "uuid": "03d52237-6cee-4ca1-896d-dfdbea819ce7", "comment": "Malware payload", "value": "91aab411c36624306a941d3249cc3f0b4db5cf08997ea47f6fc9e532d5bd25fce82d55f82b97fb68c89e43067dcebc1d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647887, "uuid": "7d3f294d-b6f5-4973-aefe-c515f5dbd0fb", "value": "T128B5D4E3179C07EEAB9459D6850D361794FBC27B2C5E1288F4E21943F13EE21B626B70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647887, "uuid": "04ad9e01-1c04-4836-a969-3712b773692c", "value": "1536:upAZ1OUf7wZkL976N8odeOMATYJMkBFHntcZNE84rvR/3JD4K7JOKzZkQAi5iOH+:eGRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774647887, "uuid": "99f8d35e-049b-439f-92fd-6f30a0755d80", "value": 2367791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774647887, "uuid": "cd7fb65c-83d7-46f4-a415-9e4b3ff126e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647887, "uuid": "6665e86a-11e0-4588-b4ee-012e0a345ea1", "value": "task.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1025730c-2978-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1774573106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573106, "uuid": "ffaed604-5ed6-4ef7-9504-970ffef1edd5", "comment": "Malware payload (SheetRAT)", "value": "dabd8879cb0e1b5435f3d65940d37555", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573106, "uuid": "ebaf224d-19a0-4414-bb0e-91c5b73ed931", "comment": "Malware payload (SheetRAT)", "value": "70aa778db224213e090444998594b4d79da716191521c5354d9513db2b87601f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573106, "uuid": "2f39cfde-6ea4-4236-8ee5-286b9b6c3ce0", "comment": "Malware payload (SheetRAT)", "value": "8d181aeeaa778a6da5f2bbda6c9582de9b1a6711", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573106, "uuid": "e8310b0f-05ec-4e1a-ae0a-d46fbb9e652f", "comment": "Malware payload (SheetRAT)", "value": "49f9d403f8ff159d1823af7668a0f463f54a9293774e6ecab2c40fe1e06c8d2c5d68e26c1f88dfc6389555e9176f82cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573106, "uuid": "2dd1c0b0-48ee-4d63-a7a7-63dba872a89d", "value": "T12C74E41CFE95F805CD1A3E73CBE610006B7121C22F219656324AAFFD87653B658A76BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573106, "uuid": "ff2e49fd-5a9b-4b93-ba61-f89d119aa931", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573106, "uuid": "cc41cdac-7886-4473-aded-9077d730989b", "value": "6144:RdE3WqzwLNIGYP9xT1U0e6VlWT8b9h8gq4wXbQ7Y:Rdx/YP9J1PVle8P8P45Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774573106, "uuid": "913e161b-999f-4937-b4ac-4c5b0e4bb691", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774573106, "uuid": "ab19be4b-817e-4723-9f46-43f0317e30e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573106, "uuid": "33848cca-2fe9-47cf-bf34-71b74cb5d863", "value": "iiii.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a83e4da-29ee-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774624019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624019, "uuid": "153190b5-d946-4d5a-94cc-240c3c9abe21", "comment": "Malware payload (ValleyRAT)", "value": "6eee866898781b1491b1a2e8d857fedc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624019, "uuid": "38cd6645-3bcc-45f0-af6f-41744640a05a", "comment": "Malware payload (ValleyRAT)", "value": "71a0e232b4d8734e8c201e8b84e153c37e2d6444720d12b945db5b128690bab2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624019, "uuid": "744cdc52-3f0a-4e8a-af9d-5e33faa0b23c", "comment": "Malware payload (ValleyRAT)", "value": "9ed3d960283d93020bb3584926ccf82db22c8f69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624019, "uuid": "bb1b0998-5348-41b9-86a2-d82f3e0394c3", "comment": "Malware payload (ValleyRAT)", "value": "7b2f280931c0930a6dc37b14f4bd06b66c2f4b26813b47bd30970313c2225ae53559ca01a6dd912cffe14e9decc8d556", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624019, "uuid": "1a334146-2993-475e-8c6d-3e2c5fa61a5b", "value": "T1BBE67D47B2A541D4C577C039CBA78127E7B1744A4770A6DF22A897A92F33AF02E3B315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624019, "uuid": "b2b234a4-73b8-4301-8020-dadc991f22d4", "value": "9e80847f6524df0aef136b620674a9e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624019, "uuid": "2305360e-a64b-48ca-aae1-05f198ba97b7", "value": "196608:3X170/cF91JAOgMMGYDNf4AJJNgQ+0m+KJsv6tWKFdu9Cy2:3XNRv1JAOgMMvZXgMKJsv6tWKFdu9Cl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774624019, "uuid": "ee97b115-871c-4362-81dc-63646ac8ea3f", "value": 15227904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774624019, "uuid": "19693e18-c096-452a-a79a-0389d1c30b99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624019, "uuid": "4bc8be34-82a5-498b-83aa-0b87d5996026", "value": "2026\u5e74\u7b2c\u4e00\u5b63\u5ea6\u8fdd\u89c4\u4e71\u7eaa\u4eba\u5458\u4fe1\u606f\u540d\u5355PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e12e37-2a08-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774635123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774635123, "uuid": "fa4ab1a7-ee55-4675-8cf5-5ed3d7eeeea5", "comment": "Malware payload", "value": "dbc8e75e90393dd9b1aff6ebe5c302c6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774635123, "uuid": "7dc122e1-bb52-4ec8-8520-4b2fde1562f8", "comment": "Malware payload", "value": "727a5adad5f1e298c5aaff0503cd445b93f20d09de08313dd51c072a58ccccc9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774635123, "uuid": "82a94409-86dc-49cd-8de5-ef685fba372b", "comment": "Malware payload", "value": "08824c055d2dd05fdda06e59330a0c3c57675b45", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774635123, "uuid": "eb608ad9-dc44-48d0-b03a-b90a7d35d504", "comment": "Malware payload", "value": "588089c21f8735ef942febabb7066e70cf29217b02ed60b5306100da5778d93c8081f161ceb531129e5d63fdc1c9d18a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774635123, "uuid": "dcac9817-8517-4fa0-bf8b-0529697a2220", "value": "T18DB57A0ABCA408EAC46E937689B265927B71FC090F3223D71E41B6783FB2BD05D75758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774635123, "uuid": "9c39739f-54d9-4b7a-ab2d-e8066b4a22cb", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774635123, "uuid": "80560e3e-cfff-4e27-a8f3-36954f3b875d", "value": "24576:eJVBnm8NsRG2AE7JZpHCPcqHBmbVexm02Dovfc6rtPkbaIR3:eJPm8mRG2AEt2PcFbVjDovfc6SbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774635123, "uuid": "44d099fa-94f0-4c27-9d19-1dd26b08114c", "value": 2381528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774635123, "uuid": "351ed988-b153-40ec-bb45-da0a6a4aed5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774635123, "uuid": "9081ecd3-f45a-432c-aefa-f7d72798fd00", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20bdb69f-299c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774588596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774588596, "uuid": "7427d5f9-1697-4113-815e-e02e651b694b", "comment": "Malware payload (Mirai)", "value": "fddc192e3bb42b8094eb1640cb3f2680", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774588596, "uuid": "e5c08326-4118-4608-8459-86df3ddcb6df", "comment": "Malware payload (Mirai)", "value": "72b9c3c1300ab070b6346c94859838df7fe970de90f54c7758136f75a655b840", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774588596, "uuid": "fed5a2fb-b2a1-462f-a0ce-9550a86a023a", "comment": "Malware payload (Mirai)", "value": "5586f8264dbd48a4c6a3919b015715b61637a86b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774588596, "uuid": "ed1265b5-02bb-4c11-b3e0-ec45918ca410", "comment": "Malware payload (Mirai)", "value": "ca703fa5ced702f72d691e4d9ee1e056243defbe1d410b9119441fa4a3d2e18b61420d68a2c6249edb3f1a364e397036", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774588596, "uuid": "27b2b995-3335-446f-ae15-439285fd09d2", "value": "T1C4A533F01D078163B54E78F49D5E808F3EB8E59B899F25381803AEAF8939750C17E399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774588596, "uuid": "47623842-0079-4a9b-8808-2820b698477b", "value": "49152:hKUg/Im7PIQRKH+3WDReLWAP98fsddNyz:kJIGAH+3WDsSfyyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774588596, "uuid": "62aa26a3-2ebc-47a4-a275-1c56ac132064", "value": 2134676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774588596, "uuid": "dcf1caea-edf9-4ca0-94d5-43a64e4dc1e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774588596, "uuid": "6d85a484-3265-4ce8-bc04-7d2a807b2004", "value": "wlan.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076a3992-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774625061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625061, "uuid": "467b3ed3-3e46-490a-95ac-abf704d6b1d0", "comment": "Malware payload", "value": "a8e3c078998de03a166bc37ec27d3a2f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625061, "uuid": "2badb40c-01ca-44fb-b3a3-1ad57b36b92c", "comment": "Malware payload", "value": "752157a579bd6582f74d891182c332af8796a8fc3dc55ddd7a6bcf8cf0c04f31", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625061, "uuid": "4947b2c9-15b8-4fcc-98fc-aaa2b3e4f68a", "comment": "Malware payload", "value": "516ee19adcf67aab37e5768a763f7afb76683c5e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625061, "uuid": "ffea539c-aab6-4533-85c4-39267b0b07bd", "comment": "Malware payload", "value": "d7810061a04fe21db97a2940127885eda811ef94fc1aaac62bf155ec948cfdb98c90c7861be773f9a6b884689584e890", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625061, "uuid": "888d9592-8115-4072-9dc1-eead9abc5a4d", "value": "T19102337CCAE1BCE0875B71D179A5FAC2228B9723AE6A2F9CF5C804511B50134DFB958C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625061, "uuid": "4eb749c2-8479-4149-9ff9-3188a02e3f30", "value": "192:ItMXSKSbuIo8xlDwxCklQyI0ZYtUhz/Da+rGMkwPshSc9oeqUCUHw5:IaiKSbuIhlcxCklnI0ZYtUtPfk4shSIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625061, "uuid": "2d0a28c3-b979-41f0-96b5-fd886ac1017c", "value": 8670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625061, "uuid": "4086897a-74ed-4a86-a25f-7728db4c9e6d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625061, "uuid": "140d3c88-52d8-48ac-9e65-4660b1b9c8ca", "value": "SOSTENER.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e860877d-29ed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774623720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623720, "uuid": "82dc0b1a-fb45-4f5e-b5fe-9eeeeafa150b", "comment": "Malware payload (Mirai)", "value": "ad73b61066f2d33b52ff5e83adccd214", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623720, "uuid": "6600a636-f8ed-43ba-ac4e-20ae0f658d44", "comment": "Malware payload (Mirai)", "value": "7562a7cbfc436a63a3bf6cad96fb59673e37b5f93baac526dc90d856f80c3215", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623720, "uuid": "319b8961-aeb9-4148-b353-b2386fa638f6", "comment": "Malware payload (Mirai)", "value": "89ad928b5f4816167150ac33ff413224092609f2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623720, "uuid": "d0ccc28f-a4f8-4de6-915f-83aab4275dbf", "comment": "Malware payload (Mirai)", "value": "6696f9212dd2a824c17c1a1149b938498ec3a771c42bdfc5d8dab6a2d12575122e93878d6346ad08e4691b3131066cc8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623720, "uuid": "75f8a922-5f80-4c52-9535-6ef446a6a0c7", "value": "T1214114CB22630B762DA2E963F2F905847180F19574D8EE5CEEEC7EF8628CD047194A47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623720, "uuid": "02566c99-89a1-4a70-9b33-5d5f56df2f9b", "value": "24:ItDyd/sN/sk/s3Wold/sMYM/srG/s//sSfHZ/s1/sFh/sKT/sg/scReH:ieG2z3WeGMyrRMcHKe8HnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774623720, "uuid": "cafb1b0a-1edd-48dc-8ff7-deaf7da5e568", "value": 2039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774623720, "uuid": "1ed8f2a6-50b6-4d44-8300-9c697dc64144", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623720, "uuid": "facd6019-7efa-41a0-9b10-651facad1838", "value": "jack5tr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4285a489-29cb-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1774608839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774608839, "uuid": "7065bbec-007e-40ac-ba56-014e20b384e6", "comment": "Malware payload (OffLoader)", "value": "74c0883347e7017e4f3b9d521f5a7477", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774608839, "uuid": "31e85e8d-1f84-4298-97f6-36f1c40f66ab", "comment": "Malware payload (OffLoader)", "value": "757610695ae4698aa6dabc40f2b368720cbce746d2fa603082bda8ca6d0baec3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774608839, "uuid": "78699eac-e552-42d2-9e67-a206abee857c", "comment": "Malware payload (OffLoader)", "value": "b47ada22efd7c9455cce8081daa2d2de1b460cd7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774608839, "uuid": "fe06e3ae-e748-4f79-8478-2d2c461b3710", "comment": "Malware payload (OffLoader)", "value": "6f8a8aca4826d9245d167fb296fbf6278466bc5628ed57100c285c7285cb990ae33bbf142cebc37b3976d4fea9e4ddd3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774608839, "uuid": "04e88475-094c-442f-a622-df528e7e9f82", "value": "T19956F127A748A32EE4284977F971E5BC583F666F721E8C05B0E55D4CCB2F4A21D2E243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774608839, "uuid": "84338723-8d45-47d0-a3fa-16267639bf00", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774608839, "uuid": "4220fed9-4643-40bc-a0bd-e2eb9df179f1", "value": "98304:ZN66naKaZqA8Mom9dwsKEjQTUfwZ5hDi:dnWENrBUYZ5hi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774608839, "uuid": "2b8052fe-1a3e-4ce8-98ec-fed4396b3081", "value": 6384572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774608839, "uuid": "601128fd-9cb3-4113-b380-5694215602ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774608839, "uuid": "d4292dd0-3af5-4388-8dfd-c8598a10250e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b20cb6b-29c6-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774606813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774606813, "uuid": "d82bcf69-da7b-4b6a-bb46-952894215d11", "comment": "Malware payload (Vidar)", "value": "fdda44b1b8288c5b2fd234b35935020a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774606813, "uuid": "bb49c0fc-6b11-4dfa-aa84-193eab4aa0d8", "comment": "Malware payload (Vidar)", "value": "75ca40a87dd423bd537641321a2c3c65180070d62c070e5b50db076ac408ff3a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774606813, "uuid": "cd330652-685c-4ff5-bf09-dda181028bd6", "comment": "Malware payload (Vidar)", "value": "5063ffad1ccd06d426a42fa605a314126c39b397", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774606813, "uuid": "9d6f561a-53c0-437c-84ac-55bdd1e77610", "comment": "Malware payload (Vidar)", "value": "8274b876d2de453416280aa4a74d33062bbe1e7b88725d9c5d1aea02bb103c7257f5ae6d8aac30129e0d350270212413", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774606813, "uuid": "bd0c6976-b98e-4e71-97a2-78f330aa2a97", "value": "T118B58C0BBC9858E6C46953B289B652967B34FC080F32A3D71E91BA783FB6BD15C74704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774606813, "uuid": "9dacf72e-ee14-4cb1-958e-1da9f870c31d", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774606813, "uuid": "89564313-ad30-4598-9848-b21074bfcbfc", "value": "49152:OKtVBQYTm7eSmOZubVSACYG2e4HdU8PNPbFRpG:OKf6l5ubV4YG2ldU8PW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774606813, "uuid": "e585b48f-8c41-43a4-aa50-5d03016d03b5", "value": 2386056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774606813, "uuid": "a3cbd2bc-5a0f-4409-a7ed-c21e2f48f7ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774606813, "uuid": "656b802a-0a81-47d1-a69a-bebea3385f5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951c338f-29d0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774611125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774611125, "uuid": "88be6931-a325-4711-9408-411ec7205d8c", "comment": "Malware payload", "value": "20da2fbc1837afea3ba1b2eae3e818fd", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774611125, "uuid": "f0286eb7-f1de-4da0-8afd-c948922c0be5", "comment": "Malware payload", "value": "7689fe3be975ad8d33e0b81b540990d858209e215cd0faccd8ffa82102dd5bd0", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774611125, "uuid": "716cebf8-2209-46b5-baef-21d2f8d9a660", "comment": "Malware payload", "value": "aae7439b129cf8c7dea15c2f04cb75a0165fbebb", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774611125, "uuid": "8564d70c-6e92-4a9e-9632-fe6cda81f7fa", "comment": "Malware payload", "value": "a61add8ea3770729a266e6dd614196b53d111c1945160d194596c3c2b4791cb64dbf72655bca7d7b319d476d1d738596", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774611125, "uuid": "5fbd2cff-b228-4d49-83ff-2c24de850f51", "value": "T142839852BBFC2604F0F6EF399AB49356453AFF25AA72E26C05A0F05C2C79641D424B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774611125, "uuid": "b93e7df6-38bd-4ecd-b503-3572438a3504", "value": "48:zPL2iEy+ciCvOYxiKiHxECvlCY1mEdom/6o/9c9B/gTY:zDD8wvO2iKiHvvlCgdoTcgWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774611125, "uuid": "66d71a4e-affb-43c7-8430-a7538060968b", "value": 81897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774611125, "uuid": "65cd1437-e580-4802-bfe8-87e4145ecc5f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774611125, "uuid": "d3b5022d-e765-4b18-884b-936979cd6486", "value": "20da2fbc1837afea3ba1b2eae3e818fd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d6874f-2a21-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774646028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646028, "uuid": "d2ae4f2b-394e-4498-bb4e-c7594c2a2c2a", "comment": "Malware payload", "value": "434adf4d35a835d413861da327dc0dbf", "object_relation": "md5", "Tag": [ { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646028, "uuid": "c93e7e4c-d0b2-484a-bf93-4426bcfeec99", "comment": "Malware payload", "value": "76f63f6c1923de81542058f445bf021e39a6d744343c566bec1b02ce0f23643c", "object_relation": "sha256", "Tag": [ { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646028, "uuid": "f4996953-93d2-437a-af0b-9fe806bb19ab", "comment": "Malware payload", "value": "3dc7549221399c3b7ca8b63d34adf58ad27be88d", "object_relation": "sha1", "Tag": [ { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646028, "uuid": "3da86415-41c3-4246-a0f8-164c4c2bf851", "comment": "Malware payload", "value": "99ae119459a07e673271a231f8d9191c7767805da19199d0e144e7d634813551f949f31462c83c6f9ddc1ea5ce6a6f5a", "object_relation": "sha3-384", "Tag": [ { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646028, "uuid": "44a3751a-21fc-491b-adbd-d7ae6fd2a848", "value": "T1C4573386D862574FEC3B8C7CD9B4134CC7AABF1AA643C65633BC779214FAB902476844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646028, "uuid": "e1217c5f-2b29-463c-8acd-c21790eb89c9", "value": "786432:pkadBHJ/ZX1JAYMf0QAfyeTwAdsJwwMHQBC8:pkaXHJhP6f0QheTtsJVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774646028, "uuid": "d991fcd1-5a11-4c60-9765-df9eda619e42", "value": 29409280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774646028, "uuid": "895cb276-09ba-434b-ac29-2dc6284ac9c0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646028, "uuid": "3fd41caf-eed1-4537-a414-4d1bfc670228", "value": "eLaunch.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d10bc6-2a2c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774650768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774650768, "uuid": "1720ad58-81e7-4339-b689-5292918f09bd", "comment": "Malware payload", "value": "12b31bb289679f73eec214ae1795d58e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774650768, "uuid": "3f457a90-c308-4aa5-9155-823fdc65b19d", "comment": "Malware payload", "value": "7929355856a2a85d48f95d230cd74fbb5ad554bed49e73b1800136c4bcccd1a8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774650768, "uuid": "480627c2-af7f-4ad9-8425-1de000db1432", "comment": "Malware payload", "value": "57103814666d1d21f09b523c90cc9e43f5fda847", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774650768, "uuid": "9b9c1a0f-be8c-4700-aebf-7e0a5eaaa845", "comment": "Malware payload", "value": "7776ae3e7133637102ca8676b9e6effde7912054ece04752908267b4e203989cca075f96267a879fe2e871154af41590", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774650768, "uuid": "8d909d38-ac65-4bec-926b-e47f5bcd3fdf", "value": "T19BF2A4CF39877165075130FB2F2AF465F22ECC80E60CD499FAD270ACA869B5C91B5978", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774650768, "uuid": "afef2e99-b93d-48d4-aab3-0a16fdfe83e6", "value": "768:Vnb29qrmUaYXYhP5yVScSf6+pcVXi2n6heOgIsG4:VixNESRi+pcVXb6heO38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774650768, "uuid": "9039a431-1aa2-461c-8966-450aaaa7a966", "value": 34551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774650768, "uuid": "50fa0109-22f8-4c1f-bffb-15ed58879571", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774650768, "uuid": "16f76e79-3986-4510-8987-e5ed78b2181a", "value": "Orden de compra_pdf.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d05c28f-29b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774597770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597770, "uuid": "7190b30a-d470-479d-91ef-efc5748917ed", "comment": "Malware payload (Mirai)", "value": "dc84c5c7639f37c98def3ddc82c5c171", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597770, "uuid": "e48662c8-95a9-4d71-be59-ae1949a6e10d", "comment": "Malware payload (Mirai)", "value": "794aaf6fa3e6e1170fe1ee1ab3ba99836d46753fb00b31564629ef7f18a91160", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597770, "uuid": "86e93a07-5958-4f0f-a1fe-9efa73ea80f4", "comment": "Malware payload (Mirai)", "value": "1f0d1afc3435be262807e0e58d74e2747a865117", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597770, "uuid": "d1971195-4260-4767-bf1d-beb1ab97b99e", "comment": "Malware payload (Mirai)", "value": "31202638d00acab40936527822002238b078b28a144fd6df71f6d617ff7b094d587937fd3b9489dc18b916d8a07e48fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597770, "uuid": "5815e38c-92df-44a6-a686-cd7678812446", "value": "T134731986E753D4F1D90705B002E7EB798A34FD620124DE5ADBA4FFF29F226D27046229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597770, "uuid": "6a4ea5f5-eb20-4d2d-af7e-d2de5c422e20", "value": "1536:TwLCLWNlJqkk0RTDwBFEQ8oJyXUG31AkxqHWciOr:HWfBuBNOKJHKm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774597770, "uuid": "7fdbb6d4-d3ac-4f74-85f4-4db17ff25ea7", "value": 77928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774597770, "uuid": "f4b46652-93d6-4438-a253-bde051895811", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597770, "uuid": "c7c53d1e-96ae-4604-b9f6-f05d0deb10ea", "value": "california", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8e8af4-29c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774604779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604779, "uuid": "a05e8f85-e579-43f8-8519-fcf3cbcce97c", "comment": "Malware payload", "value": "a995a523cf9e12601db68b14ee7b8fcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604779, "uuid": "dd17503b-7315-4ef3-9871-43c61d529dea", "comment": "Malware payload", "value": "7982894ad1279e7942fc7f5906f0ced2e04056045a81b02f123c9856d48caeee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604779, "uuid": "9d0d2e5b-ea27-47b7-b456-378a2b967996", "comment": "Malware payload", "value": "168090930fa7cc5c16c184f2bfdd1714d22d102e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604779, "uuid": "6c5b9321-3d64-4e40-ac15-61e0ec539fb5", "comment": "Malware payload", "value": "9e001201222b37eacdcd9e13e04efbafe7b34caa2fac58769829727ef36c87b34d89f025b6ee05e3dee1f0e2a1c5d645", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604779, "uuid": "d8d43a33-7211-407d-8bcb-29def901e9f9", "value": "T1ABF28C2B9BA204D5EE26C53DD9F66437FD70796057758ACF22208A090E60BE1393CA5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604779, "uuid": "94fd4b92-2855-47b3-af69-c4f50d7d3ad3", "value": "2cca5b3a02285e8132ae772bdfb256d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604779, "uuid": "c99f4524-4f68-43d6-9a12-464cb9d058d0", "value": "384:HcRfI5kqOl7U5/AEwfOhBgyzIcq53jI3K3LXpwK3293p/YRHKzCKjd3gSGBkSrX:HcxDXCIohvzhq53Ma3LC3iHKzCKZik+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774604779, "uuid": "fc7f5167-06fc-4a39-826b-fd7b1d80547d", "value": 35544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774604779, "uuid": "7d498073-da01-4371-af3f-060e9ab5456f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604779, "uuid": "82187b98-6a7b-412d-8555-a885f32b222d", "value": "C__Users_user_AppData_Local_Temp_lkz42ivh.up4_documentacao.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7a43a5-2987-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774579816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774579816, "uuid": "7552edbd-87cd-4fa7-a872-6867662ae239", "comment": "Malware payload (ValleyRAT)", "value": "bf52ca37f219dd7fbcd0fc52e4986139", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774579816, "uuid": "6e530fc2-200f-4882-b8b0-b07bc355b49c", "comment": "Malware payload (ValleyRAT)", "value": "7b628f976b029ddeff0a6d5fd1e8f0b506664eb83439ea999dc35786e4c4428d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774579816, "uuid": "743275bc-9677-4384-ae3c-d1f9ff079307", "comment": "Malware payload (ValleyRAT)", "value": "9083d000654c3b318ad6630ab049b4353937d491", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774579816, "uuid": "26d68389-fec8-4a29-b20f-8eeea8955700", "comment": "Malware payload (ValleyRAT)", "value": "2354c65df86cb6e484b90d1463a5e814617cf54a6f665fee60d44bc657a702bf88275629fccb13040c78c4a44a3e52da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774579816, "uuid": "801c80df-5001-47d6-a720-361969a22b6f", "value": "T1D6C5D013B5EAF73ED4254A351D629B61443F6EE1F41A8F639EE43A0CCE380511D3EA62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774579816, "uuid": "7a531882-b312-4993-a20e-5ce5bda93250", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774579816, "uuid": "ba991071-1053-49fd-88ad-f8b05abd80d0", "value": "49152:nDXrxYZ5BOpKzo7z4mk5I6IQDW20ZuRpYt4m8At3V:nDbxYZbwKMM//j/+u76l8At3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774579816, "uuid": "d40e19e9-a764-435d-827d-24d1d826b501", "value": 2740051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774579816, "uuid": "0961649b-3160-412f-97bd-dbae1d65cef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774579816, "uuid": "d545be31-ca53-4dce-8861-87247e2015f5", "value": "BF52CA37F219DD7FBCD0FC52E4986139.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5799916-2a20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774645566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645566, "uuid": "3d094daa-7bcf-412d-86e6-cada3cfcf811", "comment": "Malware payload", "value": "bb4f50c37baa065b2894029b547aecf1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-4047", "colour": "#0C398C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645566, "uuid": "3e7dcce6-6b1a-4acc-92b9-705ce3ec71af", "comment": "Malware payload", "value": "7bd54445dbe8f072eded2df4fd43e882e5890ed14ed924eafaa4fd83c0091a3f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-4047", "colour": "#0C398C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645566, "uuid": "abe5262f-1936-4114-81f1-12ef13ec26d7", "comment": "Malware payload", "value": "35e9976d8ae8682428abefef8681d07b18009544", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-4047", "colour": "#0C398C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645566, "uuid": "c957f1cb-2d8a-4905-9b02-c95e2163f9aa", "comment": "Malware payload", "value": "83a84f64175ba684f1309c5eb012ae49a28ef630827f8c251efd79f1c8db18ad7e85b42cd9868c925a864d30a45fafac", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-4047", "colour": "#0C398C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645566, "uuid": "1efddde6-c7c2-476f-b8f3-93eec2775a48", "value": "T19E07331014C48F1E5F60741605F0FAA23B989E3D1CA65818F5BCE6AFD5414E1F2EAFEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645566, "uuid": "3cb0480f-dc3c-4801-9940-0eed3ee8d66c", "value": "393216:6/q5R1PoJ09UUHA6UM6npYfPOSFhd+8b0Zd2IEUws+D/aMBJIk:6irpoJ0DTU3npgPOSFX+FH1D2/ayIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774645566, "uuid": "a29b7872-b877-4373-8690-21339045fc50", "value": 17127891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774645566, "uuid": "3256163d-d382-43c3-a187-f063481d701e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645566, "uuid": "b2434817-e6cd-4ea0-87f6-84501b71af07", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2fc608-2a1d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774644341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774644341, "uuid": "1693024c-b6ca-4391-ba2d-f8836e50415e", "comment": "Malware payload", "value": "69639fc847a3b07464c2ee8186aaf77a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774644341, "uuid": "40544253-1b21-4a12-8c22-d418cbad64cf", "comment": "Malware payload", "value": "7d2483e2ab5ac0a5ac8c6a6dee0eb8b782d8f10ed9bd416c68ee076b404321cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774644341, "uuid": "c27dde1a-7d9e-432b-a188-cc1f092109f0", "comment": "Malware payload", "value": "deb4d48f683b7bb1bb6170e07d458f3c551960c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774644341, "uuid": "1dd3cfb5-8781-484b-ad99-440b57379b6b", "comment": "Malware payload", "value": "252cfd3d17dcc88c978aa7fd40fb6f3db08081f5ecfc20a191b0fa1f6090446b1c30d906ba5da949c4c9a7d25eb49236", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774644341, "uuid": "95659767-2f62-4481-a364-08c7f4b3c913", "value": "T1E0273A1C1EB45723D27AD236B8A426A6BB706843E2318F0E24C597993D137326D45FFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774644341, "uuid": "a485db46-6fa2-4544-8281-a2e24a450a37", "value": "a8308de57fce070f4cb88c7f43bf4b27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774644341, "uuid": "5443a49e-0756-463c-808e-baf5e0496156", "value": "393216:mmODuMDmi3XAu5ouCYzASfV4A3mDDDy/WTALOg8Bb98q:/OqMDmi3XAu5ouCZMBOg8tp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774644341, "uuid": "a41dde4d-4e55-4c38-9f10-f10a959d8c3c", "value": 20737532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774644341, "uuid": "a8b65eeb-e840-4b5c-aba0-f0dc895d5743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774644341, "uuid": "1161d618-e575-45e9-8c1c-4a691e2b8f97", "value": "pouroneforher_FB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398c8b40-2a2e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774651344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651344, "uuid": "e2020e1a-d5de-47b3-af99-9555206d149c", "comment": "Malware payload (Mirai)", "value": "642b93f70b9efe1244fa18500d5515c4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651344, "uuid": "ecc703df-4cb1-4a6d-ad2d-ba9655cd1f2a", "comment": "Malware payload (Mirai)", "value": "7ddb77f4f6f6c45b85eef9e90adbcf900886a28321af058dda68e48ac05bf921", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651344, "uuid": "931a77b5-b551-4549-a54e-5cb030f22d43", "comment": "Malware payload (Mirai)", "value": "486501736ca679329c9f0b3c5b193fed68447ccd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651344, "uuid": "d471889a-2c07-41d0-a713-44f1c580a80f", "comment": "Malware payload (Mirai)", "value": "e8408c1cdd07f98b107f79edf9c0caf8fd2f431aa2e32e355edcd99edc5f9878cb8975292a817d57c738a035827acc1a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774651344, "uuid": "e2e70492-f677-42b2-92b6-824fbead795c", "value": "T1454159D977B371B12C719D36667A4444B061A4C5A2C0AE966CCC3AF6C08DE9431B1FEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774651344, "uuid": "b7ac4323-e874-4b49-8d3e-946c681c49fa", "value": "48:28PoPij8u88DlDY7L8kVaJ8fwV86AIU86w6t8WzWp8N+8pu8YPs82485Q83OLS:2OiijM3L6DVArPtUz/Vs8Ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774651344, "uuid": "82015b9f-4d36-4f71-a258-cc5cec5d008f", "value": 2414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774651344, "uuid": "7760cfa7-8053-4995-8a61-fe953057397d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774651344, "uuid": "74dd2462-0175-4aed-a2b1-cfe888e996c7", "value": "test.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e1c7e2-2a2e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774651610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651610, "uuid": "1685bca4-c6ee-4a68-9502-32ed5dbf0804", "comment": "Malware payload (AgentTesla)", "value": "7e5d8eeab14a3d1e112818b4c35d5b46", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651610, "uuid": "da36bec6-a940-473f-88be-25b40157df2c", "comment": "Malware payload (AgentTesla)", "value": "7df6b38369540afdf27431aa0e45c1f1f03a97acbf42230733aba474a9828cea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651610, "uuid": "73aee506-a160-4ef7-bf7b-fd58deb7d56f", "comment": "Malware payload (AgentTesla)", "value": "a3940c50bf6d6cdea044a2016c1acdfdbf601069", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651610, "uuid": "0668567f-d338-4f4f-9767-a14c992756f3", "comment": "Malware payload (AgentTesla)", "value": "bb2ef32939d63bdcf669a2d66cf5224f4628a1ee670668c35b1760e6ede01bf0ba4a1d3fea7e97a3dabee2cba2ccff83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774651610, "uuid": "4ac26cd6-9139-4a01-aacb-0970c2b1f077", "value": "T1BD35331B94C2C2ED62759062F135E2A754EA9F02F492D1F5A86C71E36327F07C6068BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774651610, "uuid": "0e4a6adc-c597-484e-8e4e-764ed77c1b33", "value": "24576:eThBxJDZm3hpnd/ROB76sN8NNk5OD2IOhq8KJiv4/KZo:eTXbDu1St69l2IOhqHJyHZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774651610, "uuid": "1e74e2be-c41d-4acb-9dd5-839f230b9043", "value": 1074069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774651610, "uuid": "01aef4e4-87cc-499f-942d-c41f05794e82", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774651610, "uuid": "57993f03-243b-4d76-a639-7f50f8a1fe4d", "value": "PO G2605-3445.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9165c52d-29f6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774627440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774627440, "uuid": "463fb7f1-fbf4-45f6-bf6a-ea93193aa9a1", "comment": "Malware payload", "value": "7ee2fcda1ae18440b3e444a42fcdd84e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774627440, "uuid": "3ee7f330-7a3c-439d-866b-b99ba970243d", "comment": "Malware payload", "value": "7f08de2db662531be25f28cdea63b3b9e85051ddf9ddf96064ec50a63cf26e21", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774627440, "uuid": "ab016c0c-0a90-4b1d-8dcd-8c7128006bf6", "comment": "Malware payload", "value": "1a578ac62a782dcee0b5a3e93b01ef560c5af289", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774627440, "uuid": "387903bb-ded2-42ce-abd1-cf27e17b4bc4", "comment": "Malware payload", "value": "8b03ea8c100d2adbae685ca4f2c2efbb961e992d41a165b6bfa01d1726f8f877878ad9cdda72d1a06ea39157a8f3b3fa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774627440, "uuid": "805850c8-63e7-49d6-8a96-375aae2329c6", "value": "T165925DB512896C79FBD1CE399F3C6F4DADE8C2C42124E3ACBA4F39215A1166DC70534A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774627440, "uuid": "ec5e63f8-c7e7-4536-9b28-1a28e8f07a14", "value": "384:jDFcuQpWx+BL0SWL0g6zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:/F8i+BL0SI0JzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774627440, "uuid": "e3112283-c769-4cd3-ba31-3a43a0ddbc0a", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774627440, "uuid": "4a6a7e34-28b6-43a2-996b-2111818960ac", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774627440, "uuid": "e5b8c538-2f93-450a-9179-57b61c8165f6", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b4153f-2993-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774585007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585007, "uuid": "68f486f2-ea43-4ecd-bdc4-6067282ec2fe", "comment": "Malware payload (QuasarRAT)", "value": "6bc90ee35a53fc5ff4e8574e6ea7a10f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585007, "uuid": "a8e5e051-a1bd-4a67-9233-6402e016e0f5", "comment": "Malware payload (QuasarRAT)", "value": "7ff5220a37320efc97d011a95e28bd0c016a5ddee388d469bade1fec7a87d325", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585007, "uuid": "acd063a9-32b8-4a78-8bb8-428055660731", "comment": "Malware payload (QuasarRAT)", "value": "267afc889064d11d4f1abdd579c26242c79ebd7c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585007, "uuid": "1fb2e5d8-caca-46f2-8777-b1ef757de455", "comment": "Malware payload (QuasarRAT)", "value": "d60e342a2d7111ebf93c1f878f36ce229f44b34681dba61c61df33c7c22d303785e6e9bcb58a52e95e0842539a775ab4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774585007, "uuid": "41be5690-94e2-4137-8d90-6b50b01c5284", "value": "T18B564C6FAF659841CA4B41316FF97D483EBA373240C5608DD26B91807696BF2E64FC2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774585007, "uuid": "38acc179-1987-4f5d-a720-44208dabc899", "value": "24576:smVVUahJXf6wf+YoP+FXnJ+pwhvd7pQLfypbpYroJoJIxqrjR29tqgW71HQaaqVq:VP648Wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774585007, "uuid": "407abc94-9daa-4748-af8d-2a22eb3823f5", "value": 5935104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774585007, "uuid": "0ec22e86-d3be-4793-84e8-36aedcd181ab", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774585007, "uuid": "4b04aac8-f8c4-4c04-91d5-1617b1eac85a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f508bf3-29b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774597747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597747, "uuid": "edff9013-f860-4ded-b4b0-bef401a800a4", "comment": "Malware payload (Mirai)", "value": "3eafd8ea3f8d94303cbf74056ccdb14d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597747, "uuid": "3557aca2-126b-41dd-9821-6b3927b2aa64", "comment": "Malware payload (Mirai)", "value": "8062f4d71cf4338aa54950270d18fdeb5b3064fa498c2e944f32f5ded6d8f284", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597747, "uuid": "729f0d5a-e11a-46c9-8aab-48883d7db8dd", "comment": "Malware payload (Mirai)", "value": "f13c79f909bfbab6760fecb279f362b4ab117efb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597747, "uuid": "aea0f878-6802-4041-8234-a5aa264846c0", "comment": "Malware payload (Mirai)", "value": "8e5f919bbfcea2b1b165417d279309eae1c361e2194cbf013a5a10fd82cba63d764682e5df87df581c1021ac80827f24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597747, "uuid": "26948528-d81a-42f8-9850-845a04894c21", "value": "T11CE23A1356B87E37C4D0B77601D30372D0EB9F4445246B5F7D061C8AAE2E3912B2AAF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597747, "uuid": "cbae205c-5d75-4d5d-a4ff-9453c5a7ac45", "value": "768:xKG3kMJ99EInoG47znjaYDw3ymMMIZLvvX:xKG3kM6K6deyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774597747, "uuid": "cb069a90-c477-480b-9540-29ab700b7028", "value": 32104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774597747, "uuid": "07ca2059-1fa0-4ecc-b9bc-4b3b97f8ecce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597747, "uuid": "ec0bc06f-bd07-4202-a77a-fd0c9b95aa07", "value": "indiana", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae43f206-29d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774612026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612026, "uuid": "761a4c7a-eaaf-4a12-b4de-4b69ce8f243f", "comment": "Malware payload (Mirai)", "value": "596d1bf7bc457161864c10e5fcbd2de7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612026, "uuid": "529aa1e6-c8e7-429f-81b6-313243e54a11", "comment": "Malware payload (Mirai)", "value": "8115b3975207d1dee1f875d784546699e9a05c2d0f396a11f60ce7a49d9407aa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612026, "uuid": "e2302515-389e-488d-ad20-326c3796b48b", "comment": "Malware payload (Mirai)", "value": "4d784a2342096d2f76a7eea338f1dc6dfc9f2f54", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612026, "uuid": "8200e6f1-a47a-45de-a624-724d2ba2cd26", "comment": "Malware payload (Mirai)", "value": "d6a786b923614bf03be6f229c5f1123f386cceee0825b8c6ff09ae69be46e45a15005284859ec261b87737d2e0f5b2f1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612026, "uuid": "2c88511b-ca00-4022-beed-c916863b59bf", "value": "T10EC3BED7F78B24A1CC6146F007C76B9E2E6361119E6BE9E76C0E663B093A0DF19063C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612026, "uuid": "f39a9215-c550-4d81-901e-45bf2691cc0e", "value": "1536:BH6XXWAZxg6cgoWZKxtHQEyhBGLaDWql0W4s2sieEg6tCwxZJehgxb/LWg:J6XXhxr4R+BGL+tJ2sd6tChhgxbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612026, "uuid": "d61c7dab-e23e-4f17-a3a7-c3d850544700", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612026, "uuid": "2ac853e8-880b-48e5-b11b-7907bb579272", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612026, "uuid": "f962eb0a-bb70-4bb1-9327-a58916f7e8eb", "value": "windy.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e1e045c-29fb-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774629367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629367, "uuid": "14811eaf-d001-4a19-ac4f-fbeb66290c12", "comment": "Malware payload (AgentTesla)", "value": "6940ed7d74ff0c25bc5b89ffe82c48a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629367, "uuid": "17b2b759-a917-4d27-be72-4f83def4d484", "comment": "Malware payload (AgentTesla)", "value": "8163363141e4466928fdeb219fda2d099ac4d55c5e0b7a626e53300511d0ce8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629367, "uuid": "8bdd470a-8b7d-489c-8fb1-51954e67d14f", "comment": "Malware payload (AgentTesla)", "value": "5e3f7136b16326bd0a364b903d7bd0ea77cbd46e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629367, "uuid": "0705d469-a9a1-4c55-a6f2-3e729e31dc9c", "comment": "Malware payload (AgentTesla)", "value": "8f8e6e1f23fd07891fa6964965f3a25278e4c404dc1c8b4bf438caa9b4aedd84cccd6bb13d7a29b76eb89c17b547f086", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629367, "uuid": "ff794d08-dda2-4824-b6c8-c998923604a5", "value": "T1BD65020589C87FB9CFBC162950BE160EA3F04D8A5119698AEB73FD4BFFE760051171A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629367, "uuid": "6bda39c7-25ad-4cba-833f-9cadc2d76539", "value": "24576:MqLCueJrjKtEGXv3xedbKNxSuc6+Sn/F6wo6LO:MKJF9+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774629367, "uuid": "0e0c8adc-aaaa-4954-b6d6-aa71f2c4836d", "value": 1516998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774629367, "uuid": "ad662d57-284f-49d4-bfcc-ee87479465e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629367, "uuid": "9af1ced3-d566-444f-994d-4e302f2035c7", "value": "PO G2605-3445.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21255c95-29c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774607924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774607924, "uuid": "4b38779f-f642-4023-998d-d9599e64350b", "comment": "Malware payload", "value": "b216dcfa987f6be94eb9fd139d13fddf", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774607924, "uuid": "4ae58ab3-e8a2-449d-b69d-046d5667e129", "comment": "Malware payload", "value": "81d93004a02a455af01b0f709e34d5134108ec350f9391dc0f91a00a54998590", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774607924, "uuid": "1590b576-9702-4a3c-b19b-3896d8f1f16a", "comment": "Malware payload", "value": "08893ab273c834c8e4be7c059d8bf86f35df1309", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774607924, "uuid": "93651a4e-7d84-4b43-9525-5989e47a007a", "comment": "Malware payload", "value": "398f54d816e5ef5480022e9d0af79eccaf70492771ae91e81d0e13afd709df449be107339a3868f8199a6d3653f37bc3", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774607924, "uuid": "fdb368d2-61a4-4e6f-948a-101bb4430341", "value": "T17E339E007BED6220E1BA9A3A15309BC9D777FE51BE36D34C0A61E15C2C75600D835B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774607924, "uuid": "37c422c6-6b08-4194-ab41-3f1bceab3661", "value": "24:w8/ZkrXUYgeLVfJwAljIYvhljIYgk/8e7W/gLLVfJaZQJe9/67J9g/6LVfJ6W7LY:nZkr2NAjpjuEFqY+ZF6Q8g5Nc/yL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774607924, "uuid": "d928ead8-fc7f-443b-8f31-797b49c9df21", "value": 52399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774607924, "uuid": "00d875cb-a23b-4ff8-83a6-072458c1ea2d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774607924, "uuid": "0f719f04-ed0d-44b4-9e63-938e02d5e294", "value": "\u0420\u0430\u043f\u043e\u0440\u0442.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9bb65ac-29bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774602570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774602570, "uuid": "1a169237-c93a-49d6-bd7b-327f5af40f4b", "comment": "Malware payload (Mirai)", "value": "4b3b5663268969bc06d7ba5e6573fe6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774602570, "uuid": "94e75373-fced-4b42-86de-32fffa180d46", "comment": "Malware payload (Mirai)", "value": "82016f76a3ec06e0bbaaaf59b7e809c0b3fdd6f39f34ba0d30d63d350b88a65c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774602570, "uuid": "8c229205-fc49-436c-99b6-7b98d77f201c", "comment": "Malware payload (Mirai)", "value": "a3882bcc5d0c6175d60080bae62126b4b45692b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774602570, "uuid": "8781e93f-886e-4ce8-9819-bd3ed0840132", "comment": "Malware payload (Mirai)", "value": "ce9a117d3a1f989fb94c9c99168e86654f0764b6484a40a7cea494579c4f2a8893d05277d72eb0b95973c6f0317cb75f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774602570, "uuid": "6f24e6ca-9e2a-407a-a335-3af3477e5a30", "value": "T155464845BB1C0923C6930DF0993E43D5F3662B4382B1A22B6B0F67473179936A6DB78D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774602570, "uuid": "5078a051-0145-4df1-ab63-db5e7880a842", "value": "98304:0y5dw0I0mf+VvcNeAkXuRAfGwRgRBIC2vc/7LIa4BiiYCk3cUYTwbghvCO7c9bUI:A0mDRHbU+107tdY2WCbN0ms31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774602570, "uuid": "239e02f5-22f7-4221-bdfd-70cda109864b", "value": 5662136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774602570, "uuid": "00105dc8-b381-47dc-908b-face62d1a579", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774602570, "uuid": "2f9a7c7f-cee6-4136-9a6a-0e7205f99751", "value": "wlan.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55407d7-29f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774626641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626641, "uuid": "3edda945-4815-463d-88a1-bc7ff697a376", "comment": "Malware payload (Mirai)", "value": "449782564019e44a4ec76edf90bda6c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626641, "uuid": "cffb00f7-288e-442d-96af-3c2ae05a2f1e", "comment": "Malware payload (Mirai)", "value": "820f297a75480e6727207bdb412751ea7b49ef1bc87e2494964fc4fb34bdb9d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626641, "uuid": "56612ca2-e674-404a-9fd7-4dee973332c4", "comment": "Malware payload (Mirai)", "value": "ce1d864b1de0fe6c4b7dc7f41312b6310fb0a3aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626641, "uuid": "7a636f67-7520-44e6-ab77-ae9f4558a419", "comment": "Malware payload (Mirai)", "value": "478613a828ed260cd41c4de2fc0f24b7a1335027427f6b2facd7fd5d4b4fd7ee2e2d8fd1e50cf8d7f3414d30a337230c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626641, "uuid": "750edad8-e4aa-4a88-a8b8-4175e4a61c30", "value": "T154E2279AB9909B5FC5C4133A7B1A411D3356A3F4D3DF7B07CE4A6E01328E61ACA36D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626641, "uuid": "b9f309a7-cbf4-4d16-9f74-472586ba90a3", "value": "768:APqUVWh6QJ7vJ0vtCLIQosI/aTMTpdT1UK7zGn:b76EjJwtCLI5STqdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774626641, "uuid": "bb0018f3-857a-4407-886c-862428530cd6", "value": 31896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774626641, "uuid": "790bfea5-045c-411c-9bcb-cc3f38ea01a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626641, "uuid": "bfe57626-6b47-4d54-a802-997a2d868c67", "value": "dbsu-daemon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3abe9fc-29af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774597110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597110, "uuid": "a4a595b4-1820-4588-89bc-f89fcd150656", "comment": "Malware payload (Mirai)", "value": "0cb05d2781bdf81674f574c215d050b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597110, "uuid": "08fd431e-26ee-496e-a88e-8221b48501ef", "comment": "Malware payload (Mirai)", "value": "83edb8ec1487637f33ef6025043228987ae9f9c2da7f4957634a9c842aca5fc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597110, "uuid": "b0d079bb-ea5a-42b4-a58f-217892fc9cca", "comment": "Malware payload (Mirai)", "value": "5ba6f3633ba0437bd8d556ebb84b22c17f857636", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597110, "uuid": "27851ef7-9820-4827-9b4d-a627e06027a7", "comment": "Malware payload (Mirai)", "value": "5404b36f131b315e47496d0963ef02d0247e3cd27fec332f9dab34190a83f7f27531b47bad0291ed2b78d1120220b897", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597110, "uuid": "6eef7c73-bca5-40bf-95d0-19e0d31c631b", "value": "T1C9463A136721DF1DF356C53805B3DDE11AE515A22EE09588933DFA2C3E60A6A340FEE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597110, "uuid": "5261f213-0003-428f-9a06-6d82e017e4e7", "value": "49152:4vw7xSe8eMOyjhj6eP9oSL9y+Xd0JhMZJozF8gMwgQaMep+pt7/pc/Q9TEG64KSF:VcPcy3X3nopRa3+7Lo9TdYbmWxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774597110, "uuid": "ee04ffc5-cc1a-4788-9fb4-df2dec78f414", "value": 5422876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774597110, "uuid": "b7a69588-42a5-4d84-b9ea-8869767841a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597110, "uuid": "3ceaf3b2-fc66-4d8f-b5a4-bc15d7385547", "value": "wlan.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6750b133-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774596445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596445, "uuid": "4043c694-834c-40ed-bd59-1823833d1145", "comment": "Malware payload (Mirai)", "value": "484210d93b0edaccd1c703a3edd51604", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596445, "uuid": "4a653814-fc05-4b52-a8dd-4421b76c34b3", "comment": "Malware payload (Mirai)", "value": "855cafa0b413bfdd57795fcbaa83bb14d0194d1f169e636668afdb68488ec659", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596445, "uuid": "0e380623-d2f8-4ae4-a8be-a4d752231432", "comment": "Malware payload (Mirai)", "value": "4c7a19ef6c2ddf05597e4207e38c2c2e8d85b63f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596445, "uuid": "dd13aab9-bae0-4c8b-867b-d62400f8f6c9", "comment": "Malware payload (Mirai)", "value": "d3b015aae676f2aa5abdccd700cd85c23d9f71b23f90de2013c1656c8b5607a6f1958fdd64d7553771ba71b3a7192dba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596445, "uuid": "6c3b3ab1-57b2-4a85-9134-c9346a82845c", "value": "T1D26301CB6EB02B27D0DCA1B1703515D9CC3A9D8AD653CA9983E2E786073852664C8B1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596445, "uuid": "de5a577d-c571-41d7-9feb-61ab88a96860", "value": "1536:DaxZLmYKVDNSl2y08yumeJyGYVmIMG7Mr3BBNL:DaxZLmYKX+t08jmeJhYTOjNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596445, "uuid": "08021c63-26f0-4570-bd55-1fbc4c5b6eeb", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596445, "uuid": "445bd191-ddc4-4252-9910-67900bc17111", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596445, "uuid": "73465f92-29eb-4e98-aa87-75606a330542", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc90da0c-2a22-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774646464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646464, "uuid": "ca3467ea-257c-4ccc-a3c2-eae033101176", "comment": "Malware payload (AgentTesla)", "value": "f31c1d49ad0b3d221033c0991d7791b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646464, "uuid": "e8b2fd60-93b4-45e0-8740-a9f73d7bfd2f", "comment": "Malware payload (AgentTesla)", "value": "85685b47e71b0f8875f9b034e840ef00bbbea2e11761f6fb3d8b2e4a0464dfa6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646464, "uuid": "4069f572-e443-4339-aca0-913b682a13a5", "comment": "Malware payload (AgentTesla)", "value": "50a05ec833458f893c31a4ece801ce6715e6cec3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646464, "uuid": "7097b0f6-de46-461b-8804-3f26625435fb", "comment": "Malware payload (AgentTesla)", "value": "d4d7cbd6e779105f96d2b0b5a30b355f5f95bc48bf9ad39ebbab08957ebca5d8b800252e005908e4c8205abac390ee57", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646464, "uuid": "f3e9ab38-19d0-4722-a245-652867f0471e", "value": "T1483533580DFCD1E21F3244657DA0E0A04B7B45E658A3F9729DF435128FFA2E533A079A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646464, "uuid": "6f9dc32d-02be-4f6c-bdc2-51c5c21b2e85", "value": "24576:OI+KcmamJ2e8YqBG6znkEQ+DyXtDpFdjpTxY4mvKOK/YemKp:OI+KdeBNVQ++LFdjpTxdyKfmKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774646464, "uuid": "a18dfb5c-3c09-4bd0-908f-06d5c9d2686d", "value": 1073313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774646464, "uuid": "28e8c9d5-e4df-4dba-a523-61352b92d5ac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646464, "uuid": "a8bf692e-478b-4bf6-a738-b2e3542b4f27", "value": "MV_VALTELLINA_VSL_MAIN_PARTICULARS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a29b28f-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774596370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596370, "uuid": "c2a6175c-1606-4d4d-93ad-7e808b6210b8", "comment": "Malware payload (Mirai)", "value": "a77b91f077cdd35c98cb6a6efe058f6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596370, "uuid": "00f5389d-2352-4e32-8329-729d903805db", "comment": "Malware payload (Mirai)", "value": "8629b5abe7127bba2f1286efe92590f0d84f32a36c0ca9f3eb1a985252c5195b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596370, "uuid": "6b604315-9305-4dac-873b-c05620147049", "comment": "Malware payload (Mirai)", "value": "43292a24b0b5fc040c93ef4eb17994d31deb92b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596370, "uuid": "c6e1b8c8-0d8d-4dca-835c-92f67b75a24b", "comment": "Malware payload (Mirai)", "value": "5ad6b7a115121251f48a17a6f7436f564502c3da9d32567385537885e31132703e1890bb875b7cd08645d60affc983dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596370, "uuid": "1bd10131-68c2-451b-a13c-09a2ddce1505", "value": "T1BD146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596370, "uuid": "411580c4-2f6b-46c8-8613-d4afa099c33b", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtu:BZAyFzQSdS7I3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596370, "uuid": "4b07684e-0b80-466d-8150-b5a2b5c1d80e", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596370, "uuid": "406fa7fe-df4d-49d4-be04-87d8935ccefa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596370, "uuid": "4d086cb5-c473-45e5-aeca-7908e96b3f1a", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e867b74-29b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774598444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598444, "uuid": "6ead2709-fb3b-4fb9-b161-b3e31a05be1f", "comment": "Malware payload", "value": "4d1e35340f8270140111e6b8cc4ed937", "object_relation": "md5", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598444, "uuid": "e2b48450-d7ce-4120-aee1-fe5dadcfb84e", "comment": "Malware payload", "value": "867f0397c516ffe127367288f8113896afad498db7b559f8f5fcae967007e9ab", "object_relation": "sha256", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598444, "uuid": "65a31a9a-cb7e-4e41-8758-f158787b88d9", "comment": "Malware payload", "value": "8a0b500d62b3202bbccd6b32e568bae532c5c7ad", "object_relation": "sha1", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598444, "uuid": "13de8d6e-24e1-4661-9d6b-f51b3d39d1e4", "comment": "Malware payload", "value": "1d27f4377268ad8a47be79611fb4011564fe6309b42b41cb8e3dd60b37a860b768fad45164433d9cf7d88c0fc3844e13", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774598444, "uuid": "34cd3c95-4c37-43da-920b-5a7d86f62183", "value": "T12E845A4243FA410CF1FB4F88AE7A40614A77BE661D79D02D16A8144E5AB3E18CDB5BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774598444, "uuid": "6ec318e6-d154-46de-b811-6ede23cb9498", "value": "6144:rPFQyQHt6Bs11tETxeRKp9KLPaMUhXkdVJi1QgASckt3LFJJ5UPnRQjSxFulghDd:rddCt6unGTxeRbPaMakdVJiagpcktb3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774598444, "uuid": "647ff94c-4223-474e-83dc-f817bf10154f", "value": 387200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774598444, "uuid": "a686a982-24f0-494c-b0e0-a8d05fa992e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774598444, "uuid": "ab52a340-fcf9-46ae-998f-895c358ed72c", "value": "INQ24-01220759.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f32eab-2a25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774647786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647786, "uuid": "2ee50038-bc0d-4d0f-a11b-681196ea8126", "comment": "Malware payload", "value": "bb9ebfe6045577d35ec0d592ec8e262f", "object_relation": "md5", "Tag": [ { "name": "5-8-248-245", "colour": "#8543B2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647786, "uuid": "1056e9ca-0639-4b97-ac02-e7e7bdf77299", "comment": "Malware payload", "value": "86ce0bad00a31c8b7b64e8cb07ca8a49bba4fc02d339e04eb3ba61a85ec6bf53", "object_relation": "sha256", "Tag": [ { "name": "5-8-248-245", "colour": "#8543B2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647786, "uuid": "dd044c62-2477-466a-acc2-d856621fae4d", "comment": "Malware payload", "value": "68dad1709f2319299c4fcc058c297819582fdcdf", "object_relation": "sha1", "Tag": [ { "name": "5-8-248-245", "colour": "#8543B2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647786, "uuid": "1d04e9ff-2b2d-4a09-87b7-6fa7cfbb0abf", "comment": "Malware payload", "value": "cd8b72518842fa056962714aef886a4c2d8a05d5056d96ea3c6e3a6461bef4e9b07ffefaa48a3305f5cbf9264f5e1aff", "object_relation": "sha3-384", "Tag": [ { "name": "5-8-248-245", "colour": "#8543B2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647786, "uuid": "13640478-a9a6-4ad9-8207-5a2f6e7791ca", "value": "T19A147D4673A9006BF87B9634C9678916E773784207309BDF03A443B95F277C1AE3AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647786, "uuid": "571b441f-7284-4613-9348-ac69d94db37f", "value": "a7f7752d6202c6b5602510cb5c8c7dee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647786, "uuid": "dd9d17b2-298b-4c10-a49f-f22846423584", "value": "3072:Jgz+Vc+CfKpC0MhKoLKnvjF5h6EaayygyEcu1IxWJ4PPmCb49I/oUiUnJ:Jer+5pC0EW55hjBzV5WCUK/oMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774647786, "uuid": "eb707efa-c102-483b-98a5-1f1aec13a0d5", "value": 192616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774647786, "uuid": "acf8609b-9d87-4550-9884-7492bf2a1f4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647786, "uuid": "b61b1a0c-fde4-449f-9dab-f1a0e2f77b69", "value": "vcomp140.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78ec088-29f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774626725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626725, "uuid": "1137c66e-ef16-4dfc-9dc8-d171406265ae", "comment": "Malware payload", "value": "15af954e449fc30cf829565f33babe59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626725, "uuid": "a99585d8-8652-4cb9-9c79-2a7c9918bf33", "comment": "Malware payload", "value": "88493a057c8c73edd7690a7e98b00773221d5ca8263f498379f691193bd33f66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626725, "uuid": "3b619cde-ad63-45b8-9526-4f17e0680a54", "comment": "Malware payload", "value": "f68ecd3588f8ffa69a72373dbd7448b873a93f76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626725, "uuid": "1901f6f2-43eb-479b-aa04-31915bda2ffe", "comment": "Malware payload", "value": "03689f4cb3ce24baa592ac68a28693211f3fe61529db7dce9a0edf7cbd63330a078debfe09d25bfd79f26ee2bc791133", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626725, "uuid": "8004163a-1fbb-47d7-88cb-c619136fdb63", "value": "T111B65C06BCC42BBAC46C4A7484FAC95122B05E144AF1467A2565FFEDBCB72797F0788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626725, "uuid": "b496f2e5-e3a2-4ff2-93ac-6a344a3842a7", "value": "98304:ghbGCDCBM8E49d2F+Qb3/esTcIGCX4Zcx+:EGC8M12E7GsTzJX4Zl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774626725, "uuid": "c516820c-c827-41b1-99ab-732d1aad8850", "value": 10900181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774626725, "uuid": "e7e9e080-886b-477c-8345-7824b585e6b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626725, "uuid": "bc14b148-890c-41c6-b010-7348e77f9e2a", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f618fd91-29fa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774629327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629327, "uuid": "4be2892f-0313-409d-a7c9-4851d31c24f8", "comment": "Malware payload (RemcosRAT)", "value": "3d26dd05a31971a6c0ddf741fa99fbe4", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629327, "uuid": "b38d8cf9-57ad-49fe-832a-ef3bb7f56bf1", "comment": "Malware payload (RemcosRAT)", "value": "8886deeb1f13a0c21d14ab2db36d984b7af51c6c9e5608d65aac5ac7aba2da49", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629327, "uuid": "abc6ba97-97bf-4766-be41-d7eb9d76f88c", "comment": "Malware payload (RemcosRAT)", "value": "3a99384b64c2c8bde55e145b42c7f4dcb3d91d35", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629327, "uuid": "482690d5-489e-4808-89d0-b77dd7aa73ab", "comment": "Malware payload (RemcosRAT)", "value": "8dd534ba825074d459796e40340520b0d40504a4b306d62d4f7eb43cf81e13424d03abbf45fa8cd9ed26ab4abf7dfc24", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629327, "uuid": "a934736b-eaf8-48a6-a0f2-377f7fc69607", "value": "T11CE40275F68C88ECC60784796A479581130EBC546B6ADB2230DFF32FB473A6D86D3522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629327, "uuid": "2761ef60-1108-4e8c-9f87-3ecba08d39f6", "value": "6144:63Psb8uYoQYExcojgU6JIsb8uYoQYExcojgU61CTLwadeQJktiMwnmow/96rWrWx:6/puyzpuytYaFktiMeFilaYLYEsQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774629327, "uuid": "067dfe11-9e24-4c4e-9ab7-6bd0f62e41f2", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774629327, "uuid": "a1413a85-f2c3-4998-a2a2-86102e550384", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629327, "uuid": "b469f2f1-6efd-4e97-93ee-9c2152704726", "value": "Agr_Esting_1_ATCIS_Ahmad_300925.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a059b88-29f9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774628716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774628716, "uuid": "d91c9ed5-1bac-4e07-bb9f-7302388b67d5", "comment": "Malware payload (LummaStealer)", "value": "e49a60aa59aca73fe86d046f403d33ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774628716, "uuid": "1d194b02-7129-4563-aa3e-70d590599538", "comment": "Malware payload (LummaStealer)", "value": "89043da2e6d158dcd7741c0306530351759b57830fe6a8ed0092362f46446e0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774628716, "uuid": "c363fa2e-9158-4218-aed5-5442c463eb7c", "comment": "Malware payload (LummaStealer)", "value": "11441a0879ab1ac1cbe5df59b830c540e924e2e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774628716, "uuid": "5f08ffac-b3d5-4328-b4ae-7fcec48db2d5", "comment": "Malware payload (LummaStealer)", "value": "fe3014933ad5839aa0bc95caaec94aef75fe098948501dd83fb580dc66827498cc9524ddf1f36622e8d59a73f51aed70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774628716, "uuid": "6f4f0b79-e7f1-4bd0-bb7c-6f732e61da32", "value": "T104947B56E3BA85E2D84B163C10E6BB3F8D207A1007349FD39BC0EADB695E9D6413D712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774628716, "uuid": "ce2fae94-ad8e-4111-a0b3-611d363579af", "value": "29aef8ae8cce97ad2ba2fffb270e6c34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774628716, "uuid": "633d7ed9-4ec1-4934-bc96-710386c07e9c", "value": "6144:MO0dkDl5i6k4Ft6Afvbt9V0ENK5ZM/TIbpKM8mrx/KDKJoPJEJQJEJzJEJrJzJES:MO0dW5i4r6AXjKEKSEpKM8m1/KDhWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774628716, "uuid": "f6c25cd6-0d79-4b4d-94b9-a4ce53d3c989", "value": 437188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774628716, "uuid": "3de8093f-ec90-476e-b1f5-bce0fd7aa02e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774628716, "uuid": "d59bef99-5607-4b2b-bddc-60454569efe8", "value": "89043da2e6d158dcd7741c0306530351759b57830fe6a8ed0092362f46446e0d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f71cbfc-29da-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774615250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774615250, "uuid": "c06946da-4b37-4594-bfa9-cc1ad4bfb52c", "comment": "Malware payload", "value": "448dacf967fb80e62b2370993347a6f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774615250, "uuid": "00975e18-f43e-45e7-98fe-c418d86c9785", "comment": "Malware payload", "value": "893e8fad67156615d67509706a75bd5c7031f94914c2a39336b22458896fcf53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774615250, "uuid": "4e54de12-2a86-49e2-beec-2305566e992d", "comment": "Malware payload", "value": "328549616c9e13e45f6ba86c33f703412c4f3d04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774615250, "uuid": "406ba098-da12-4523-8d16-99155d78aebb", "comment": "Malware payload", "value": "8202be77f30b72a8a69e66eeed112255919c1ed7e555148399ee26db4ae97c9e7f670dc1c4a0ea6cd83e820325dba135", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774615250, "uuid": "30a4d904-1407-41f3-8cd2-9cf65af439db", "value": "T136746C3171E4750AF2F54E93D2B526A24F7BBA370C64855EB8921B0ECA31D41CCB87A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774615250, "uuid": "70f4450f-f108-4228-86ff-e907f912f95d", "value": "6144:j79BtZp47BLz6eYD2ceEnFtcOD+8Jfa4ZrndVNc5YmyROqY:j7hwP6FDDeEnLFaarnPNc5Ymywb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774615250, "uuid": "738d614d-6b34-4df9-89a7-1db941bf66de", "value": 367226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774615250, "uuid": "6d59a61d-9afe-4ccc-81c0-df2110663bcc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774615250, "uuid": "22dd287d-df03-4824-80b6-307430fdb91b", "value": "aF3O7bWqZ6Au3nkn.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b50244-2a13-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774639929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774639929, "uuid": "71d7a181-85ad-45c9-afb6-0922f6b9516f", "comment": "Malware payload", "value": "2ff5813dc9f90d39fa2a02c73a4c9db7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774639929, "uuid": "50902e41-0149-460f-96a0-06ddcccca82c", "comment": "Malware payload", "value": "8951eb5057d54add058dab63838030155854519caae4b3b7ff5269e160f0e75f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774639929, "uuid": "9336509d-bb41-4399-966c-9bbe86ca8d71", "comment": "Malware payload", "value": "6a1153e784117f35eebe6c80569adfdce794aae0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774639929, "uuid": "e97e4cd0-7e3b-4998-bb4b-9a0148bfe3f7", "comment": "Malware payload", "value": "e194a79a9733ace0e782bc4463b1b284660c60f4a35a1d3e1d115eea3a7ff3f725af2345511e90285ed4268017c4ee57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774639929, "uuid": "5338bc00-d3fb-4692-9863-1a2126aa8046", "value": "T194143A5533EC0A14F6BFCA366CB021504AB6B86BAD25D79D1CCA64DC2E327C1DA10B77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774639929, "uuid": "7b6559ce-381d-4b55-8968-195c7193b00f", "value": "3072:ThXoQM7JPlzdEdZtfkMbHSW5/lNirKn7rUrnL6Yz:CQMtPUfPH7irKfmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774639929, "uuid": "7cd683d9-5b40-4a15-aadc-1fd836b7bfd1", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774639929, "uuid": "fdc61053-2965-40fb-8647-935987637914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774639929, "uuid": "8cdcbfd4-a0cc-44cd-a4a0-45733be9c11d", "value": "SecuriteInfo.com.Win64.MalwareX-gen.73186966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0047be31-2a21-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774645665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645665, "uuid": "0408157c-a57f-4e0f-b98c-f21bca72d826", "comment": "Malware payload (Vidar)", "value": "8f622c1c36d4b90bdb6d0949a4f92ce8", "object_relation": "md5", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "not-Vidar", "colour": "#F5203B", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645665, "uuid": "f0a9a4de-5971-41b9-a5e7-39ca18ecbaa2", "comment": "Malware payload (Vidar)", "value": "8a094a17335433c16502a1e9d650dea5bd8eb8e56c7fae884b0f0302dccba482", "object_relation": "sha256", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "not-Vidar", "colour": "#F5203B", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645665, "uuid": "3e74dcb0-213a-4983-9b77-433aa8fe4234", "comment": "Malware payload (Vidar)", "value": "9b03b73307eac66b7edb3cd019e511b8aebd3bb7", "object_relation": "sha1", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "not-Vidar", "colour": "#F5203B", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645665, "uuid": "371f9081-3f8a-4664-b19d-504afa98da43", "comment": "Malware payload (Vidar)", "value": "a8d83b887e4fffaa54fa4ad98145072d83df9aa4355dadaefd981e44b9508a11e52686a333565a627a0ea48d76557dbd", "object_relation": "sha3-384", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "not-Vidar", "colour": "#F5203B", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645665, "uuid": "27d822c1-2e96-4368-a806-02555121204f", "value": "T1EE857D176C9644F6D06AA3328CB62291BBB4B8190F3233D72E90B7392F767E45C75748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645665, "uuid": "37ede75c-4b4b-4ee2-a833-3bc03b306c59", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645665, "uuid": "96be0f1e-98a8-4957-b51d-189fc7c33c48", "value": "24576:9scqYaLp3M4RLVu9/wMWu6FOkwnjz3C5N12DeleNK84HTwB3xhh:9sNJL24P6CuIOkIOjdzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774645665, "uuid": "7c9c3da8-2f4a-44e8-935a-1d241c4f6aea", "value": 1806488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774645665, "uuid": "ded0c79a-90d1-45c9-b67f-282acd03021a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645665, "uuid": "dac3d82f-55a5-4583-a19d-d8a319efba8c", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce03675-2978-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1774573235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573235, "uuid": "e8083dac-ee65-4b45-93c0-1ed31fd3d391", "comment": "Malware payload (Amadey)", "value": "a7a6e9ed4e00cb3c448ba965c4055cbd", "object_relation": "md5", "Tag": [ { "name": "1456c6", "colour": "#043707", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573235, "uuid": "06a4560e-6d41-4b69-92ed-584ce945dabb", "comment": "Malware payload (Amadey)", "value": "8a65397ead6fe14c3bf0cbb52cce78e6e89827384fe303dc580f2721c99dd605", "object_relation": "sha256", "Tag": [ { "name": "1456c6", "colour": "#043707", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573235, "uuid": "83170775-fc0e-40e6-be6c-c8db0d179407", "comment": "Malware payload (Amadey)", "value": "b35b5927f27b94b89062f568f2cebc2206437774", "object_relation": "sha1", "Tag": [ { "name": "1456c6", "colour": "#043707", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573235, "uuid": "0bed3d1a-3beb-4afa-8561-ed382a014eb9", "comment": "Malware payload (Amadey)", "value": "f59a7b328c8989497fdead3cf8839b9f0a9098fc0eb81fe90d658a19a070d15e4016ac8ba4898e0d9882b8218f38aa44", "object_relation": "sha3-384", "Tag": [ { "name": "1456c6", "colour": "#043707", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573235, "uuid": "ff6a7aed-cd55-40a3-97c2-13707875aea7", "value": "T184358E06FA52D0B1D8D420B111B6BBF2597C6539A72445DBABC01FB69D201F33E36B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573235, "uuid": "7e035bc0-e26c-4ab2-ab5e-30a0e045c26e", "value": "aca6f08ee5befa37be16bac4bc315573", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573235, "uuid": "d6d2df58-5fa5-4a5c-91cb-67ec693ff410", "value": "24576:tf5xDRatdGrWrz4x8/cvmGwDM1H2BPdEnunN1ljhzgPnvzJnRVIjo:tf5xVaU24WGmhkXzFUjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774573235, "uuid": "28f96eee-736d-4c8a-953a-956fe7aa6709", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774573235, "uuid": "78f29aaa-19d6-498a-bba5-15021989eaec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573235, "uuid": "da19cd17-6c53-49bf-bde2-ab9a069a0bde", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8ef1e5-2a20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774645494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645494, "uuid": "791102eb-aa64-4293-b7c6-b85983e7eda9", "comment": "Malware payload", "value": "f9f36a443e94b4226f96b72a6b34c607", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645494, "uuid": "6c3ffd96-84bb-4616-a9c6-f39509a2038a", "comment": "Malware payload", "value": "8aa78ae6cd7d52921f44be77813c401a675cfa8b941f3c3368a57edfc03669d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645494, "uuid": "01eb5ade-a9bc-4c6c-8bbd-3be085e10b10", "comment": "Malware payload", "value": "5fe96edb9a9f3375cf10b15618197ce6a96f5cf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645494, "uuid": "5ff44e35-2f20-41af-843c-c71bb20ed253", "comment": "Malware payload", "value": "e3cc503cdb7da1d723d2aa3e6603ae691c3628e9682e64aa0d6c6c6f2aa69137aadd5f11427bd4bd963ac4205e7631ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645494, "uuid": "38de1c02-921b-4361-8d59-c7d401a54c4b", "value": "T19EF633E629D580DDDE78907F63B1A38E0A36D0FBD010E4B65325E2BEACBB57121419CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645494, "uuid": "36d2a79f-10c1-41d3-8156-5f0b12f6a7c1", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645494, "uuid": "cbec7d9b-1dc5-48ae-b1b8-4f60cf05b6a9", "value": "393216:UaYhKLTo61jUX5z+66/3q65gTH8z8v5Y7tE0F4wRzJfVKSggp7o75R:RzjEKj3qlTc4e4wznxho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774645494, "uuid": "261b4166-e199-43db-ba47-89249ea8ea94", "value": 16704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774645494, "uuid": "ee3bec49-4630-4f92-8a18-35a7f6d6fc43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645494, "uuid": "30dc8fbc-ed24-478a-9078-01611de6364e", "value": "Installer_v2103_x64_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4ff27b-2973-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774571008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571008, "uuid": "c5e6439d-1630-4ebd-a7e3-8b9bdb60c80d", "comment": "Malware payload (SalatStealer)", "value": "bfc8f1c251a59aa9f27566be88ea622a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571008, "uuid": "c178c6ed-04ad-4cf9-b45e-0094543e1216", "comment": "Malware payload (SalatStealer)", "value": "8aa91d328bad554d4caeb619999c0896418a3e7f9d6207bb29a4fae67f29d59d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571008, "uuid": "d56f3a5d-3898-4e66-a31d-224930706e4e", "comment": "Malware payload (SalatStealer)", "value": "ca51fba11eae4cf5a8c9712488aa0423425ace69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571008, "uuid": "33456e7d-a953-46f0-9647-287cb8af0290", "comment": "Malware payload (SalatStealer)", "value": "c2343fcbff0aba29ce9d78b33d944fe0c1f0f64ed5522e309b966df341db1613bc66f3a9a0ecb90362c8fbe3785488d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774571008, "uuid": "4641ba75-9e08-478d-98dc-78b98013a118", "value": "T1E8C65B11FACB54F5E9035831406BB27F23315D048B28CBDBEB583F6AF87B6A1196A705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774571008, "uuid": "0b70caae-dd40-4297-b6ce-9f05d6d438f1", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774571008, "uuid": "d1f421a5-ecd0-4d2a-9e80-aafb2de294f5", "value": "98304:VtojSBs3TreeWM9Sisy6PaHUUdn4Ac3HX+6E9OO/:/smeWM9Iy+ronOe9OO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774571008, "uuid": "65c9141c-fc38-480d-8e1a-26bc66d3a715", "value": 12571648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774571008, "uuid": "4981849a-0837-4c1d-8f94-4c7238ef9843", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774571008, "uuid": "66bce66e-d52c-4c8a-90c4-1e2974d64717", "value": "sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb6c420-2a32-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774653012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774653012, "uuid": "a9b36c23-12b2-4a73-ac2e-40aeca5cf591", "comment": "Malware payload (njrat)", "value": "0bac2a7b8f614c43e06ac2b7d9accf96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774653012, "uuid": "6e957bf1-f3cd-457f-8111-2ed306961c1c", "comment": "Malware payload (njrat)", "value": "8b0b8156435c167e2563d3ed2266c1b36fcd868c9d5403f4cbc5e510aede68c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774653012, "uuid": "3f133130-0b03-43fb-8d4d-4c61ca871807", "comment": "Malware payload (njrat)", "value": "64fcc6b82473462b73b2bdf3d25adfa77730f86f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774653012, "uuid": "0007c98d-09d3-4812-a927-65f7d7f6ad14", "comment": "Malware payload (njrat)", "value": "a1b46d6d0ae871083cc15b5973d860f15dc54fadff6bf5fdb1f6d99057dc4375df23cbd632b4616370150ddd9039aff7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774653012, "uuid": "735153eb-b5fe-4fe0-b007-ffd604a0da3e", "value": "T1A9A5689D9750FAD3CC1A2237DC96F45A2A0B35F650F2E2D32DA83A4BD51E633D812076", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774653012, "uuid": "7f4eedf6-7fed-4c62-bf06-11cc8dd740ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774653012, "uuid": "6f7b947f-4ba2-4982-b364-950921d46fc8", "value": "49152:+vebUNi1inAxKmP7NyHwVm0qSOgMuf7QWhXjI+j:OeINi1FjN4Qm0qSB9T7BIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774653012, "uuid": "45309f2a-0bc1-46eb-87e1-4b12073d88b7", "value": 2254848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774653012, "uuid": "476e1e53-4514-4f67-b931-e45f5a9e5097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774653012, "uuid": "1c92200f-6b33-4415-ba44-7a2d86fed667", "value": "0bac2a7b8f614c43e06ac2b7d9accf96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d941a7a-2a1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774643164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774643164, "uuid": "244346fb-58fe-47ef-8cc4-9969936eb303", "comment": "Malware payload", "value": "61cd1fdcc2a15661c4bc9cdf393ba983", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774643164, "uuid": "cd1288f4-66a9-42a0-8df3-417035b56571", "comment": "Malware payload", "value": "8ba3cdae7119c553fddab87cef42c88a6120e3f1fad6a70258225e5fcb074240", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774643164, "uuid": "ffc51b75-cdef-4910-9f05-8ef73e825c66", "comment": "Malware payload", "value": "4c28c69f0da3f34daeb386e2ae5be7088ef70ed2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774643164, "uuid": "38116413-3840-459d-a12f-4946a7979c99", "comment": "Malware payload", "value": "4a9e2f3b21ea67b78b25005c0c94667eeb78125d8541458b8c42c81fd6a11c53d2392b827b913cc828f009ca7c7e2f87", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774643164, "uuid": "ee853569-1b97-4afb-87f0-863574a44a90", "value": "T1A2664A47ECA155E9C0AAE1328A629153BB717C481B3123D73B90F3386F76BD06EB9750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774643164, "uuid": "10e1783e-2cf3-4253-bf66-bd1937acc198", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774643164, "uuid": "ffc25779-2abc-450f-b666-9904a6ea12d5", "value": "49152:ecj/wi05/xmn9y1fkSNg1gXFPk5J1ADqDx0A8gyXXorZ130Lskl1k0nVZmzKr7qD:ea/w0TmSAGDx0JGAjmWtbpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774643164, "uuid": "e1c3aa97-2cda-4bfb-bf04-ad4ea693be80", "value": 7008768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774643164, "uuid": "bbc03990-1d61-48a0-968f-995d2d0b59e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774643164, "uuid": "37a790ae-08e8-4f4c-895c-4258f02a916f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30aae0ec-2974-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774571443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571443, "uuid": "e3e35e87-3c59-4d05-bff0-d39fa0ba5259", "comment": "Malware payload", "value": "106e1d016976afe2b2944500f06d16ec", "object_relation": "md5", "Tag": [ { "name": "britanicauniversidad-com", "colour": "#7FFAEB", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571443, "uuid": "921c75d8-25f0-4968-bc87-e8eb46044136", "comment": "Malware payload", "value": "8ca8dc699f55f614b8aa1e6bf6d74d83f17ce6125ea88f6db74ed0064d9147a3", "object_relation": "sha256", "Tag": [ { "name": "britanicauniversidad-com", "colour": "#7FFAEB", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571443, "uuid": "44554b66-c48f-4920-8d97-0ed5a51029b0", "comment": "Malware payload", "value": "f6cc4e079dac883e6aa3b38160be605bc6c2c57a", "object_relation": "sha1", "Tag": [ { "name": "britanicauniversidad-com", "colour": "#7FFAEB", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571443, "uuid": "4c2bb184-af36-4336-b129-d6fb2c102d1d", "comment": "Malware payload", "value": "7da4afd8284ecd4138f13d8a4b6d4d6fe4a7ab885c68620f0094234a0d143f57b79cc561c719816d74630112b7590e17", "object_relation": "sha3-384", "Tag": [ { "name": "britanicauniversidad-com", "colour": "#7FFAEB", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774571443, "uuid": "ad48b7e2-0035-4e1f-9cd8-caa545ea4405", "value": "T1DC25D02176DAC937C86E05B0352AFBAA552D7D704BF2C0EB13C86D1E1DB29C14336E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774571443, "uuid": "6c7e7918-3905-4aa7-9342-315f7c75b99d", "value": "24576:Ik5YiB3dxGSf9VtaN2AUrnwK1rcpFu0FRz:Ik5YiDxGSFVtaN2AKnj1rcmuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774571443, "uuid": "d9183010-a8e1-4015-ba3a-0f3a7a987989", "value": 997376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774571443, "uuid": "9b03fdd9-ed93-4e3a-a9dd-eef05cbc36d3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774571443, "uuid": "e02c45f7-becc-4919-b296-a5fc73553d92", "value": "094572764PDF.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be8198cc-29d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774612054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612054, "uuid": "85caac6d-e50f-4248-8aaa-a9cb7b9885d9", "comment": "Malware payload (Mirai)", "value": "de84395b22923e682faa4732ff0b0589", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612054, "uuid": "59ee3c4d-115d-4e6e-b3a5-916d9c58f152", "comment": "Malware payload (Mirai)", "value": "8d90473c4c638353d51befdc156eb681748cb9aef041593de934055a12d4dec6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612054, "uuid": "8104ec74-49eb-43a6-83dd-7e0874be7beb", "comment": "Malware payload (Mirai)", "value": "e69df0a7c2e30cebd88dd30cfb46d320e769dae3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612054, "uuid": "281885b9-ceb1-45cc-9d29-5109cb655da0", "comment": "Malware payload (Mirai)", "value": "79528e69e8d23206e8198ee58c849e1cee030a0af8dae45568b4831eeda730f2d2558997a47d1dfb924d6df0e9baa55e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612054, "uuid": "0c7edab6-75a0-4288-b214-06bb10dff5f0", "value": "T1D7D36CC4E64FD0F6E91211352176B7269A72FD3A113EDE83C3A89B62AC939C0D61735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612054, "uuid": "1316fe57-33f7-4cfd-8394-c21b905a95de", "value": "3072:SS3mvDmaFrp0nvT6jr9abt5O0Ju/LmDt:V3mbmaIhykCLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612054, "uuid": "6345c414-30a4-41ed-af96-e49cee8e710e", "value": 141676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612054, "uuid": "9838d4ab-5de7-44fb-99af-32bdd4e405a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612054, "uuid": "8580bcd3-743e-4543-8a79-ab16544e4fe8", "value": "kurayami.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde6e4fc-29d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774612053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612053, "uuid": "bfa2bff3-25fa-4a4c-a533-51e69b948a3d", "comment": "Malware payload (Mirai)", "value": "9681bd770b3d2903163e9ad5b9d135a5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612053, "uuid": "edb67ada-0a77-4cff-8921-b3fe28497509", "comment": "Malware payload (Mirai)", "value": "8e69175aa1cafcefd0e78fdb0f3b8d49cf9354803bf51e14b3c5e95d2f46d545", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612053, "uuid": "91203dd4-3be1-4471-b551-a5bd9a1b6600", "comment": "Malware payload (Mirai)", "value": "425bb2ce2902f4f41f7252ec91d75f1b32cec30b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612053, "uuid": "9aaa287f-8a58-4457-987c-c94dbb57f251", "comment": "Malware payload (Mirai)", "value": "df374745766d63c2f4ebd660a823b30f172e67cf9169a5b5757760666c64ffb8002d7316341da17653423e48e38fc13d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612053, "uuid": "eb4bc3a1-0f87-47c3-a485-71bbdf1ae0ca", "value": "T1B6736CC9E983C4F6EC130A350136BB379AB3E53E2169DB83C3A9A525DC125C2DA1735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612053, "uuid": "a1f8e0ba-32ec-42f8-8290-1d43a854f6d0", "value": "1536:Dbsv6XewvASsos1LNxVZW9Z3J8h3qaccSXY:DbsiJRsokLNx+9zs3mY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612053, "uuid": "9686f80e-240e-4d64-9bfd-af737335a08d", "value": 79444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612053, "uuid": "ff17e6f0-4b88-48a2-ba5c-37af98fc4284", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612053, "uuid": "3d6dfe43-883f-4070-acc5-660ebf186c3d", "value": "windy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2cf5f1c-29fb-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1774629724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629724, "uuid": "1eaf72d0-6764-4fa8-aec8-a61f3fc46619", "comment": "Malware payload (NirCmd)", "value": "b0d240fd70474ed44d56d7ccdfb2a52a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629724, "uuid": "3c7e3b64-2ec2-4f7b-8be5-9dae03b42628", "comment": "Malware payload (NirCmd)", "value": "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629724, "uuid": "61fb847c-0730-4e2f-af7e-3d7919b912b3", "comment": "Malware payload (NirCmd)", "value": "7057f0b32fcb8ada4e6f3d83016650e677d09dca", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629724, "uuid": "58b2f317-6f07-4715-b29c-ee86f85793fc", "comment": "Malware payload (NirCmd)", "value": "0519c0074f8d906102a2467a1f2b0f5a596f994a751eafd143aa7436aefd454d8338ec289e81cdcbd2f64ce13947e4b9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629724, "uuid": "83d90211-a668-4480-86cb-f31845221db5", "value": "T1E1A52342F8C485F3C4511C331F65A7616A7DBE202F268EDBA3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629724, "uuid": "07683c11-812f-445e-8bd2-d34e435d0615", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629724, "uuid": "ebbdd444-bcec-46b4-b061-7c90fa3813ee", "value": "49152:ABRLTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:aJTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774629724, "uuid": "01fe569b-9171-4f7c-92c4-f4b59c4c16be", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774629724, "uuid": "5cbd2889-e1c6-4a37-b5dc-2446986f4b62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629724, "uuid": "4d160089-435b-4da6-863e-f65b1b412b32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3394ddf9-29d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774612250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612250, "uuid": "ed22fd2d-aa3f-46d9-89e3-f2cde401f363", "comment": "Malware payload", "value": "c3da48b186058d5dea8c1d6bd5c70060", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612250, "uuid": "13ee1418-f18e-40a6-970b-746789a4efa0", "comment": "Malware payload", "value": "8ea3c693f6edc50719b565dc8e24d94fef688196b2dd527e9f58cf2ea5fc0f72", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612250, "uuid": "c19806e7-8f0c-44c0-8fe8-4b82ea09e704", "comment": "Malware payload", "value": "ca1d6c4808c1821bb26d8c4d7967207a69effc80", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612250, "uuid": "23145287-4d6a-4706-b3a7-a9c3a2e26e41", "comment": "Malware payload", "value": "88053615843035853deac92c83b198f1025eb15518d808bb98389e6fc3208ac678cb46a9c64227fbfc1e0a56ae28857b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612250, "uuid": "7d7c68fe-416c-4751-aab3-5e20d176e08e", "value": "T11F64E7B0A278617E011B56C6F630E718E36BE31BF75944E0B97F92B497D3C84EA83158", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612250, "uuid": "3f92c08f-9815-46dd-8e26-3af8ee571813", "value": "6144:Ajiy0B4IMdW0VxkHMAfarZ1OF4Hwk29QmfmJARqbLmQtGMZJT3CqbMrhryf65NRz:wiy0B4IMdW0VxkHMAfarZ1OF4Hwk29QA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612250, "uuid": "f4eab23a-b855-44a7-93e8-1d18b833d781", "value": 325198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612250, "uuid": "dbc0d5c4-ec47-4756-bfb8-87285467ebb0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612250, "uuid": "52d340af-4e8e-49e5-bc95-fe787cac09e3", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6225b1-29fc-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774630117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774630117, "uuid": "8670a86a-7f27-458f-943c-8752c7a23266", "comment": "Malware payload (AsyncRAT)", "value": "f1079322137285e950eac09854b6cc5e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774630117, "uuid": "c83a4f19-1a0b-4137-85a1-a239035c50cc", "comment": "Malware payload (AsyncRAT)", "value": "8fa6bba21b169744df5fbc82d2e078011b758fe2d2f233afc785c5a38b7288c9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774630117, "uuid": "1ecc38f9-e47f-4877-b194-82ad2c87b81b", "comment": "Malware payload (AsyncRAT)", "value": "ed8f09c54b2917c7f0ca2ac94d64aca6eb1c0a63", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774630117, "uuid": "f4ddae82-fd9f-4053-ac6d-4feb342fba75", "comment": "Malware payload (AsyncRAT)", "value": "89ba8c2f021b2723282fd270b93dda36c4f671b5a9f882e5256716282e6c7978a026c0fcfdc0b565b704efc1745323f7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774630117, "uuid": "5dca0c72-25d1-460c-b8d2-5febb1410c88", "value": "T123738D1837E58925D0FFAFB059F23223C739F5535813E22F14D952DA1A23AC88E917E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774630117, "uuid": "69e91ce4-2c31-42ea-9655-8acf3e26650f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774630117, "uuid": "47554a67-c51b-470d-8aa6-cb7bad701fa8", "value": "1536:HTM7XyirJfpDc+e5+bDw74GOiY8/760gOktoeHSg:HA75fFcF5+bDwrJUOkmen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774630117, "uuid": "a4cd7e8d-60a8-456c-8997-bae1fdb9aefe", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774630117, "uuid": "2786e063-07c4-4571-a896-d455d7b1e10a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774630117, "uuid": "d56a1c21-bb94-4e45-9572-528513992d15", "value": "Runtime Broker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c95a00-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774625119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625119, "uuid": "7ee714c0-f895-4713-bf89-f4442030e5e4", "comment": "Malware payload (Mirai)", "value": "cd68b4867b1eb0e469940e58744f4e6c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625119, "uuid": "a0f149d2-8bbf-41d5-9c08-5a91e5b190ce", "comment": "Malware payload (Mirai)", "value": "9072d9bcce1cc389eec8bc7ada21f80dd06f6df7af6e4d973e473120072777db", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625119, "uuid": "52792051-7467-4bef-88a3-891b51ccec5c", "comment": "Malware payload (Mirai)", "value": "3c572afc8301d0e184363f20e3ff48bf8ac35fc6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625119, "uuid": "17633397-76a4-4cde-9139-9417b2a0ab79", "comment": "Malware payload (Mirai)", "value": "fba5c57bb25af7edfe5fa3b8732f0782ed587de27667462c2a2756f59475f9d5612fc6a549f15e9feb948bdfed37914b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625119, "uuid": "ace65fce-d5d5-4a7b-8182-4739b1270a6a", "value": "T182B2D03C2B111B58DE1EC1BE439D0B513CB81B259182AD4A6207FD97AF968747453AE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625119, "uuid": "1f60ff4a-8dc6-46f9-9a3d-15fdde669c33", "value": "384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiHoemdzJgGlzDpH7uNj1Jq:neD8ZSWvZHZbs1row697qohQvg9Ieiz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625119, "uuid": "89ba9958-4213-4db9-886b-2743d23c30ee", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625119, "uuid": "07020e39-594c-49e1-a1fe-7665c016ea0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625119, "uuid": "cb0ac7c3-21d4-4242-9644-4f400e7c136f", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "489c1569-2a03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774632901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774632901, "uuid": "109425bc-70f6-49b7-8e6b-1b2f6d2974ca", "comment": "Malware payload", "value": "7e15f29e9f702f6e2f1860e255727c10", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774632901, "uuid": "17d13570-0a64-44a2-b29b-6827bf2470c8", "comment": "Malware payload", "value": "9189499c98ba9a90ecebfb73b559d6bd44009fb7c58ed53f1a103a5b6e51a3f4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774632901, "uuid": "96ce5c4e-8907-4240-ae50-a7396a4c8add", "comment": "Malware payload", "value": "4f3b31f40818b895f58b2ca39d2cd8c8794c1768", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774632901, "uuid": "c8164fcb-4439-448e-bbca-d6eb80e091a5", "comment": "Malware payload", "value": "0f151fccdfbe8092310ae1cba4b7617a089d51dc2a5f018e8b226d37df35b22864bac248d5cc398a50dc3bcee758bce0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774632901, "uuid": "891e6daa-a456-43f2-8221-090a87f9d14a", "value": "T1702180CD2010B3E976348F5C7909E5B829C88AC2611392A41C0E397EE2A5E10BE27F39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774632901, "uuid": "4352625d-101b-4e4b-af6d-13ef8a72c574", "value": "12:KQcUH99QuUDW8NIxQzMxvAW+QuKxBHBQ/FY0KAfkQ6WpQH5AQYSf9QOUcijxxQ93:KWr8NIx2PnK9LlIhy2LBovvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774632901, "uuid": "1f222ba8-e126-4e38-8eb3-10ca3444cd9a", "value": 1153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774632901, "uuid": "aa340b5c-2ae5-4101-be67-ad6029d65b39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774632901, "uuid": "f39e06fd-dcb7-484f-8dd5-909f25759bdc", "value": "flameblox_c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23cefcef-29d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774612224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612224, "uuid": "b9b96026-9a84-430a-a83f-0dc2f6288a1c", "comment": "Malware payload", "value": "9773514ce18108dec8fdc1536de48d12", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612224, "uuid": "6ccd5175-c5e3-4795-b60f-b4b3882b53af", "comment": "Malware payload", "value": "91b7354f8565c63762d33e823ac1b66eb2b8db13143024d73e123e3ba35dc924", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612224, "uuid": "ba88eea4-eaef-47f0-b92a-acb15d580848", "comment": "Malware payload", "value": "275382800c25b9b178d5af8daa102537e8dba5c5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612224, "uuid": "661a627b-1867-45a0-9f87-85746237b56f", "comment": "Malware payload", "value": "ef83ce317372d590bfd70b3f342f3aa4006f447a2d8fd52e9b3ea4da3d4eb02a2c087ba2085e87c5edf2891861c22d8e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612224, "uuid": "be8ee270-b673-4f31-9e1e-59e2b8fca531", "value": "T1C521848211558E37FF08AD1779A54E0C34D06AF09891FE4E94F622E2F95EEE4B902E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612224, "uuid": "0fce3648-1dfe-4193-9db4-2138fc9d8702", "value": "12:JCku6r7tuFtn+U6r7tcIFtcVcXt2U6r7thiFthjJq:Iv6r3U6riruXt2U6rX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612224, "uuid": "8e8ea5d6-4555-454e-9db4-51343a046f3e", "value": 1161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612224, "uuid": "2f8e978f-a7be-4f53-8df4-1d795185b86c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612224, "uuid": "df907e2a-8704-4d96-9f4f-fb87dc4258dd", "value": "lol.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb59df8c-29ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774624182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624182, "uuid": "74bdee19-fa28-487e-b392-5b2cced5e2e6", "comment": "Malware payload", "value": "0ea451f773cc85c68410533195d78b44", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624182, "uuid": "658d00f2-b990-45dd-a856-1e1a56e52efa", "comment": "Malware payload", "value": "929cf7a15968a4e38eccb852a72874d58c3962f52dcac97cc69b5a6aa113c2d4", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624182, "uuid": "a50bf4bb-2825-4d1a-812f-5fac40942e95", "comment": "Malware payload", "value": "4b9e677b82e72c036462f21d1bdba662992f2adb", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624182, "uuid": "4672ba1d-a629-4abf-aa01-79973439569e", "comment": "Malware payload", "value": "1e0c3892b8d7dbe1aa22a804b4f6553b63b0430e8d902a5a7c369102570c1633f4f61f2a4064d0a479cb240b7b293dfd", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624182, "uuid": "c1d35112-0e5b-456d-89dc-e3ed19bf9b84", "value": "T1C2540858FA0341B4E12397B6499ED7F7C62475058132AB7BFF4FCA05B8B33262C5528A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624182, "uuid": "07488087-c1fd-427b-a8c9-81610b2b44c5", "value": "6b55314660347d68f29ca3350662de7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624182, "uuid": "9a0963d7-c040-4aad-a7a9-90be7ae4f831", "value": "6144:mgT+nqLP+L8nPrxxlYAqgmcCYVB/FH3q6BGcUti/exA:PK8PtYAqgmcCYV18EpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774624182, "uuid": "dbcebdd5-fcf1-4c70-94f7-e2d1f4d09a93", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774624182, "uuid": "2b57d172-ccdc-4020-a8eb-76ed803fe00e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624182, "uuid": "f4b80e9c-373f-4ad1-b16d-e7811750ff9a", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9e7d9f-29e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774618659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774618659, "uuid": "a55aa152-29ce-4079-8bf4-901f74ed4f67", "comment": "Malware payload (Mirai)", "value": "34dc27d69ef10a9bf98f467359aa597c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774618659, "uuid": "62ef26cc-038f-463a-981b-3f19614b8883", "comment": "Malware payload (Mirai)", "value": "931939846e8391bba367e3eb16f1889b0ff8d428fa7a8a8b5d32ab01d7872203", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774618659, "uuid": "9c8d9d50-0acb-4886-b4c3-86ade68c063f", "comment": "Malware payload (Mirai)", "value": "d8e391a1b9f1699a1e8f7c5da14fc6526ca00c2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774618659, "uuid": "7a98add3-6e38-4b45-8c24-ccab30cc0885", "comment": "Malware payload (Mirai)", "value": "c491924a899a2ecce7a4deda6aeee66793424944970baf9f9d03508dc96463808efa3ea7eff88b82858788e6ab38f812", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774618659, "uuid": "36951113-b173-4ede-b24a-46f3ba8e84e5", "value": "T1CE13F2F7D753B8AAF82335B630026B80DE785426AA47172F049172EECD7999B3E144F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774618659, "uuid": "d8a9f061-6e9a-49de-9ae4-3dbdf58353fa", "value": "768:hd6Rhju90wsPHrbfNfGbhdVDFGXmmdArRQxFMqPmvhkz3UcNY0TGa/pNGXNciNkC:hdSw3sPPov8X3amFTmvhGXtLCNci4Gj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774618659, "uuid": "23301015-7aef-44be-ba1c-91e36aacb87f", "value": 44540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774618659, "uuid": "88816ead-812b-472c-b2d6-8d8be680e2be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774618659, "uuid": "02df2128-f222-422c-8306-089c4e7864a8", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63017daf-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774596438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596438, "uuid": "78bae6f2-4ff8-4ea9-95e9-3936899b5d3c", "comment": "Malware payload (Mirai)", "value": "36e613fa621ed63633a98131b7bb4611", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596438, "uuid": "97f7ba4e-5664-4138-8976-cf1a0cdbb28d", "comment": "Malware payload (Mirai)", "value": "93364a69cb1b2954bf5bef5e971b15632e67b8eeaf14c25852ec5f6224f3eb80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596438, "uuid": "999a2ccd-3ed5-455d-9ece-5d1768d2af48", "comment": "Malware payload (Mirai)", "value": "f3b18e08ff052931c61dc21bdc2f3aa70a881e30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596438, "uuid": "4d69daff-7b1c-419e-97e9-9a1488f53932", "comment": "Malware payload (Mirai)", "value": "1cf2893b010f8cb38c61aa5d8e37c91edca240b65aedcebcd40b81db4d2870598af4ec0d7266f4bc8fdd4c0e824b906e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596438, "uuid": "4af0ae0a-5562-403a-a251-0f07105e7f01", "value": "T1B1147120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596438, "uuid": "847424e4-ebfd-40ef-a141-20619b2afd28", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCR8UKG:IcY5JpMByVs9jSrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596438, "uuid": "44ad4847-1339-4d2c-a471-e4e081a6a748", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596438, "uuid": "bf502111-6d32-4f0f-b7f1-16806fab302a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596438, "uuid": "56b8d115-7ff2-4ecb-8704-3cb86ac724a7", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c6a0b7-2a26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774647925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647925, "uuid": "56b035e8-1652-4a05-af3f-d0b09a3c8955", "comment": "Malware payload", "value": "87b0897c58c5f7cc8b17bf089355ad48", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647925, "uuid": "50448787-1774-4d95-bed3-ba01515e4a41", "comment": "Malware payload", "value": "938625bd46288afb484e0178da793cceb0360328ef4d12138e55d7aac4ab6af8", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647925, "uuid": "9deb28ef-c82b-4155-b3f9-eb9368f1ba90", "comment": "Malware payload", "value": "a711adec5b37ca2d913cc6403d21a48cec6cfd7b", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647925, "uuid": "9caba902-b8e2-46c8-aa50-f51f22427894", "comment": "Malware payload", "value": "792337486454dcef3b6217c7a0c4b9b1b40862ec91d95544b86b7fba9c0df68abec4342459715fc64dda59d6c0823966", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647925, "uuid": "ebb65e58-f595-468f-983e-c42ff9c0402e", "value": "T1F3C31ECE8E5E85FDD75B206884AF9D039ACA5803181FD591FA9EE8803F35E1DB0855F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647925, "uuid": "143d90f2-853d-41a7-9e57-be10660c9989", "value": "768:LaHr0oAlixKtlunE4ARrFKoXOjUNR9TrHWYY447BwARbXGhc7HVSzXjG7alhldqL:IrgQ/rhbWc7HVSjjG7alhldast4agcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774647925, "uuid": "339b80d8-1db0-4d37-a227-7ebb0ba31474", "value": 126692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774647925, "uuid": "aa8a76e4-8c1d-40c4-8e7a-6d20f023202b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647925, "uuid": "133ab3c0-5bf3-4462-a142-2677def1612a", "value": "Dataset_Primary_v2.7.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de25d91d-2a2c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774650761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774650761, "uuid": "09dfa0d3-1e9f-471d-8d75-0a75ccc13c80", "comment": "Malware payload", "value": "a7eeead9c868d9944ed1c1f113328f32", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774650761, "uuid": "3ad5d48d-e836-4a11-8aa8-772c1363f902", "comment": "Malware payload", "value": "948c8c69fe02eda9231aebfa5c626335307058ac74a5c3c40b346179a1bfc982", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774650761, "uuid": "f0328122-f12d-416e-8228-efd20216ad60", "comment": "Malware payload", "value": "b50b3800b17ad7ad5c4483c0b6b24d1d151a9d10", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774650761, "uuid": "caf45dc7-180e-4338-beb6-dd3e32008840", "comment": "Malware payload", "value": "4f303fce7a306de193e3043fe7a2a931320bc17d2c7244d6d5ebccd7698130b491bd78e4fe5492f1ba4e53dee2c54fe8", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774650761, "uuid": "a425fdd0-eb38-45a2-936f-138869855777", "value": "T17F62CFF6093DD2B17F1472988D17B9315A338E811B02457B1B8F53CDBE98923FD92615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774650761, "uuid": "fff64114-4ec6-4758-a6d7-90e9327f2fcc", "value": "384:0Q3rNlEyn5qrbkJQXDFCN+GGKNMFZUjNBgmf9:7rNlEyngHkJQTFCN7qZUjNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774650761, "uuid": "699a2033-e0f0-4935-82d2-073beeaaf601", "value": 15117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774650761, "uuid": "1848850d-b0b8-47ac-b22a-2b7d539f6759", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774650761, "uuid": "209fc90e-fab1-4b4b-867e-2c15bc99d9d2", "value": "Orden de compra_pdf.uu.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc583ba5-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774625364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625364, "uuid": "0531399b-42ef-4f73-acba-3e8308c6223c", "comment": "Malware payload (Vidar)", "value": "1d9c8de1a6317a9f633b85b78d6e42a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625364, "uuid": "26721070-1066-4f18-b4dd-0342b613263a", "comment": "Malware payload (Vidar)", "value": "94af2ec26b6c5755bfafbcd037e768e7d398ee8c1c6828cdfd010f72a941d85f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625364, "uuid": "6603c2f4-fdfd-4e13-a975-3c5d0ee2a4cf", "comment": "Malware payload (Vidar)", "value": "7de7bcaa78399a82ae481276e0203dc53574ff95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625364, "uuid": "fb24c801-9147-43ff-95aa-30045e04a980", "comment": "Malware payload (Vidar)", "value": "189c15fc1e04ad7a49838d2ead5768758b4591febd003de6c1702351d5e1ee9bec6fc928e177840339482a4d51865589", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625364, "uuid": "c81e0992-d96d-43c9-b403-8ca870f3421b", "value": "T10EA58D0BBCA405FAD0AAA3368CB261D17770F8490B3223D32E916A793F767D06D79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625364, "uuid": "93f0c965-f330-483d-9e11-d560f791db9a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625364, "uuid": "e4dbdd0c-efe4-47ce-aba6-a2f96c6add66", "value": "49152:k0uY2W2NKdNzshXovPycoUocY1PzG3OcA:knVcveXoCRUtMQO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625364, "uuid": "b10814e7-3294-4b00-8b4c-a5a4c8742cf1", "value": 2246352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625364, "uuid": "a8f51e6e-65ed-457f-8a27-62f59323446e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625364, "uuid": "89fbbba5-4cc5-4e50-a4e8-b44d18f2c225", "value": "1d9c8de1a6317a9f633b85b78d6e42a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f730b627-2a17-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774641784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774641784, "uuid": "845302ad-cbd8-435b-8eb4-a0ea67fe90a6", "comment": "Malware payload (Mirai)", "value": "a3b6ce9ddc0e52ae8ecdd6d176d82cca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774641784, "uuid": "985520db-0367-4054-8aa3-342c494c0259", "comment": "Malware payload (Mirai)", "value": "94da95cad09a71040570af0d28e8f7a02f759e2201133f83550dce6aacec3a3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774641784, "uuid": "2a9981b4-6600-4d70-8b21-f91c20319939", "comment": "Malware payload (Mirai)", "value": "566b47b5f4a1b50a8d465d25618259a457b269c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774641784, "uuid": "66393795-73ff-4976-a5c7-8d46fd1741c8", "comment": "Malware payload (Mirai)", "value": "a0e72bcc7487678e70faf9ddd0764062a0685ca0f31643dbcddb9947944d0663d7e18ef56f92c6fab908e50ca4a1c925", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774641784, "uuid": "1db9ba0e-043e-4979-8486-8691bf109ece", "value": "T1EA731782F98B45F5D9074D3060ABF63FDA31E579407097ADEF4E9F34DA23A02911624E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774641784, "uuid": "13b72882-d0c5-4376-86f0-12ac7533bbea", "value": "1536:0/8IhWh7Iyvz7EydD3cXEq9AxPu+0v44xPuGWKL:0/VWqyb7EydD3GdqxEw4xPTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774641784, "uuid": "391b77a8-9b9d-4429-9ecb-768bac9e62ee", "value": 74512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774641784, "uuid": "cf777453-b0a8-4477-b273-7adfce3e641d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774641784, "uuid": "ddc47fb6-9925-46c8-9264-2105aa058d8d", "value": "db0fa4b8db0333367e9bda3ab68b8042.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace223ea-2a15-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1774640800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774640800, "uuid": "78c03d01-2d69-453d-82be-b623dd93c5c0", "comment": "Malware payload (NirCmd)", "value": "cf6571fa96194da2579695a2f81988ca", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774640800, "uuid": "2769496a-461a-401f-adc2-77070bece1d5", "comment": "Malware payload (NirCmd)", "value": "94f35527e1e97a38810892e78642a273430003bde6b7331364d09b505fa474c6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774640800, "uuid": "bd7e476a-091c-4e4c-b16b-521ea52833a0", "comment": "Malware payload (NirCmd)", "value": "8fa917b14d9ed1e6466dc10c3dd41a07216fb98b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774640800, "uuid": "1de7a73b-6876-42e0-aa0b-aa69163a8be7", "comment": "Malware payload (NirCmd)", "value": "e31ae162303d306abb3b423f3718453bbfa4b37e3efc2e5cd20e4c38b15e4c5743814033404398d929a283dc2e839120", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774640800, "uuid": "9451c26f-f229-447a-8a1f-5107ad44efd2", "value": "T1DCA52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774640800, "uuid": "9d3ad346-a6db-470b-9fa2-4d666b1d0b7c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774640800, "uuid": "a4310dba-5f49-427a-9515-6d8ce3960d20", "value": "49152:ABR2Tpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:aQTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774640800, "uuid": "6c98c761-623d-49bf-bf0d-6af63385385c", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774640800, "uuid": "d4d7d160-80d8-4f17-bb62-cd7eb5ea9db4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774640800, "uuid": "4bde5dca-e8f6-46e5-bdab-80b9b953d572", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6a3b02-299d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774589399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774589399, "uuid": "1281f6ef-4ade-497f-af96-aef902125cdc", "comment": "Malware payload", "value": "8892edbbf47edde8708ba46f993c9cd0", "object_relation": "md5", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774589399, "uuid": "42b7bea4-ea60-4810-bd3d-a7ca497acd3c", "comment": "Malware payload", "value": "974bf850e1f12d1642ff3c51ac07239cedfcfc1b4b046f373bb0483235cb2ed4", "object_relation": "sha256", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774589399, "uuid": "9bccef6a-e5fd-46f7-9bc5-345106e31532", "comment": "Malware payload", "value": "9da634860ad390f14ec03ea19ab14577451284af", "object_relation": "sha1", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774589399, "uuid": "5335811e-bfa4-40ff-92af-d766f2f4e21d", "comment": "Malware payload", "value": "9e034bc1f8ebac7f3e196016d850fcafba2c302316546c73baaaf1ef5e771870e400b0fd44515204d880c72e82aa1aea", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774589399, "uuid": "6cef7e1c-07f0-4f95-a54a-51e6fe95c3a2", "value": "T19904120D8FF47166B58D9E7A4309871C86BD612B4A8432F0C0FD716666CA7244B72EFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774589399, "uuid": "0d1af484-2fec-4146-a0df-01a8c1dd22bb", "value": "3072:YHGUjGMLNUYv7X2JJcc9tRsWxO/7ocLAVIYfg4K+IQ4GMEZzlm1BLha/brkj4:YHGUjGGjj2gqKArfgc5LYLhwHkj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774589399, "uuid": "8aac6204-049a-44aa-8d5f-47199c35e7c1", "value": 173582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774589399, "uuid": "d1111cd3-8428-4970-a980-492f8e8bd3d0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774589399, "uuid": "c90a36e1-846e-4a1e-8949-1cf78d5861dc", "value": "QUOTE 951063800.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90952c4d-298b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774581482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774581482, "uuid": "484d27d4-b340-4168-a981-9a0da8e24274", "comment": "Malware payload (Mirai)", "value": "3cb3a7d3209d066858af8146b73f2dec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774581482, "uuid": "f701afd4-6e1d-45ae-b978-416d6dd66474", "comment": "Malware payload (Mirai)", "value": "9809241b1c49bbf57e6b22faa3bfb902197799c8c78c843707ece3861bcde3c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774581482, "uuid": "6ee895f4-8a1e-41d7-9d64-d0576ec87ad5", "comment": "Malware payload (Mirai)", "value": "4e39f89cace57bc9d5f75019b7b4651b81b5c306", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774581482, "uuid": "cbc42fc8-4591-4c6a-8076-61627cdccac2", "comment": "Malware payload (Mirai)", "value": "593b2e45bb05671ad78744565f1c9dc681c45f99edf715a66b61da6963ea69f10620410b7bc96b7bc82ec18cfa013287", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774581482, "uuid": "09f7bff3-a837-42d9-9ef3-7a28f307fa2b", "value": "T191367DA9FE0E3C91F3DAE37C9B4AC7A1731B39A0D71390A37E42425C85A66D5C6F1814", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774581482, "uuid": "84caaaac-d4c5-4be8-a4cb-adda642d7b8d", "value": "49152:QgbIqKvmPBKsbJbkKqjwq+QXKSPIJ7yG2l:QgbIqKvaxZ4jw46zJ7n2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774581482, "uuid": "693668b9-aa0e-4359-9bb7-79b834e12813", "value": 4874888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774581482, "uuid": "68b28316-2116-412d-a779-a978b3be86d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774581482, "uuid": "dc313b35-881a-4fa2-8e41-d497ba8c94b3", "value": "wlan.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9115098b-29b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774597804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597804, "uuid": "7e0c8f08-80a6-4b13-93c1-c930f7827e3e", "comment": "Malware payload (Mirai)", "value": "98633e5bcd11151a5ae49ba87350fc78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597804, "uuid": "7e74c3bb-6a41-4111-a5f7-0c6677dbc2d7", "comment": "Malware payload (Mirai)", "value": "98c01d760ac3efcd9994fe893165baf552d7f9ab694557907690864dc263489e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597804, "uuid": "c81bead8-ca04-4af0-92b8-db42229d1423", "comment": "Malware payload (Mirai)", "value": "1cff5fda89abe403dfad516963cdc933f10b42fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597804, "uuid": "c14f47a5-c2e6-4c01-9429-7dda1f068ec5", "comment": "Malware payload (Mirai)", "value": "a3bdbce647a3d02e7cc39f006fbb04a099d886bb18801619afe7258caa61afbead342bb8d2e05cd2374807e695b70d78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597804, "uuid": "57c70a05-9a4c-4747-bf83-91cc1e2e6b1a", "value": "T1A3D31763ED269F0AC116A0F0A1B28E781B43FD2649575FFAA476EEE44143CCDB5053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597804, "uuid": "a5d5480f-be09-40c6-a975-319502fa2594", "value": "1536:Hn18puiiZXYtOICfK9ZkB76lOVzYmMhOhWUnxo8XT9qw/:V8MjZXsOIL9WnVzYvshWIxoSAw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774597804, "uuid": "affad7ad-2d0f-4686-9638-b0d5571a1a21", "value": 131084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774597804, "uuid": "45d4f938-0224-473b-af83-066fca138a6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597804, "uuid": "4272bd2d-ca41-41f7-a6d3-cbff89520dd6", "value": "illinois", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e9bd3e-29c8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774607610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774607610, "uuid": "8dfb047a-368b-4ecf-9893-75737a123b52", "comment": "Malware payload", "value": "23d6f16a6ba18b0b0fccdfdbb3f70685", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774607610, "uuid": "09c79833-29ff-4b0a-be4f-fcdd081403e7", "comment": "Malware payload", "value": "98d977340ea117ac44590e8bac646f70d6fa3970e43f12584b97665d7a45cc94", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774607610, "uuid": "3c2bff84-9d37-4422-8f86-fcd25967b79a", "comment": "Malware payload", "value": "f582021724760ed7e987b876466009946054730f", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774607610, "uuid": "218db938-9816-41dc-9dee-4f59747f48fb", "comment": "Malware payload", "value": "aae71e9dfed3052919e41e5df8daf9cb925e37f9c4096f298a4143c48febc46682bb0c82d07cd719484d4f3fb7671c50", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774607610, "uuid": "c378236c-1656-4a7f-8cc4-7e03510c6f06", "value": "T170511F2026E50734F2B69E7284FAA751C97AF851F9718A4E4440028D0812A06DE76F7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774607610, "uuid": "0baad9b2-d730-42fc-992d-10b2c6c701de", "value": "24:846jP7v0zPsglkAuR+/5+Aii3c6PtWQyKILnD1ijqdd79dQ8FSFGqBmO:8NTLKxBUic6PtWQyKILD1iWdJ9RODB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774607610, "uuid": "587a2412-7822-409b-a46a-ab3045bf45ed", "value": 2611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774607610, "uuid": "73ada9fe-952f-4362-ac6e-292fb51b264b", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774607610, "uuid": "41eefb43-05f4-48c0-9ac6-788e99c505b5", "value": "DOC_281dUR.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8444dfe-2977-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774573066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573066, "uuid": "d73edb96-739a-4b33-95dd-8db5a267332a", "comment": "Malware payload (AsyncRAT)", "value": "c6ce56a573ba165366d67dfb29f3ef44", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573066, "uuid": "0cc30ed3-cded-4990-b176-cacc91373af8", "comment": "Malware payload (AsyncRAT)", "value": "98fd9a1eb9be9ae7df389c4e47a69dcb9f1eb728badecdcc2086249339a126be", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573066, "uuid": "89d842b1-cdea-4956-919f-02a67f1956e1", "comment": "Malware payload (AsyncRAT)", "value": "a9aada958c0aa544a1ad9aa9963e0d3b671e1446", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573066, "uuid": "8bac0a7b-d534-4228-9272-aa6602bc3634", "comment": "Malware payload (AsyncRAT)", "value": "521ade95238b7338f99375509384995eb7f5210efbc7ab3072db2678fa630bd35180255e3d628a42f9c54795fcaa3aef", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573066, "uuid": "53c904ec-5435-409c-8037-9fcb7a75bc7e", "value": "T12384C060C7D43FF99BF81B3E60EC6568AB744DCA7211509AAB427EE4BEB6012037701D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573066, "uuid": "daf33595-f280-4d94-a6b2-fbdf8235ca14", "value": "6144:okvPJuPFZx5sNJ/j55eTVXw5qm7HMN1h0gPDCxgdAB2vUa6:bEzu/gNFm7H27FUqcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774573066, "uuid": "f4788491-98ee-47ae-8ef3-0f7976166cd4", "value": 389094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774573066, "uuid": "a0110134-726a-49a9-a44d-a87fe6a2d1de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573066, "uuid": "2df2c246-6b94-4d9f-8099-0a544e34e0e1", "value": "Estado de cuenta.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44fa0189-29b6-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1774599824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774599824, "uuid": "4ddb13b8-d579-41a3-92d4-d95938804bdc", "comment": "Malware payload (CountLoader)", "value": "7b54b5eb7b0d79a5ee708a0fac2df6d2", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774599824, "uuid": "10945349-efff-41a2-a403-6f2d0b1f58de", "comment": "Malware payload (CountLoader)", "value": "992d92455d35d56a2e2d1afa7f0f2642461a5ffdc5d3e582f1d87db3accd2704", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774599824, "uuid": "ceb493c8-4d7c-400d-a8de-cd824d9c0a25", "comment": "Malware payload (CountLoader)", "value": "19bfd15cf7f8f593d17de9a86aa60e82cd13bfaa", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774599824, "uuid": "b60bbfc2-ea46-4f57-86e3-c47e8bc575ef", "comment": "Malware payload (CountLoader)", "value": "b6c476f919a2bd144313346853a7b315f39832e1a5f87812feace3dbe95bd44f6f198bb8c25c97c41be7764e5be83554", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774599824, "uuid": "d6e21026-7785-43a0-8015-605dfe729a47", "value": "T111D30FC8C99E88A48B1F7438491F5C268D9DE223462EC994BBDE9F953F175B032F94D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774599824, "uuid": "b5cb61b6-76e8-42c3-b776-f202bcc5caf7", "value": "768:aMgKUokMqtoe4p/kpGRn6bS/MoSyNV6J6w6s6x6BybTs6ry8YPE8O1hOBMzS6w03:uK6JjSZFehC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774599824, "uuid": "8cf2e4d3-66b1-48a3-bd6d-8555bf0ee061", "value": 134690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774599824, "uuid": "e1b9f3a5-e70e-491a-af4b-3dd2c837a25b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774599824, "uuid": "9e7cf4e7-6e50-4a63-a7bb-fe1abc7e7846", "value": "School_Images_Clean_318.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d2fdc5-2a0d-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774637329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637329, "uuid": "18a62b2e-9865-4723-86fb-e17d1c7b1736", "comment": "Malware payload (ConnectWise)", "value": "0599927a18e5624a95a2564922891380", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637329, "uuid": "ca150b36-b399-4b2c-b8ae-c3b78cb075ec", "comment": "Malware payload (ConnectWise)", "value": "9a40b944c4c7c470a8a958e5ff86e814ba135d04b0c071b856d23f9b1108d81f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637329, "uuid": "841c04d8-795f-4d76-8ca6-f09f318c27bc", "comment": "Malware payload (ConnectWise)", "value": "74cb38f8e06b391f5f0215d6e8e80e373e2ab326", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637329, "uuid": "419bd627-e552-41cd-9245-62fc6cf49299", "comment": "Malware payload (ConnectWise)", "value": "b599918afaabfe54a7cf546af43e06d1a349fc1074625b33d928cf96d894401e3e51e1635839f49e8057a42bc54b8838", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637329, "uuid": "4ecedc67-dd58-4e7b-b8eb-15fc0bd5859e", "value": "T1DFF633102BE8A5AAF2735B38EC7B26B00579BD51CE13D02F4319B81E5531D94AAB3773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637329, "uuid": "cd149ab1-6dc8-40d7-8a85-933b0f8f4738", "value": "393216:7OvTi7hha62o3N11TOvTi7hha62rOvTi7hha626OvTi7hha62:7Ovjo371TOvjrOvj6Ovj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774637329, "uuid": "692c81cc-b34d-41de-832d-a2a10331a974", "value": 16723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774637329, "uuid": "4ae3c1d5-088a-4f5c-837f-98dd50f20ecf", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637329, "uuid": "a01c21ba-cf81-4ba5-87e3-7fc9ae9629a2", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7f9e26-2991-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1774584190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774584190, "uuid": "8f6e5237-b652-4a4e-9a34-07532ae9f045", "comment": "Malware payload (NirCmd)", "value": "22ee7b987b79751121c0122b2fdb3f4b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774584190, "uuid": "41b18845-4f13-482d-877e-8c1b0f50f623", "comment": "Malware payload (NirCmd)", "value": "9b72b99b61010507e973d13d15e4d08015a46a94b8f1fde5dd5b6279683e6081", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774584190, "uuid": "36753d84-f713-4e57-9ff2-7ae4ae54a3a2", "comment": "Malware payload (NirCmd)", "value": "071bf2f2968a5a388918de9d6229bd4c4305f750", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774584190, "uuid": "8a2f300c-8089-4a74-9748-5e539800e428", "comment": "Malware payload (NirCmd)", "value": "7d1949aed1aed6ff90b9df553f82278f954f7559871267a6f46ffe9bbc972e844fa9c14771da01b210086bce6a515e88", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774584190, "uuid": "ea185d71-4e47-42ae-a66d-3acd4cbd4782", "value": "T196A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774584190, "uuid": "eb3f3c3a-fae1-479b-aca8-fa01928f6046", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774584190, "uuid": "f70020f1-3b2e-4894-b405-0d91c2183883", "value": "49152:ABRUTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:aWTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774584190, "uuid": "d823e60f-3486-4864-b7c2-d68d83d5e737", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774584190, "uuid": "011844ab-864f-4cf4-a4b6-68c913c6fba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774584190, "uuid": "eb566957-a39f-4efb-abb1-4424dd290f8e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff421eb-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774596406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596406, "uuid": "cf70e28a-0cc8-4aae-a2e4-cb25fbb6b00f", "comment": "Malware payload (Mirai)", "value": "27cbd8a5587c3320cc150bc2e708edee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596406, "uuid": "ade8e56a-1c5b-4212-a9e0-cc1299e8724f", "comment": "Malware payload (Mirai)", "value": "9c421cd0a3044517f0846538755487b1b8ba2997864e085d55c96ff1f2fbf632", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596406, "uuid": "82e0777c-0972-4847-b32c-3ae2782bbfc8", "comment": "Malware payload (Mirai)", "value": "e147ff91fdc2445317c37908b51684b23f4983bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596406, "uuid": "2f74a2f5-abc1-4086-b081-bb888484408b", "comment": "Malware payload (Mirai)", "value": "3362dbe0cf5099d683c9d925e22fdb6aa89c9c97b57c109c1da97ae666ace5f94e31567a4194c9b4b02cfa84c1fd3053", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596406, "uuid": "a3c0f3a5-3933-4f08-98bf-cc7216d28b55", "value": "T1145302F690E87DCCD26A4730061B4E473EC667B8A095663672C4E2598BF2350CFE8BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596406, "uuid": "b549576f-7f8c-452e-81af-ec4b7434406b", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASAX+bLkg4azHH:CM5az1Fy0oPgdZX6hTo8RsaLGazHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596406, "uuid": "fdeeeb48-93be-46c2-a231-08c038579901", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596406, "uuid": "af918037-6864-41b8-8cdd-f05b0a2da32b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596406, "uuid": "a9fbe026-1cc4-4c55-9ca0-1e9bd7817d5e", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d79ff8-29b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774599199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774599199, "uuid": "a9f5db36-2062-4bc8-9d4a-24c3e2e4f3eb", "comment": "Malware payload", "value": "db0f9d2f738e2dcefa1db6b9531d11ca", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774599199, "uuid": "84475895-e984-43c9-865a-558d222f5d8b", "comment": "Malware payload", "value": "9c664dc162ce5912e4b53efdccc4499d2c0127428675569658f4182667f1716e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774599199, "uuid": "bae31ce3-225d-4485-b904-3c7f43c28ccd", "comment": "Malware payload", "value": "d2562015e2148f0079da647ae1d0fca8825909bf", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774599199, "uuid": "8061f201-c430-4153-b167-8c474268704e", "comment": "Malware payload", "value": "87b654040a1dfb66d7e3ce37f5bfe9e6df795af0fc028e587d2774f2cc867abf6283907b5832948d0f4a07818b803b2b", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774599199, "uuid": "ddceefde-9cee-4ee3-9ec3-f60a22df7024", "value": "T112A423DFC114359CAA75C4F9CF6FA27578E354564B3A060C63E67E0B8188EFC5A40AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774599199, "uuid": "33126060-685c-49fc-972c-fb21924e5d52", "value": "12288:22ObbnMTvAaft9ugpToSAvXdcqK033HVZPt/:nOX8Aafb4vXM033/t/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774599199, "uuid": "6c4bb579-30ba-410d-90c4-99c442c46e4b", "value": 472540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774599199, "uuid": "2b9aad32-5d13-40df-82f6-d64f965e6b33", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774599199, "uuid": "b0e06cd9-e442-4acb-9876-82c08f5b8248", "value": "sitecustomize.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "641c01ba-29b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774597729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597729, "uuid": "58005cd1-7385-4490-80f3-9be917447849", "comment": "Malware payload (Mirai)", "value": "d69eeecdf22b9a0aadb1ed51f99e789d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597729, "uuid": "79e0549f-a9dd-4617-b465-e4121f25f762", "comment": "Malware payload (Mirai)", "value": "9c84623c5a9b5f79023eea9b94bba6ac2a2257a15ceb7c2f5f65b8d3cdbea0ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597729, "uuid": "a8f14d0c-20ee-4160-8839-f0cc54e24b81", "comment": "Malware payload (Mirai)", "value": "8cd058ae53742b141b0871c00dc86aa1e431764c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597729, "uuid": "b1c833c5-6497-4835-904c-aa6d35890253", "comment": "Malware payload (Mirai)", "value": "d48559f04de64cfafa9b822d6428ba5e080388673fb39e15d6900ae679226c544120baceb5e232e67cd749692479354a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597729, "uuid": "5c26cc37-ae18-4666-8170-cce62fda587c", "value": "T1B5E308066B0E4F03E1532DF4277B5BE0839BBD5228F9E280751AFEC993719B25506E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597729, "uuid": "7d3b5bc8-3723-4847-b4e7-c6e8b919f6f5", "value": "1536:qoiEE512kGrrl6xi0TNYBFmGOsl/N6YG+jrZZP1ZvAr+urfmSJegl6qhD6izm:qoiZTGrrsxDN6FmwN6Qjr9Wrcnizm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774597729, "uuid": "cf2f3128-840c-4bc3-b21c-81ea5fe59080", "value": 147552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774597729, "uuid": "3269ff6b-b471-438b-8159-4fe79da87a40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597729, "uuid": "1c481c35-b468-4381-9dc0-05e6b1a82d6a", "value": "hawaii", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49afa82-299e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774589703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774589703, "uuid": "b4061532-61a5-44fc-a29a-4379dfacef99", "comment": "Malware payload", "value": "813b9dbcfa31e82d0d45bca53a246883", "object_relation": "md5", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774589703, "uuid": "15a7c08b-35ab-443d-8098-c578225ed12c", "comment": "Malware payload", "value": "9da946644e9ce2f467eb57884e6c7ba986d5dacd2e946f15464ad64897d06839", "object_relation": "sha256", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774589703, "uuid": "0f547e58-ced3-4389-b935-2fc11b85466d", "comment": "Malware payload", "value": "398fe275955962ec187983bfc38aae404b580ec3", "object_relation": "sha1", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774589703, "uuid": "19142320-e535-409a-ab02-ce9ac8807db0", "comment": "Malware payload", "value": "e2492238f61716b650024845938eac88310ea57365219bdab1865e2eeebdb8b6bf3af768e7cb67d903d3e37b4d771c20", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774589703, "uuid": "152b7252-9bf5-4e47-8016-55451114db9a", "value": "T1FA7533BCD8FB9C24C1B5D34B85A96E138CD5A824EDD87F2886B6A9D1530C0835BC2767", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774589703, "uuid": "774a2e59-ce2b-4d5a-83c8-3e7878f8b237", "value": "24576:SPkHo1kLdraRic0wOV7Mrx73m0Kia34A1mpLZiTaC+LWlxjBaedrMEiAnCn7e:BHoahraRitwQMrF3DKtoFLZCesBUJN7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774589703, "uuid": "419162fb-94f5-4eb9-b7dc-1427480d68a1", "value": 1675044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774589703, "uuid": "cad74028-b40b-4a6e-8b95-75301530db56", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774589703, "uuid": "977b8715-ec20-473f-be74-e3da5ed2e405", "value": "image.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ece1e1-2978-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774573165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573165, "uuid": "54d12732-1a49-4cf4-954c-87928f798e90", "comment": "Malware payload (AsyncRAT)", "value": "e1e562d474fb6fa1a728eb98cd903e26", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573165, "uuid": "62298736-45c7-44c5-9adc-66f4b30d326c", "comment": "Malware payload (AsyncRAT)", "value": "9ea44a571244b57d5f8ff3cf3410974247f6d15c335f3681599f401b99e3f0c0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573165, "uuid": "1afa804d-27f2-4b73-84d7-a852b2303c13", "comment": "Malware payload (AsyncRAT)", "value": "2673bfc038b9bbd9d38a91ce9dc85698fcd2f787", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573165, "uuid": "3b503226-f199-4d0f-b3a1-16a5b4a35492", "comment": "Malware payload (AsyncRAT)", "value": "471d3a2c9a0354988f9894e5d7ed0e2fd3c6e11cb9ddfbcf3b2b5fe67e854af3dbcddcdb3cc04eb3c3cf5d352fa1a082", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573165, "uuid": "439aa416-a153-4db7-b601-2c8a03771108", "value": "T162E23A4877944712DAEEAFF12DF362021271D51BE813EF6E0CE485EA2B67AC047407E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573165, "uuid": "e5eece33-9450-4838-a9df-cc186ce9978d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573165, "uuid": "d824d6a3-52f2-40c0-8e23-39acf8352052", "value": "384:iEbmX5Qa+vN1h1+X3v6JFjL+g93Tm2eaFO6pzRApkFTBLTsOZwpGd2v99Ikuispt:7Va+vNtg+PB93Tw4fpzVFE9j9OjhrbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774573165, "uuid": "5b1427ab-d81e-499f-a039-4310f97a7686", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774573165, "uuid": "12c6d8e0-1c72-44e6-beeb-8dc240b0e921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573165, "uuid": "d12998e4-ce43-46d4-af6c-1efdb6669aa9", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b944cfac-29d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774612045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612045, "uuid": "0618a6bb-f8c0-458f-b7ff-da1d28e62d9e", "comment": "Malware payload (Mirai)", "value": "528e49940cdb1030a3ff239a62bbbdc2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612045, "uuid": "2c63a51e-1c9b-4ff5-b118-669f43fb59f8", "comment": "Malware payload (Mirai)", "value": "9f43679f1f4f31aa5046478f1c688b1460882d2561dc87475f918793a0df7945", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612045, "uuid": "92717b4b-be39-4468-9bba-a3019bb90977", "comment": "Malware payload (Mirai)", "value": "3a0bcff7de9b9e1b25f35db0f2131c64531eacb0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612045, "uuid": "5492a985-c720-41f0-b63e-16b3f4be5d26", "comment": "Malware payload (Mirai)", "value": "cb3bee36533e106becbb498cf8b9f8e71502f64f6c483c1196793fb1f4c08efbc56ff3fb415c497f8186a5eed6122771", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612045, "uuid": "bd48611d-f4f8-4ee2-9fa9-1f6daa6c52ea", "value": "T171431780FCD2996EC6D4137AA73E358E33A1B3E4D1CA3613CD585B25338A68F5D66B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612045, "uuid": "e1d98ac3-af99-4422-be91-cf7b1b4dee8b", "value": "768:ncyi0+MnuAHIf/StW3GvQoyjEFMoRBN5cDqS8kTIM4cL/KIoNRit5ZMfgTBN1TWd:n3nzHI36AGYDEFMWchcMLL/Kqt5Z79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612045, "uuid": "d3e1e676-a241-4483-9864-b9d9fd6453df", "value": 55884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612045, "uuid": "8fce7acc-2e21-47cc-a27e-4f4f08f15059", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612045, "uuid": "868c7b61-c189-4d1a-bd78-d55464c2778a", "value": "windy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bde62df-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774596453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596453, "uuid": "40ece953-7496-4af1-a810-c4eedab68daf", "comment": "Malware payload (Mirai)", "value": "37946f2d1826c2cc48fb647d3793dd28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596453, "uuid": "212671a1-80be-424e-bd38-7ac13008866c", "comment": "Malware payload (Mirai)", "value": "9ff06b44763dc160eb7e4b00bcb3e13eac978bb0ee4179a4d349c5e3e936f23a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596453, "uuid": "d5835c66-8df7-484f-96db-54c7166beda3", "comment": "Malware payload (Mirai)", "value": "9b36d435b05da514e4c48bf35b8ccc226fe2aa57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596453, "uuid": "087b6c68-810d-4965-adad-cf3d248f305a", "comment": "Malware payload (Mirai)", "value": "e48250f32b6587753564b9eb480537ee3d84cdf9248973cde8b99c7648b838d9b6a75c20b73a21b29aed3c7582e20083", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596453, "uuid": "7c1a402b-a0c5-4486-83a6-b923609f48c8", "value": "T1DDB3AF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596453, "uuid": "fda46d5e-54fb-484e-b2ed-ae4855a47f9e", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHz48rSR:t3SrlGWnKTU83AQB5A5Liy36f8USR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596453, "uuid": "b20ec474-3179-4b42-a9a7-3684b18705b9", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596453, "uuid": "d36d34c8-1144-4070-98c1-cf2da7282064", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596453, "uuid": "2168a6e8-7465-45dc-99ac-9af6b89cc4a5", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912a8e8d-29b3-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1774598663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598663, "uuid": "a77e667a-b7f6-4e13-be6e-c3b170ebffec", "comment": "Malware payload (GuLoader)", "value": "117bc638988d7009c17f5f835580d83a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598663, "uuid": "986015f8-b25d-4b65-8fcb-a6105574fad4", "comment": "Malware payload (GuLoader)", "value": "a06d2f622eb4e0403f8a8198898d2ae1d26b5f897cedadcb68cc95b888dc7525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598663, "uuid": "6f8de094-29df-4923-892a-c228b8674070", "comment": "Malware payload (GuLoader)", "value": "4fcd7233a913288e83af1c4ebff7ec085634d421", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774598663, "uuid": "7f9be358-15bd-488d-9ead-45bc9200db22", "comment": "Malware payload (GuLoader)", "value": "bada6af9da454ed342d1f918650a85aaac56b53351e75bb5e73e652924629485dadb07cb8addcf5d475aa38274a18811", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774598663, "uuid": "22d3d753-0a1e-47f8-bf27-90e6e7e8a800", "value": "T185D42328EAA3F89CE95C41B13D724712D7E5AF683B2C1D471FC17BA161FE886D62C601", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774598663, "uuid": "6eaf0be8-7f32-4fe2-b21e-fd4260c2f107", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774598663, "uuid": "809dad1d-fb2d-46e2-bbe8-56139e5b113a", "value": "12288:r0yeHMloKEZaf7HrBp+WkvbBN2u4ByUVTAGZ3LUbBLGCR2pUOos7gARuS:MHGfTrBp0vdcByArJ+2pBgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774598663, "uuid": "1831e12b-6182-4321-9fb6-5de3f75c8c89", "value": 645314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774598663, "uuid": "fdf6d928-d300-4614-9556-0a3e63eaa2f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774598663, "uuid": "bf9aac4a-8d01-4366-b2f7-78d6ee43bec7", "value": "Quotation_Request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df6f13f-2a0d-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774637339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637339, "uuid": "4aaffd5c-23e7-45eb-917e-c47d3b6d48ef", "comment": "Malware payload (njrat)", "value": "45a1cfa98b57bb2eb4ca51a8b923275f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637339, "uuid": "ba56f5ea-ae2d-4f1d-92ce-2852afa113f6", "comment": "Malware payload (njrat)", "value": "a13c0c6b4eab485d6bde66f918dfc458b3f404f25affd078848f187a92d99e70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637339, "uuid": "33856d28-9186-4f22-9c3f-be1bc4880507", "comment": "Malware payload (njrat)", "value": "f73729e7a4978a5223bccf5fcbb70aeafcc6fd25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637339, "uuid": "fa752f1a-df42-43d7-b012-43500caa876a", "comment": "Malware payload (njrat)", "value": "4732e3fcac3a1f30dfa1a35767ba381701ac241778ba132c9dc24696b9a0fd820fb4c50484be5eb3413957983c5099e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637339, "uuid": "921e2aa9-7203-44b0-9ee5-04651eb6d72b", "value": "T193B34B4FF7619659CA5C4EB78C23984C03AAE1BB6A33F77B11E85DF15C224AC894F540", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637339, "uuid": "874e401c-7ae0-42ad-bb43-17c706a65df6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637339, "uuid": "076e1762-ef1a-41c0-8ddd-a399f21d6f5f", "value": "1536:AF/fgHxjxZLJFXEHellekGHnmubMRzf+i4vqwmi359efhMdsxRFsUbpSoPsr:G/fGxNDF0CAHRMVfLY35Ld8sUbpSssr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774637339, "uuid": "2a7c4a65-b5a3-49ac-8127-62b00bba90d0", "value": 107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774637339, "uuid": "83ebca03-20e5-491d-8975-7878b6d3055f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637339, "uuid": "3d60fa20-bb69-4b12-9cbc-f01a1d1cdc7e", "value": "XWormClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98ebef7-29e3-11f1-a769-42010a9c0008", "comment": "Malware payload (Kinsing)", "timestamp": 1774619400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774619400, "uuid": "b53b1318-5020-462f-88eb-bafbbc873b62", "comment": "Malware payload (Kinsing)", "value": "a47148c1bbdae60bd90794090403244a", "object_relation": "md5", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774619400, "uuid": "62cf9175-ff38-4c80-b9f3-2319e52b3355", "comment": "Malware payload (Kinsing)", "value": "a1e95e92d1b72c00837751bc45ce452dd9c034231def59d7da010a706a9c23f5", "object_relation": "sha256", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774619400, "uuid": "80600c2c-b40b-4f76-9026-73845ac3f72f", "comment": "Malware payload (Kinsing)", "value": "8a36248db97292a825557a077ed75380ae4f3e33", "object_relation": "sha1", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774619400, "uuid": "197d30e0-7c04-48de-9735-0f4740beb567", "comment": "Malware payload (Kinsing)", "value": "c75a4eea04b5f52191dada05c356cc89095bc22dc2686a1a09246f9078088b4784dc2a047f954d7ee22768d69d5e1957", "object_relation": "sha3-384", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774619400, "uuid": "40e8e032-5cbd-41a6-8398-be749d190a0d", "value": "T1C982128DB011ED742A5DC4B59CE2287D602BA00A4D623F10B45C7E786B9DA05F7B9BFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774619400, "uuid": "1459f6c2-1f0e-47cb-b5ac-dfda88575798", "value": "384:rQ+ihlH2wx2vUaQa5/eN86704s80ooJQYgykWT4yCtvUsDjdWOoJwN/:Ma7YJDj8OoJwN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774619400, "uuid": "935bd0ce-4846-4761-8a91-3bd8a96f1f82", "value": 17574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774619400, "uuid": "c4ff1010-d5ad-4562-a93f-00530d68404b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774619400, "uuid": "ada4115f-1bf8-43bf-a2e7-a9de3edc5e32", "value": "i.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92449771-29f0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774624864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624864, "uuid": "33840ad0-e955-4e02-80b8-351af1ad113f", "comment": "Malware payload (Mirai)", "value": "141a565268811fd7e75024eb4f8c3606", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624864, "uuid": "6fb331bd-212a-4b04-92dc-1c25c558383e", "comment": "Malware payload (Mirai)", "value": "a20e6b829c391c825949fd971f863ec9d654095db1e1ad5cfe2f05f7d25ee6bc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624864, "uuid": "3ab55692-23b6-499b-a0ec-01afda2ef929", "comment": "Malware payload (Mirai)", "value": "2967f990a9b1fe5b00119de2f2d730ec4608bf01", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624864, "uuid": "ca926a24-bbf7-4c8c-9070-ac6bc0e5a38f", "comment": "Malware payload (Mirai)", "value": "8ff39b97cbf318d2a9827d57752941bec4830ec63a9617517c0eb4b7559472a02efc9a333b31b3b8bdd74c0881045d2d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624864, "uuid": "0a288b52-fae1-41fa-854c-bb286eadbdd7", "value": "T170833925B87A2E27C0D4A17E11F78751F2F6370E14B4C66D7D760F8EFB24680A50A2B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624864, "uuid": "979d5857-39cd-427c-9a06-cdfd60b5c780", "value": "1536:Xc1jXVIAir0J7s7F5ujL4FqixRMTrJNMIiqDktVFhCJnC6XH5:ij+ATsxRFh+nJNMgyVFhCE6p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774624864, "uuid": "b57951c9-ed5a-4f9d-96b3-0fd831eb661d", "value": 87608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774624864, "uuid": "0850e5f0-c2f4-4344-ba18-6eb1e470e149", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624864, "uuid": "e4611ff8-1b27-44e1-9161-cc77d40ec045", "value": "nullnet_load.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5779061f-298a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774580957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774580957, "uuid": "100cf2d1-d166-4a54-bbbe-e8dc7337ea65", "comment": "Malware payload (Mirai)", "value": "0c72eadca00be18874e3cc4818939ed1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774580957, "uuid": "4a6c24f7-d63b-4a38-8a53-0b4f5ab18131", "comment": "Malware payload (Mirai)", "value": "a2e8efe502017c6c601f41717e8afeaf72914fcb81bcf923e7c7b98e37052dde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774580957, "uuid": "a86a1bee-bbc6-451f-bfd8-aca10b968e23", "comment": "Malware payload (Mirai)", "value": "8dd94a2ffa45ddbf2277845aa0f20a1fa819d925", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774580957, "uuid": "01b2cf4c-b7ff-452d-81ad-8f8d82cee742", "comment": "Malware payload (Mirai)", "value": "f6450268adbf93d2ef52125a20f3d882644ec033509a3df9f5172ba135bace87272753a7fc274850544353e1c1350663", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774580957, "uuid": "f0d7b57f-ac14-4a60-a087-355cb29127cd", "value": "T17D065A22BC90CA62CBC066BAFB5E829C73135B75D2DF71068D14473436EBD5A0E3B652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774580957, "uuid": "633bf3a1-6b62-4135-9cab-b44dd4bf1002", "value": "49152:bk0YZLKCzR7eoNWNmW3EUfKldNnUxhrqx67PhWfP+pAe3QIPgU:bk0WLKS7eoIo2zUnGqxmofEB3QRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774580957, "uuid": "051dff61-458f-4d32-ba16-389171fa673c", "value": 3999008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774580957, "uuid": "ae7d78d7-953b-4673-8b27-affb0f5732a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774580957, "uuid": "d49c6c3a-6563-449c-a0c0-b314edd019f1", "value": "wlan.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36930a8d-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774596364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596364, "uuid": "e0e1cf1f-ef48-4589-9611-c61b3e27498b", "comment": "Malware payload (Mirai)", "value": "ce7cb1a18a130ec1d51bc6e6e1c7edec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596364, "uuid": "9e4a71e6-d3cd-489f-9490-86496350718b", "comment": "Malware payload (Mirai)", "value": "a35364635b95a8aa9f4e92b09575cd0e1e5757e991f12fbf31de6d16c07a938b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596364, "uuid": "f2872530-2e34-4a5f-ab3c-3e9f2f701b5b", "comment": "Malware payload (Mirai)", "value": "ab5225e9cdb60a02331d1d8c659d52b44e11b41f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596364, "uuid": "5a91efe4-02d8-4709-811a-7c990c8728c5", "comment": "Malware payload (Mirai)", "value": "40f22b0213a056fb6d69781f39c0c3777ad2ff1e5ec24fb613b86913ae9de5da1b5cb6aea5394c250ea195ef00a96d89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596364, "uuid": "03a2d79a-2f80-49bd-ba98-1af6fe95721b", "value": "T1FA630247FBDC4F9CECD926F507AA65DB23A1A03190B341B40DE58889C1AFDB11196CCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596364, "uuid": "9ee42c78-39d4-4108-a68b-9225fb1e62e2", "value": "1536:x7MbwKNGjjH+Xq34n/q8Zu41zmX3sDgOrPU:x7Mbp2L+Xqdfoz2shrPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596364, "uuid": "9ad5fbdc-1e8b-4797-8bb4-2169596b42b7", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596364, "uuid": "376ecf28-888e-4798-90f7-7ca4e88b5b39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596364, "uuid": "7736d4a2-febb-4a61-9cbb-a2f719f85bf9", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6005725-29ea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774622428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774622428, "uuid": "0e214ba4-a416-4d99-896e-9f97e677e81c", "comment": "Malware payload", "value": "b674cbd82dae55390a25f738bc24bba0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774622428, "uuid": "c894ba79-3d81-4ba9-a43a-a73bb4da3793", "comment": "Malware payload", "value": "a4b2ce61469713616f9480b443e032cbb40279d02046890a15afcfe6ecd039b5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774622428, "uuid": "15a163b1-35b6-42b4-8619-0e1ccd82b754", "comment": "Malware payload", "value": "53d4ea75e680f2c203a12f96f352cf7f600f26fd", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774622428, "uuid": "541c514a-3bda-48ed-80cd-9191cb9237a8", "comment": "Malware payload", "value": "61da8e3e511eba81e0c2ce4a23c949a01dcb4103fb6c5fe8780bed407fb6850aa8bae87dc9b3788b756e618d91cd0e2b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774622428, "uuid": "c255315f-0d3e-408f-b1b9-b2f9981e8c78", "value": "T1CC57339AC4290BABD93DE472C9780760D5793C6ED5114E2B3938735A11BAFE022BD4BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774622428, "uuid": "ae4ee562-135f-43bb-a8d2-6d4f23e0ace0", "value": "786432:HN+MbDOqB9FJr/SmliK7k/6Iu9iZUZ17X9kMJ0:HN+F+9FN/SSVV9iZUZ1BP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774622428, "uuid": "a33d27cf-be04-475d-ad6e-65570052d197", "value": 29503488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774622428, "uuid": "3b81c23e-11a3-4873-a228-bddf0a6f3db8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774622428, "uuid": "d0b8992d-b56c-4324-8d59-ba63a3562e05", "value": "AetherixCore.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0402dca-29c1-11f1-a769-42010a9c0008", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1774604782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604782, "uuid": "20ad92d8-d38d-4c9e-b0ee-e5f3f612db9d", "comment": "Malware payload (Cobalt Strike)", "value": "cd36a6027378ebc6bf31e2f5d5a35ed7", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604782, "uuid": "fb20bff7-cbf8-4900-a394-d6f3fbb6afda", "comment": "Malware payload (Cobalt Strike)", "value": "a59cba001f2093aa44758293c6efca87110339e3c68fe25da49a986f948c16fb", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604782, "uuid": "98f61607-358a-450c-b84e-862d6a1bfd49", "comment": "Malware payload (Cobalt Strike)", "value": "bb82789e5b134079629723eff8a6b4111232bf7b", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604782, "uuid": "6800cbb8-1d2c-4dfd-8df7-92682fc2dfd5", "comment": "Malware payload (Cobalt Strike)", "value": "eb1c1159c7fcc42c440589e51fd9f13e6bb6e111eda0e0addbdec7bc45a2232326303e7e72ea12dcf9f0aa947a8f243c", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604782, "uuid": "b826607b-a492-4b8c-af4d-7e97380ee09b", "value": "T12FD5AE4393EC41E9E0769774896A4212EFB2BC291F74A6DF0344F60E1F33AD25A76712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604782, "uuid": "23af8a15-57ee-4c3d-add4-a37d06560f8c", "value": "994b14da736c8f6cdcca49337922ee88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604782, "uuid": "ceca4bff-a00a-4af8-8120-eff194b700a7", "value": "49152:D8BBAjoUsWMAHOaUQTYH62mm9IfZ769gbr2c3r4Ca0:DRRR6m6m6Kbrv3rDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774604782, "uuid": "c8be8f1c-9184-42df-bd52-7c6ceb7566ff", "value": 2964296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774604782, "uuid": "e80bc4dd-b24b-4544-841e-4c9338811c7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604782, "uuid": "0f60f805-7a1f-4d40-a125-28e5397e0c52", "value": "Procexp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435bf6fe-29ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774624302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624302, "uuid": "6b0b066d-e401-4357-87cb-f13cf7e93689", "comment": "Malware payload", "value": "cffead5749a553baa64a094b7a8ba2ab", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hzcn", "colour": "#8604DB", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624302, "uuid": "e5e34a72-462f-4722-9b74-754b2325650e", "comment": "Malware payload", "value": "a5ec2bb312181b03c770e5c670d539cad796b8e6a8004ba0cf82a92e08d6e859", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hzcn", "colour": "#8604DB", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624302, "uuid": "0a691401-5502-4d69-bb31-728310075043", "comment": "Malware payload", "value": "fcd7a43b9db9d2ed5b532ae3b840e5145f2c47c8", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hzcn", "colour": "#8604DB", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624302, "uuid": "a4c62e25-8b23-41b2-9109-df77894a3d36", "comment": "Malware payload", "value": "21611b3b64ec9fbf199fc54e1ac4808c4818efea8a49f1d67674333654c704d127bc285bcb26c7faee8def599b2b0c4b", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hzcn", "colour": "#8604DB", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624302, "uuid": "8c05d254-916d-484e-bdc5-2c710aff7464", "value": "T1F3465A43E19E52D9D039F07482E79A73F9F13C684935757F8AE036222B76B50DA2D30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624302, "uuid": "468ac8a9-667e-4f1f-86d9-96ac8ce132fd", "value": "c83727d8577f7be135511e8000b7035b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624302, "uuid": "264fde65-9d8c-4dcc-91ff-635234bd62e2", "value": "98304:cmJQu0YMRrm8oEkbODAUvcvN7MdP0WxtpE4n+:B0YMRrmikFUkv1mi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774624302, "uuid": "21a1f79d-6185-4407-a06a-0f9e852c74aa", "value": 5756416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774624302, "uuid": "a8683437-1cd8-4b19-8d36-be61ed88d154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624302, "uuid": "508a1fa4-fd81-44a6-82dd-962c6e5e290b", "value": "yb0327.docx_____.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c8d983-29b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774600518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774600518, "uuid": "d8d20abb-6346-4413-a927-ffbf2f097cb9", "comment": "Malware payload (Vidar)", "value": "8dda596bb6f578b1ce3d237bea02842f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774600518, "uuid": "31fcfe13-d0d4-4bfa-bbf6-e8c3575d6325", "comment": "Malware payload (Vidar)", "value": "a663d782603ea186deca9ce7614fb7def60e22d7d699a0f920ad77f85971a58d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774600518, "uuid": "c5cecd2c-0f74-4de4-8302-b50840751ec4", "comment": "Malware payload (Vidar)", "value": "d6a87b67633dea0abf80b4f463f72f932d83b530", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774600518, "uuid": "33d9b535-ac96-4988-90fe-ac43263fc548", "comment": "Malware payload (Vidar)", "value": "b8858c1630ba17a76f48ebd1c22726a5e6dd6960302d06742f4b297d7ab3691437affc46c84903e3fc41118847cbc9d0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774600518, "uuid": "b734967d-2a29-46d5-bd59-6ff7417eda58", "value": "T1A8A57C0B7CA585F6C46AA7358CB66296BB70F8480B3133D32F906A792F767E05C39714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774600518, "uuid": "79d3b9ad-2f69-45a5-bfa1-c58509f21c55", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774600518, "uuid": "e82f119e-3460-412c-ae5b-acb0cd74b990", "value": "49152:mvlwv+B5VE5gfI5xyiT0brUe3Ra5fKsw7FFZ/NaT6fdJCd:mveYE5gw/yiT0brfkfKs2yd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774600518, "uuid": "89c04cc3-9b52-4a43-93a0-ad5e4e932ccb", "value": 2249880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774600518, "uuid": "b359b4bd-366d-43d4-83c3-86b49df43c16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774600518, "uuid": "55396591-32f6-474d-9b65-e80b9fff8463", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a63499b-2978-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774573124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573124, "uuid": "fc1455c7-25c8-4d88-8a6b-dc4e59282721", "comment": "Malware payload (AsyncRAT)", "value": "7374dec4d6e682e984cf842e2db7bb1d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573124, "uuid": "93280237-3f97-47e7-bdd7-875aa510f8cb", "comment": "Malware payload (AsyncRAT)", "value": "a6e45f7f4bda924f1a07296d8b28cf3f78345ec7a90aac2a0b8f3f89aed903c1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573124, "uuid": "eb9cfa93-dae3-463b-a03f-a66a0a0e6339", "comment": "Malware payload (AsyncRAT)", "value": "12d85f5bc7feede4f271de439c50c0dd6b67fe6c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573124, "uuid": "7efac50a-6e54-45f9-a94d-3e6a729a58a5", "comment": "Malware payload (AsyncRAT)", "value": "00a8f3be820443a2bf54cede6ea6e7c1213e12fea60cdeaec7a2959e0f3c709157dc1d50e3392fd205a1129a9ebe93dd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573124, "uuid": "b4ce46e7-a9a5-40db-a12b-c6b912e6778b", "value": "T17BE25C047BA1C226DAFF6BB45CB2911A02B4D613D927EF5F0CD844AB6F67BC146017E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573124, "uuid": "897923d7-bae8-4b7c-81aa-61aa4b4b0718", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573124, "uuid": "5240c108-1e73-43af-ab7b-655433c585a9", "value": "768:hLIwKXnJ80W+bEZ2GbTFy19isOqhryIJg:hw9W+bSNfFI9isOq3Jg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774573124, "uuid": "f0a1293e-1599-4bfe-88e3-a6bbf7bafe85", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774573124, "uuid": "097db9ee-0b38-441d-97a4-ae6611fa57d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573124, "uuid": "95114617-4d6d-4757-979f-4c560caf082f", "value": "RainbowDashClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80231c8e-29b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774597776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597776, "uuid": "010802f0-1e94-4d8a-a2e5-cf442295cccf", "comment": "Malware payload (Mirai)", "value": "853293028084a0917e8be62d85afb452", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597776, "uuid": "abea37a9-544d-431f-a383-bb7be40da77f", "comment": "Malware payload (Mirai)", "value": "a7359b810b45f7bb0fcb56a5da5dae41f9c65c7a4c4e5fc0267ffb5a26756c19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597776, "uuid": "e1f5a4fa-6c5b-4318-aafb-eebc9fa5a7f2", "comment": "Malware payload (Mirai)", "value": "7f2c95fc635bbb1b6bc42f1ec86187541ed3ff3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597776, "uuid": "73deb4be-dd69-4488-8e91-80df10d1a609", "comment": "Malware payload (Mirai)", "value": "f21d1467b87202d23e96c28ca487d703d67122b438dbbb3f10f243c86a394269a19c3007444fbd88659e2a24d3760e06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597776, "uuid": "9a0da39f-791b-43b9-80f9-09b26ad74b88", "value": "T120A3D6C2BB43CBB3D94315F102F75B358A31FC3A4C26DA85E774BDE29A125C1A616368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597776, "uuid": "16f77412-86df-484d-b357-669e442be387", "value": "1536:BJ3DLAnutILhlmP7lYGINLDwKMgJsPbzs1BNSlaMso6:/ihlG7aBnwNgJsTUkII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774597776, "uuid": "84f0e9c1-1c35-41c7-af85-7cbd2f242758", "value": 103152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774597776, "uuid": "2b92229d-558e-4b40-9954-4256dda47b73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597776, "uuid": "eea6eae5-fffe-476f-b9f3-992d6937f978", "value": "colorado", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fead1cc2-2992-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774584673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774584673, "uuid": "63495658-ca6d-4d5c-a05b-07a99b9353b7", "comment": "Malware payload", "value": "db2fd0821e5e34a7371a0c1cfe660e3f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774584673, "uuid": "1315ce2b-2c22-4aa0-b737-d10683cc4c07", "comment": "Malware payload", "value": "a73c2b6f5b035a7ad2b85792283a5aa4e855a616575ad56b0b9db17d136c8ce9", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774584673, "uuid": "e17a28ff-a389-45ff-8ec5-5472ab10388d", "comment": "Malware payload", "value": "1d8869264435bb5c35357334a96040b350ac21d5", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774584673, "uuid": "52491633-227b-4a19-9d94-e52f41a97cc8", "comment": "Malware payload", "value": "9670110b9d251c5cd7e55c8fc178d8556b2b2137046280f39cdfe3b9bd916e562ee8beb79f6c6dcab7814122d7cbfb85", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774584673, "uuid": "76432c77-3c1f-4c56-970b-b51377c0aa1e", "value": "T14F012D61354822A161B3877D9EC640C9DF9C8557A5711CBB3C0C90FADFB29635233BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774584673, "uuid": "4936c355-036a-4c68-9a66-8472c10ba998", "value": "12:w7706Q/YIUp1snq3lWuNJsN8s2Vr03rVJ8kVJzv:w7706Q/YIUp1snyU2pCf8SD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774584673, "uuid": "570b52bc-8957-44fb-9219-6eb14c7a8771", "value": 853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774584673, "uuid": "c211e711-d65c-49e8-a01d-77502ba491c3", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774584673, "uuid": "54d4285b-d03a-4d59-8455-eef2eae094cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f930de7-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774625128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625128, "uuid": "7230bcea-dbd7-45da-8a9d-765de6c65ccc", "comment": "Malware payload (Mirai)", "value": "d299930867d2f4ce337ba23c59386aae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625128, "uuid": "f37809f5-9975-4bed-a7cf-8786aa70adc3", "comment": "Malware payload (Mirai)", "value": "a76a8d84860fc7cb7cf7c3c15ed4ed5dd6d9490e174aee39e6c6ef274114d990", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625128, "uuid": "58d863c3-63f9-4fdc-a188-04988575ad2c", "comment": "Malware payload (Mirai)", "value": "9eb81e78a6487a19cd693cb9600fe378c4e27e4d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625128, "uuid": "32865e1d-c0a6-4265-ae94-54648c5976a3", "comment": "Malware payload (Mirai)", "value": "6ded591e50efa4e065b207fef2ddab6355b8d6db0c6c26cba2954f306bd761f512218a8373ea4c9b03220f735e5b700d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625128, "uuid": "74d4ab00-ffb1-456a-bb10-a05f0e5bcccc", "value": "T1A6B2C0CC61943084CA8D7C7C17CD4A665F6CA190BAED9B26E350CD98B3BEA4F345D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625128, "uuid": "1f558bb5-1187-4040-a038-90c54ce25d1d", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpaZqSWva:4QlS07FUXqIYSXQKquuqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625128, "uuid": "34ba98bb-a6c9-4f14-b029-b82a2021bfe3", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625128, "uuid": "956553f6-033e-4855-8b98-7cbe231f6421", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625128, "uuid": "7238c64d-c3da-4d10-925c-1a3d9c6968cd", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07a6129-2a26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774648081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774648081, "uuid": "90f9062d-6fbb-4452-814b-c13a278699bb", "comment": "Malware payload", "value": "10b70b533d0b8e1436eacf19f64a292c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ProctorU", "colour": "#CFBF17", "exportable": true, "hide_tag": false }, { "name": "reg-pcsdkflyer-ca", "colour": "#32D47E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774648081, "uuid": "e40a0d82-ff15-42e7-a907-041b9f4c770e", "comment": "Malware payload", "value": "aaebc8c07de485be6d1bfa956668c5e18aa1ff5588dfe84672e20ae90b4560f1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ProctorU", "colour": "#CFBF17", "exportable": true, "hide_tag": false }, { "name": "reg-pcsdkflyer-ca", "colour": "#32D47E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774648081, "uuid": "24a5a14c-38dc-4f84-b2e1-075f600695b7", "comment": "Malware payload", "value": "c0b003b3af873a3b1af117912ae31b462abd743e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ProctorU", "colour": "#CFBF17", "exportable": true, "hide_tag": false }, { "name": "reg-pcsdkflyer-ca", "colour": "#32D47E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774648081, "uuid": "0c2483ce-9bfa-43f1-9f19-e90eedfc76d7", "comment": "Malware payload", "value": "bc5fefac360cfcda1053c811f0b5f1534a86506b432d4bdc49f4d0d558de8a6ec4898c3cacf00b2e4b87efa4cd8f66bb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ProctorU", "colour": "#CFBF17", "exportable": true, "hide_tag": false }, { "name": "reg-pcsdkflyer-ca", "colour": "#32D47E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774648081, "uuid": "0b5d14dd-67ae-435e-93da-43cc9758f28f", "value": "T1BBD6D0A37285FC9FF6822472FDA0E1358295EDB89F3B01D739947B1ED1B62019A06F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774648081, "uuid": "cc8f6f83-6e79-4e60-8e8b-11cfadf87962", "value": "d23fb45e6470042c2e00e0c1d133b73a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774648081, "uuid": "dfbfeaa9-98d4-421b-85b8-4e7d8b2c9151", "value": "393216:RYxNINQwhk2bDf69TNzq1Q69J9nT1NQ30F3:8cQyDf0q1Q6r9T1NQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774648081, "uuid": "55726770-5036-42e0-922d-df623bea088f", "value": 13437952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774648081, "uuid": "7ef7a9f8-d0e7-4ec6-b24f-33360ad079ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774648081, "uuid": "85b9d50c-8b93-4170-9f98-0cc3faedfaf9", "value": "ProctorU_1.33.win.04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3004f8cf-29fb-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774629424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629424, "uuid": "37ca8df7-ae55-4e9e-b499-a5bb32e55d27", "comment": "Malware payload (RemcosRAT)", "value": "49c8d81c8470b46b2e1666aa2b14048a", "object_relation": "md5", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629424, "uuid": "2579e4bc-9b03-45a3-9c7e-dcfb73163957", "comment": "Malware payload (RemcosRAT)", "value": "ac4575174673030dfe2404cde288ac17313f73ccf53731444b2b3ee804ab3f0c", "object_relation": "sha256", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629424, "uuid": "85056b44-14f6-44da-8d95-28f5492cfa48", "comment": "Malware payload (RemcosRAT)", "value": "d525b6819f3ab77b3e678ecec5bdf6aaec87cece", "object_relation": "sha1", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629424, "uuid": "9a33f57e-585b-4c64-aaae-f03e607de1b8", "comment": "Malware payload (RemcosRAT)", "value": "33f0a6ad9d3a6a258725dfb29d6b85efe67f5a4333264f4b881ab731fb879ea3338460ad92e91ec351c90944f521b690", "object_relation": "sha3-384", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629424, "uuid": "bada64c2-de43-4acc-a3fa-53fd57d29577", "value": "T167F22F4C7FC6B66907292477AE1FF1BAF1AEDC84700DC358E2A59851F914B18F0B3928", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629424, "uuid": "be535aa7-9781-4c4c-8dec-624beb9f61d2", "value": "384:RI5O+NIy1GBMC39BS3IvS7R327R7K6QsFUhhT+zksUAlOI2km6yxaW4Cd5GF3u:K5jPsxfBvStknetAl7mrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774629424, "uuid": "c154cfaf-5a3a-42ae-9c8f-1f89d9101510", "value": 34656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774629424, "uuid": "83ae3d7f-c9b3-4894-8c8a-fd217b36ffde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629424, "uuid": "a388d9bc-e113-44f9-9c78-1160b2cc4ff8", "value": "Shipping_Document_pdf.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5cd00d-29f6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774627433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774627433, "uuid": "1e23a372-89c2-41c2-bff1-dcd12419c659", "comment": "Malware payload", "value": "dfcf24186a4daa6f6e4e7c0f94e2557d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774627433, "uuid": "ff99663c-c5ee-4f96-9036-3bfd4019e347", "comment": "Malware payload", "value": "ac7d8028e97fb59750fec35387a50099a6d6df27b943041689fed14412d7c714", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774627433, "uuid": "242c0803-6bbe-47cb-8f74-07336824826d", "comment": "Malware payload", "value": "61810a5d6a47324bbc403b799cbb0f7afed47450", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774627433, "uuid": "44a30588-e0f3-403e-a037-926cdc9a1554", "comment": "Malware payload", "value": "b8afc898485c2d6d32f5b3235be67832625d2310a64839ec7f834dfba48dfc63d245244742439f957c48f1be27590775", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774627433, "uuid": "b85448b3-2a59-4a94-8e57-7a925c55cd56", "value": "T1EF925CB412896D79FBD1CE399F3C6F4DADE8C2C42124E3ACBA0F39215A1166DC70535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774627433, "uuid": "962e8f2e-2029-4683-8963-28c2a9d2297f", "value": "384:idcuQpWx+BL0SWL0gXzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:id8i+BL0SI0AzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774627433, "uuid": "1820ee8f-11e3-4f36-854b-e4bdb91c7c06", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774627433, "uuid": "862467f2-4052-41db-838d-09400d125482", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774627433, "uuid": "6d48e671-5806-496b-8985-89ac3e25f0c7", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1602c288-2978-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774573116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573116, "uuid": "1d1d8408-7fd3-407a-97b8-426b9f948821", "comment": "Malware payload", "value": "3bb63dc6d9fdac2282883c19cc346693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573116, "uuid": "4a3c9d1d-0050-40ba-8f38-b059d832898a", "comment": "Malware payload", "value": "ad528fb45f208d332f1b00deab9ecff8a95a6953f091b7e41b632032cac52a1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573116, "uuid": "6e38e5a1-b65f-4c41-8fee-70feef7fe5d7", "comment": "Malware payload", "value": "358645549091a8269036f707fe96ae43a175a14f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573116, "uuid": "b4579d40-2af0-4bc9-b3a6-c7644a719630", "comment": "Malware payload", "value": "1287c2535fac1df298fd6b2819ac1f2b7835f00961fa67ce14828d353d9fa8c05b8a0d2fb90136a3341fa478f58768a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573116, "uuid": "33c75082-e914-4ada-8ff3-056cfdb89a64", "value": "T1B5163AD47491FC74F54DDFF3C806F3A743A99A28FF2CCB1BA5E3A2A922A53644408945", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573116, "uuid": "d521d3cd-bf59-48ac-af13-39a52e3ff983", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573116, "uuid": "b20f14a4-9ab6-455b-924c-3419ddf72774", "value": "24576:74trAMjaVaNSECafsJe7akagwXiXaYIfUaOaUU2+aSNtaY3D42DoNW19UYt6WWSj:kvKQulow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774573116, "uuid": "abbf4ae4-24cf-4fad-9022-dc298110c9d0", "value": 4173312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774573116, "uuid": "72de2972-b058-4c5f-b914-0e179d0e0a59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573116, "uuid": "8f8271df-d738-47d6-a319-367fa70f7438", "value": "pidorat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c585f902-29f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774626668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626668, "uuid": "ceffb5ba-735e-41f0-ad23-e02b5d9e47e5", "comment": "Malware payload (Mirai)", "value": "c30ada9f0b0678183d539b1c6854e57b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626668, "uuid": "e4909e0f-a093-44c9-88c9-badee7982218", "comment": "Malware payload (Mirai)", "value": "ad6474f9bf66afe4b81f5d156c4f1a73de9d7068e9b20debe32172a89f4b2b26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626668, "uuid": "24bcac3c-f8b2-4b27-828a-daf705076e9f", "comment": "Malware payload (Mirai)", "value": "e364bd7848d85ccefa6239c5c940d1244972d09f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626668, "uuid": "8cc80768-69a0-4aaf-9f6e-06a40422b011", "comment": "Malware payload (Mirai)", "value": "39846eb5d81b07f389c42eb4cc8ece0549246351cda946804c1429592ac605d55e4d1230d8ac016db70a6e9a61aa3639", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626668, "uuid": "8e850975-bb4e-4316-a045-99d76d856a60", "value": "T19ED34A05730C0947E2673EF43B3B27D193DFDA4221A4FA45255FAA8A92B1E33158ADCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626668, "uuid": "50d9ccb8-6034-4f3e-bb85-0159662bd06d", "value": "1536:iFR2QpDt3dxZhREg5qDIM+66ea3PBXPWSJX9v6hvArzcv6eGpEmNqA/VVi/IffCP:+f7dxLRETeFT/BeSL6uvpegffbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774626668, "uuid": "3e9a5810-693c-4055-b3f8-7abeb6af16d3", "value": 136260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774626668, "uuid": "2e2a39d2-35fa-4a63-9cc6-9544cc4fe854", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626668, "uuid": "f0854806-916d-4ed4-b04e-b72b60e663df", "value": "cronn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e599443-2a03-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774632911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774632911, "uuid": "029a639c-bff8-416e-a07b-d149935d6435", "comment": "Malware payload (Mirai)", "value": "807a8a6522836ce6b00c2ea0056b22d3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774632911, "uuid": "0cce95a1-c6a9-4b5c-b20d-240fd4511d48", "comment": "Malware payload (Mirai)", "value": "ae3038f730e9e85bac4f57222821e24cc3b78a23555d74e762ba129bc8d9eec0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774632911, "uuid": "9c99756a-1e57-406c-9586-ddfd7280e05f", "comment": "Malware payload (Mirai)", "value": "52850f58574eba956e311aecdf49c83c6287914c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774632911, "uuid": "876d9c3c-0590-4e68-9bc6-df8aaf350bcf", "comment": "Malware payload (Mirai)", "value": "cec1cbd5978bc5d0f8c0971d28475fa53b578da77469fd1ec458f63f8d0a8352c11856bbe60993ae5450b836d87c115c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774632911, "uuid": "685bdd5d-150a-4ce9-99a4-9324bdde7bb1", "value": "T10E51418D3050B7F87D75DB6A7AA5C85832C498A250C3EE625CDD38ED80ADD043D727B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774632911, "uuid": "498ead8a-e157-4f78-bbdf-67572b08ba3b", "value": "24:vEmsssmsEBLvmsImsmqmsx8s89msXms5msKmsREmsamsxmsNmskt:vRsysEBL+sdsUsts2scsLsns7sEs4s6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774632911, "uuid": "6459c892-5ef5-46ae-a413-cbedd1f62952", "value": 2730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774632911, "uuid": "6f47f90a-aec0-4c48-b9a8-16e3f003f44f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774632911, "uuid": "0ae30156-229d-47c5-b731-c9e9969e463c", "value": "flameblox_nuclear.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fff526e-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774625156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625156, "uuid": "eb3fcaa0-cc69-4a34-9d93-1195ae2ebac8", "comment": "Malware payload (Mirai)", "value": "084f24568e058a7245a7b2f7f1aa78cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625156, "uuid": "33537a4f-1a7b-4426-804a-0518d78e4434", "comment": "Malware payload (Mirai)", "value": "ae691a5eeadd6d78033aa3e532af3cec8ac5e0467fb067c745fea547cb150351", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625156, "uuid": "90b8269e-2280-4933-9f2a-1d245912359e", "comment": "Malware payload (Mirai)", "value": "d2d1f5c6cfeacc924c99d7cc9930b2de0fd66336", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625156, "uuid": "6c4ae79a-72e0-48f0-bf85-4d1d0b705b82", "comment": "Malware payload (Mirai)", "value": "d08e544eaeb31345ccab6f6d3a21f0062bde4f521b1aa3f4321d2df931956d222e843a10aa186416e76b0f1aa69e86d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625156, "uuid": "87a692b4-954c-4079-bad2-8a27e54892a1", "value": "T161C35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625156, "uuid": "ba3b0535-495d-4bbf-931b-cef6b009aef2", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHoprScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIprSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625156, "uuid": "3aa09bc4-f8da-41c4-aed5-1f4501765e0a", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625156, "uuid": "eb7b51a8-e7da-44ba-a30f-228a21dd24e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625156, "uuid": "62197409-4e8d-4b1c-8a08-e0423cd15e18", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36933f2-2a0e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774637778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637778, "uuid": "01784d16-5007-4e09-a5ae-301ed941647d", "comment": "Malware payload", "value": "7d5c0a5d366f1e3eb49078d2339fca8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637778, "uuid": "ef6d4e67-bec5-4cb6-be80-031af49f2d76", "comment": "Malware payload", "value": "aeb2dd609ad610758ec2ba5b1f64e64a09577890cc100974d6e099b9e7805312", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637778, "uuid": "f7622aa9-43e4-4211-a402-52499a4ee2e7", "comment": "Malware payload", "value": "858d2d2bfad23ed42f9e5a9a8d451d0000823aaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637778, "uuid": "4628d948-ba05-46ac-9e77-3349d390e2f5", "comment": "Malware payload", "value": "be610ea7893e82743c549dc89afaedb534202a4eb4e402a873cb629da9c6957fa2fdb940ef457216ec0e1109183c4a5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637778, "uuid": "e83a62d8-5298-4c5a-b9d1-944d0af75187", "value": "T18A8733B733D24937E9B451B20D645B549B6BF2270178CC5B97C49E0936A2CC2A32DBE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637778, "uuid": "b737fe23-7238-49e6-962f-c0ca69b91cc0", "value": "1a4d4d785c58913f559c569cd4cb3c2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637778, "uuid": "801145b7-bbb7-4bec-bdc8-bb891944ac29", "value": "786432:S5VYnr6SAGzln6N2UErcApnYLK6mOJJdyoIEWikaGNt6o181vNOXbRNZ:S5XS56N2UR8y/IZ6NfOrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774637778, "uuid": "57b990b3-9e3b-4ed3-87bf-7ab39f998f5f", "value": 39135057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774637778, "uuid": "305e965b-5425-4334-8bd0-f80b1b4b1f8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637778, "uuid": "bd95ee31-b72e-4c29-8662-f4f74e4b0d17", "value": "fnvpn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca08cfc5-2a0d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774637413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637413, "uuid": "8ede56f1-6fc1-455e-a49d-f2cd80c7d16d", "comment": "Malware payload", "value": "81014f36fff3f1e447ae8f7c14f622e4", "object_relation": "md5", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637413, "uuid": "fedbddb3-acce-4da0-903a-dd635859efe0", "comment": "Malware payload", "value": "aee2fe7d5f91f02d6b59d53493abaa819d0e2493a8eb89bb78124a4859faeefe", "object_relation": "sha256", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637413, "uuid": "09c2699b-a8b6-4e5f-92aa-f8963ed562a1", "comment": "Malware payload", "value": "3900049bc935ed5bbb61bdc9d70e167dcc0df09c", "object_relation": "sha1", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637413, "uuid": "3d4ef758-04e1-483a-a3f2-d9b2d26f66a7", "comment": "Malware payload", "value": "0ad14ce5614b098362f86183e978748ec039a399ecd3748556b335d40152fb261fc5502b5a5750af4403d648bd5bcec4", "object_relation": "sha3-384", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637413, "uuid": "88405266-0167-40f8-9975-5890c26ffecf", "value": "T1C035331AF1D7635E5DCFD9423E5924A300100AD72A7C6DA30E0A38389FDDDE1ED98A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637413, "uuid": "cdee18aa-ad8b-48df-bc6f-2bbb43e2cc66", "value": "24576:g9rNrP/QP8ogZ5L+tmZ6cPW70T01OdJgjEkC5ZH8ktrY6W4:gnrXQjuV/650T01OSC5B8/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774637413, "uuid": "b9cc5376-0a9f-4717-85a2-c987c00542c7", "value": 1094643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774637413, "uuid": "8502e151-737d-4130-8ec7-6ce1334b3ac5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637413, "uuid": "3d1b3f2d-06a8-4987-a6b0-b33a21f2c073", "value": "Intelnet.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1cab03-29e3-11f1-a769-42010a9c0008", "comment": "Malware payload (Kinsing)", "timestamp": 1774619410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774619410, "uuid": "8c3616ff-7fb5-4758-9e83-2288efb91c7e", "comment": "Malware payload (Kinsing)", "value": "06621f20208b76ee969f28c705960631", "object_relation": "md5", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774619410, "uuid": "8590f118-a9d8-434c-ae92-dd4afac68427", "comment": "Malware payload (Kinsing)", "value": "af2584adf937e22a46ffa5a11e139facf2a4cab8e354cf92c1faed5e1c7b4034", "object_relation": "sha256", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774619410, "uuid": "d0b6686f-ea59-487c-a941-b2efc4e26042", "comment": "Malware payload (Kinsing)", "value": "e238c24bca4bac7ccbf0248293c760975375388e", "object_relation": "sha1", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774619410, "uuid": "3b23777b-57a1-48b2-bbee-66314c281fc5", "comment": "Malware payload (Kinsing)", "value": "3a003ddcfbae68a22378557dac8b6b67008e08f19ebb7ab3b183e4a6428a692c2a25f4213de42a3191c2cf33e6dceda8", "object_relation": "sha3-384", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774619410, "uuid": "6c32efd9-c018-494f-a4ec-02f549d70a6f", "value": "T1DEF2374D9072ECB52D65C866DEE1322DB0BEF088C5F37B88AE253D3C55A4005FA715AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774619410, "uuid": "78d24840-ec03-4ef0-b4bf-32196ffc41c7", "value": "768:NcY7mzQ5VFNcDAFLcIwgnoYq0xFB/ytYpuv:NcKVF+D6cIwgos90v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774619410, "uuid": "bf038bd9-aef2-4408-986c-6b0da485faca", "value": 37425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774619410, "uuid": "ca220fb4-cac8-4ea4-9e98-6fdbf26ee267", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774619410, "uuid": "6656f754-ecdd-42cf-895a-2b3ffb8a6924", "value": "sc.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c3de7e-29d1-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1774611336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774611336, "uuid": "ef5520c8-c661-4e6d-b202-6462734c1edc", "comment": "Malware payload (DCRat)", "value": "c4a38efbb8827e3d287f1f5e1ee2ccc7", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774611336, "uuid": "592a3bd0-7041-4e83-89c5-f849ce69f42c", "comment": "Malware payload (DCRat)", "value": "af4a17d60bc55ec49cb0656378581a96b1ab137eea1aba91597f492ec977312c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774611336, "uuid": "1ab15021-d6da-4c3c-8aec-158ae8f42678", "comment": "Malware payload (DCRat)", "value": "4f2ef3bee5ddcfe05a1b7cdce500c78807a7093f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774611336, "uuid": "4d356cc6-8722-44e0-b9af-72571e378c86", "comment": "Malware payload (DCRat)", "value": "f6cdcd8b662cf087f65243d15ec8dd85824fcd6035273a1595f09659d756c66e1723335a2959708da7a716c274c4a9e1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774611336, "uuid": "1c1700a8-ef0e-44ba-b293-f128183a6eb9", "value": "T11D3549427E44CA21F0591633C2FF490847B4AD912AA6E71B7EBE776D59123937C0CACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774611336, "uuid": "c633e039-fce2-45dc-b0af-a44422b6a836", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774611336, "uuid": "9182cd71-4503-4783-8eee-481bea10d75d", "value": "24576:p2G/nvxW3Wk55/cfHi1fVfuA3bINjt2RDx5h:pbA3bv8Hwfbdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774611336, "uuid": "7d7500dd-f886-4cf1-ae92-ac39375f7c81", "value": 1133170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774611336, "uuid": "bff3bb60-faf4-4080-a20e-562b46131f93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774611336, "uuid": "5f52b635-7c23-4044-b731-f9b500b8428f", "value": "C4A38EFBB8827E3D287F1F5E1EE2CCC7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640873fd-29f2-11f1-a769-42010a9c0008", "comment": "Malware payload (For)", "timestamp": 1774625646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625646, "uuid": "7b79b483-959f-497b-aa7a-cce378187e07", "comment": "Malware payload (For)", "value": "fb3f1b2563b5591f35b9cbf8e0c8b018", "object_relation": "md5", "Tag": [ { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625646, "uuid": "3fb4122f-be7f-4a44-a464-16b5794e7fcb", "comment": "Malware payload (For)", "value": "b032f35e35c10de208372ccb96d9caad6cd25eabf18e0f69b091fb5fb67cb0ea", "object_relation": "sha256", "Tag": [ { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625646, "uuid": "ff675b45-461d-4b1f-9999-fb880f6ca4ca", "comment": "Malware payload (For)", "value": "c97ae6787043adbc8efb645abe7aa2cedbc94aed", "object_relation": "sha1", "Tag": [ { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625646, "uuid": "6714b12a-87e5-4154-a76c-a1df5dec45b1", "comment": "Malware payload (For)", "value": "76156735a1e3a7dc468d3ff4a7e13d7262e62d5e5b29eee08a4a75396fbb542e4f69af8ca4a73fdf4238fde5456fe841", "object_relation": "sha3-384", "Tag": [ { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625646, "uuid": "191e7d84-ff02-48c3-8ebb-2b15f536c100", "value": "T18C3633C59F4805DCC62A9B5E4590FFADF01839101FE5D9889F73F2EEB622EE54C86488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625646, "uuid": "4acd4ded-0344-4d27-85e9-650ebce33c1e", "value": "98304:QLBpf4ruZoTa/rL4UOVdjAsUMl1em7CVrggwb9eeS1DpaW/aSX0XyZtUjGDEGqLi:IbCuB/MFARetCVrggY9todaWiSXmyZtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625646, "uuid": "1b077f39-b06b-442b-9b6d-b4f60e6f8517", "value": 5169974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625646, "uuid": "93776cf2-cf70-4ef5-aa1f-dd8baac3e0a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625646, "uuid": "52878199-d4eb-4935-8724-ea2008ed3c88", "value": "SWIFT809827736829.PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb61d32e-2a01-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774632315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774632315, "uuid": "d4cb9074-bb10-4d89-b08b-f983b5b70424", "comment": "Malware payload (Vidar)", "value": "89823b32925e74ba7beea95cd31f274e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774632315, "uuid": "bc3c9b67-671a-4f40-896f-7087e8ec764d", "comment": "Malware payload (Vidar)", "value": "b061f1f9d9a3e9472c22a1bc7ce0ddbb20eade19ae21fd79aca7573a149092b6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774632315, "uuid": "0b47be05-f660-4225-8a5e-0efd211709a1", "comment": "Malware payload (Vidar)", "value": "c298f327934d9d1eb9611d0fdfc6384c938d1b1e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774632315, "uuid": "80c08977-739d-4216-bde1-27531db9d61e", "comment": "Malware payload (Vidar)", "value": "f02d0244d32e36c915c70fc0115936e7ec8bb8a8466bdfe0a742bf66df5e9762ca8ec2f2b9c4133918e17633bdc299d5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774632315, "uuid": "d5aad364-1c44-4159-9336-02b88c029501", "value": "T15FF6177B26D18368C31D813FC0628F1CA5F3B0BA1722FEE756A50F688E519D95D3E621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774632315, "uuid": "fbbd57c5-7c3a-476c-8179-f788132c4357", "value": "e6d4c0486cd6d079ac245402af7e0d4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774632315, "uuid": "c01a290c-3f8c-442a-9ac8-2c05162f65bb", "value": "98304:VDHG4cYLiMBYdpNoOEVR70vt0lCLSdQI:cYLijdzoR+0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774632315, "uuid": "bb317a28-e94e-4827-afa5-b71dea2f1641", "value": 16550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774632315, "uuid": "6b5d6fa5-1c89-48b1-a0b8-c5d520bcf488", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774632315, "uuid": "6ccb80cb-87b9-4abb-928a-de3387c5440a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651c27e8-29b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774600737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774600737, "uuid": "c26f9430-ea3f-406b-8d61-a353d8317d12", "comment": "Malware payload (Mirai)", "value": "938ed38bc0e86bfc30d4558302184e10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774600737, "uuid": "5b013666-bbb2-4dc3-b481-08b0d9114bf3", "comment": "Malware payload (Mirai)", "value": "b3c49d520da3f2fb27315f4a88f5ec4d48cedf7556d8c64260f8a8c95cd0c500", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774600737, "uuid": "6baed91c-6505-4c82-865f-aeb33cf46b8b", "comment": "Malware payload (Mirai)", "value": "36f56faab5714e0ffdf9d3eb32c680b89dee43bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774600737, "uuid": "8db478ee-0162-4a38-b453-3e38533ad640", "comment": "Malware payload (Mirai)", "value": "ccc53698170d4436287552731cdc2bfd3ffda90014e2dca380c73394e8163f82a5b25195d551024761cf1554c55034ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774600737, "uuid": "79b21029-9b29-4a6f-9ba6-155ccb7bb472", "value": "T104A5335AED9D68736FC0BEA875671472CABE107D538EE3C2FBED1424913E50CA4A0B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774600737, "uuid": "3099ae3e-b2b6-4e00-af68-df7b4ad9ce08", "value": "49152:Y2n/EUhKEm6X6AZdXhlYrhg+mMq5yG4AVdcIFFX4MBBgo65JE7IuP:L/iEm6K6XDYr4/4qKzwwqjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774600737, "uuid": "bd1fa65e-8b4b-4248-89b5-ca9468aff0e5", "value": 2095468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774600737, "uuid": "6278cf90-8d02-4cec-a3f8-049586cbeb6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774600737, "uuid": "526f4a3f-0b67-4aea-991d-e1273bbcb499", "value": "wlan.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a276228-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774625146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625146, "uuid": "ce078118-103a-4a5c-b428-a29b0da3c085", "comment": "Malware payload (Mirai)", "value": "df7d7f6f2958e42b0cef71a2d22c3177", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625146, "uuid": "f0b31ca6-8c77-40e1-ba89-ce4b747a690d", "comment": "Malware payload (Mirai)", "value": "b3e8cee6c6c9362dd5a2d8cd9edcc96c96f659ecc74ef2dfd2e4f3906c197a81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625146, "uuid": "9e6a1654-f4b7-4efb-b255-ce77116e28fe", "comment": "Malware payload (Mirai)", "value": "4fbdc0ab0b207aaab27df06fd4719a6f9550b322", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625146, "uuid": "5a8780c2-cc1b-465e-925b-8b3ed675256b", "comment": "Malware payload (Mirai)", "value": "b0303212eb321703022ab2492fb7bda945025977970a5582621739485296158e6551a0f6c46937374af85f494931ece6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625146, "uuid": "6cd28960-e594-485e-898f-f437c5ae07f2", "value": "T1E6230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625146, "uuid": "826d1d7a-89bf-42c2-98f4-4b7cecc8df64", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THm:5DmKF7Gxyk8cqoHAmWurAufsG5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625146, "uuid": "5eefe859-7c8d-4549-9b66-09d6fb1eb2ba", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625146, "uuid": "3ebc2ec3-355b-4f15-8396-3936a80f73f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625146, "uuid": "8e22d362-8c51-4b6d-b4bb-51676f22e581", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c3d516-2a21-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774645815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645815, "uuid": "1fcafe89-147a-4b44-a17d-c19ff8333fcd", "comment": "Malware payload", "value": "9a310ba001b5349ca581623ec4269aa8", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "fiker-cattermicoffa-sbs", "colour": "#11C8CE", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645815, "uuid": "245c6781-4a9a-47fd-8fd3-82f8488747c7", "comment": "Malware payload", "value": "b45d65f3bc682539ccebd90d783974d6c58e0a759c76888698a4f0031b1bb9dd", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "fiker-cattermicoffa-sbs", "colour": "#11C8CE", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645815, "uuid": "ac88719e-7175-4621-80a0-2ff347816a56", "comment": "Malware payload", "value": "69e322b4216f45a2c7908ff64f79d5648bf87e68", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "fiker-cattermicoffa-sbs", "colour": "#11C8CE", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645815, "uuid": "783553df-d659-435e-a0fb-5e3d109dff9b", "comment": "Malware payload", "value": "238bdbc98297df19a454eea4e1981d2014b5327c647e408e4d89323b002e066b79c7e3a75734f0800b4f20c46ee9e625", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "fiker-cattermicoffa-sbs", "colour": "#11C8CE", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645815, "uuid": "ba28f5e1-8073-45d7-99c7-806fd1426575", "value": "T1D4868C60FCCB10B1E953187241AB627F17309D085F39DAC7EA507F99E8739E319B624A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645815, "uuid": "e698e376-fd3f-46c2-b26c-717016e7c42b", "value": "77269cae0968bddaaee2b7ffb668a92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645815, "uuid": "f838f766-1a6c-48b3-b961-a6167a5e919c", "value": "98304:J0M51GxhiehH7MZcniemIeDOIqWq+iPwo+eH6/DJc/3N:JTPIUZfD0aeH6rJcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774645815, "uuid": "d8df8b62-73d5-4b70-b46c-ef7da7f6cf95", "value": 8391320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774645815, "uuid": "3f623d23-b39c-48bc-b318-89690f0d622f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645815, "uuid": "87a76668-7424-490c-9b43-544e4fa1bb62", "value": "python314.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b7db9b-29d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774612232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612232, "uuid": "b79f2fcf-652a-45f0-be2b-649b895c33b8", "comment": "Malware payload (Mirai)", "value": "6345160bb604b872d66ee9cc99289d7e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612232, "uuid": "d0b07b0c-174f-478a-9aae-40d07dc21d2d", "comment": "Malware payload (Mirai)", "value": "b5728658643b5849e9aa812e4c5e13f64806438ed9be44ac9333aff5a861c71a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612232, "uuid": "9f40ef9f-45b3-4777-b729-618f95df8ce5", "comment": "Malware payload (Mirai)", "value": "7c4288d0625c2f2ca165347f47f0febae29a16f5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612232, "uuid": "1aa066c9-ffd1-402f-bd76-ce4b3ccfc1f7", "comment": "Malware payload (Mirai)", "value": "52bbf14781c71a509639597a82789b454a95f7e41a9101da61a24bfc26303f8eaef60bda37883d49f11f4c6f76a895a4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612232, "uuid": "692e945f-9857-4c8a-a073-c7e76580c5eb", "value": "T1E3616295314242B12EBD8F37627E49243183E0A76CEF7F59D5EE24E8849CEDAF040752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612232, "uuid": "6220fc4c-cc63-47b2-a9a0-2246f5e1d970", "value": "96:i57Q5oq5tg5Ua52S5ae5T85z45ysL55g5ge52435lYL53M56WY:w7eootuUY2gaETyz2yk5ugE24JlYV3CI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612232, "uuid": "39b78649-4e86-4017-be74-9c56910811f0", "value": 3284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612232, "uuid": "8820ca46-79ef-41ce-ab16-563e9f42235e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612232, "uuid": "324bb7ed-817a-4e49-95a9-7bcfaa7925c4", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de849ab7-2977-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774573023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573023, "uuid": "9d91731f-b0b8-4722-b70a-b3e4a78b7e30", "comment": "Malware payload (AsyncRAT)", "value": "6005b5231fdcd4ae1e02f391c8e7467c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573023, "uuid": "2f5c551f-37b4-4007-bfd2-f2c424db6aa6", "comment": "Malware payload (AsyncRAT)", "value": "b795ab2a8cdf887c4c0e6abb39a0e395495533f63a2a4cd44a5cfb710ee72235", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573023, "uuid": "ae3fd8a2-61af-4af7-a869-5fcefeb023fb", "comment": "Malware payload (AsyncRAT)", "value": "7a4437a984888ccc9dcbbc71b0779e686862b544", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573023, "uuid": "7452eba3-5593-45b3-8e7b-e6f948044e5a", "comment": "Malware payload (AsyncRAT)", "value": "b1a829de2fbc978a4cbc98272f1be62d96c765de1c28b6adc709698a491c5491bff09d6539b2180bc8c5f02c0abcb550", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573023, "uuid": "d71d5c55-1670-4c1e-91d6-2981eafd3fda", "value": "T166E23C4877E04312C5FEAFF02DF271091275E11B9923EF5E0CD88A9A2B679C146507EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573023, "uuid": "ec3fa3d5-5cc6-4413-aabe-8d339a7d38b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573023, "uuid": "25586f25-a04b-45af-9374-ef02504fb41f", "value": "384:jYaJWq4Ava7Rm32oDuuw3+q5XwYeLBEYvh0FbOKTCOQmxRApkFTBLTAOZwpGd2vL:dxC3fOJ5yYvGFbO75mxVFo9j1OjhbbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774573023, "uuid": "ea24a49c-9458-4500-b257-b45fab943091", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774573023, "uuid": "683edd48-c3e8-42a1-aa80-72d71db66b52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573023, "uuid": "9e93946c-de15-4df3-b68c-8a9e3efb00a9", "value": "121.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2568565f-2973-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774570995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774570995, "uuid": "d23c4779-7ba3-4255-a1e0-b2599865d72c", "comment": "Malware payload (SalatStealer)", "value": "07e934f6970a5d39031f7c5f84860928", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774570995, "uuid": "9234021d-9253-4c2d-9a63-66648c3a6f7d", "comment": "Malware payload (SalatStealer)", "value": "b8d9fb22ddf146adfbbdec174fe2a77d621e78a550f850ca354c743298bc4b59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774570995, "uuid": "1ab2b043-c4a9-4e8f-af37-4d4b4cfd1fe5", "comment": "Malware payload (SalatStealer)", "value": "104fbb9a8aaae6170a9a9b8c3f46da2ec9b3435e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774570995, "uuid": "335aabb5-df21-4894-81b2-0e6c73513a13", "comment": "Malware payload (SalatStealer)", "value": "5d1e7a3c0617c5d26335bfe1784f429f50c264465c9560acd28d2541c6fa53bd8ecdfef93d5b6514dc8934c0a94e96d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774570995, "uuid": "b4b332b9-c9a6-42d3-9308-80b6e7e40781", "value": "T16DC66C41FA8B56F5E903593140ABA23F23315D448B38DBE7EB147A3AFC776821D6B205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774570995, "uuid": "988123c1-bb16-493c-9d4d-d07746450991", "value": "49152:VlinFMxXT9mj3swGMBgwMJQ89thtXBoolbp5yVHadNlwrqp2WdRJro8FZcc3gfsL:jeFMxosJzCVHewrsDF7wnUlV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774570995, "uuid": "329d8e43-614a-4a5d-8f0b-5bab1e0d2fc9", "value": 12104704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774570995, "uuid": "78caabc1-bfdb-4cba-8c96-dc48f3dc1a3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774570995, "uuid": "f6d6fe28-b15f-4c40-acba-14e3da78829f", "value": "xb8d9fb22ddf146adfbbdec174fe2a77d621e78a550f850ca354c743298bc4b59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf880c5-29f5-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1774627109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774627109, "uuid": "e2165878-ecca-45cc-a064-ff6e7c0dc148", "comment": "Malware payload (Joker)", "value": "4ade3acf7ab1bf4a7822b93a68b5efc1", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774627109, "uuid": "92f85806-7212-4428-8910-f0860cb7b9fd", "comment": "Malware payload (Joker)", "value": "b9574aedf15f8160a3c0c38f03b3cae34c367f3665c28c09b05af427986a49d8", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774627109, "uuid": "2bdd6d9a-2aca-4401-8f9d-b46730536138", "comment": "Malware payload (Joker)", "value": "ce3dbdf946e8068ad567b87bc0a1a3460421f5a4", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774627109, "uuid": "d34c826b-4256-4b7c-b382-872d4a1c7439", "comment": "Malware payload (Joker)", "value": "22d54cd072805bc5e3cfab58c717fc1390abc1ec51a9eb562a318ff1e4f87a61ce184c5acafdd4c07839bcd7edd377d3", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774627109, "uuid": "32cca9ec-661e-43bb-a95e-1b54e4ddf0a1", "value": "T15977221AE75CFD2FEDB7F0788D9E2221A4253858D70097E32812926DBF839D18E467D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774627109, "uuid": "3c4e3ea4-559d-4a66-a0dd-46f73b0a2592", "value": "393216:WPLgXo9oWQPml3VLHUbAGfRXoc7J5MVUrSTh4ryKWF8Y/PH2g80pK5Ntxc7u2yaS:oLIWQP4iRMyGSbWKkkCKUgXs1naRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774627109, "uuid": "adefcc73-333c-4742-a2c9-609c64b2be33", "value": 34971086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774627109, "uuid": "d3515e24-501c-4fde-982a-8147ac628227", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774627109, "uuid": "3dd87d74-22da-40b6-8223-1dc70aba5809", "value": "Junk+File+Cleaner_1.24.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b44470-2a2b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774650343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774650343, "uuid": "fb1f05b7-971a-4605-a478-aa9ecb3a7354", "comment": "Malware payload (Mirai)", "value": "75e46ac4a746b2899380397e169b88f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774650343, "uuid": "d0093a85-2c54-423e-bd9e-f153acb5323f", "comment": "Malware payload (Mirai)", "value": "b9ad8360a3068c24cbb81b26d8075b55fb15d13073d9659790bee7131664c03d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774650343, "uuid": "0ace136d-611f-4d3f-abdf-1b3ee916619a", "comment": "Malware payload (Mirai)", "value": "9cb1be117b3640f9506cddb96c45300b899adbd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774650343, "uuid": "3393a28a-3f29-47b6-8385-0af982ef7eda", "comment": "Malware payload (Mirai)", "value": "aa85fe6d199e5a4a5dde9c4695884e689ec739aa9110cd9667c9b2ef186a28ff14a0fdc75a0920a73feb84a03c146050", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774650343, "uuid": "0a0b44f3-0054-415e-a2b1-ad05d949940d", "value": "T100D3390775C080FDC8E9C5B88BEEB126D973B46D1279721B27D4AE322E8DE205F6D614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774650343, "uuid": "758e4357-345c-4b60-98fc-c6eb04b95f84", "value": "3072:lWWsWHOy7Ncc7WxZmbNDg1iCm0SmisIfH2LCmk1:ABbRZvvi5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774650343, "uuid": "04db7d11-5985-4da3-a778-4d86bdaf84b5", "value": 141480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774650343, "uuid": "5fb16c3b-85b4-4980-84e4-c23e171971fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774650343, "uuid": "b4e5fdae-0a1c-4fd7-bd90-1a1be9ca34fb", "value": "sshdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640566ca-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774596440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596440, "uuid": "0aa5ecdf-456b-4030-bcf8-490a4b73e65a", "comment": "Malware payload (RustyStealer)", "value": "def4f909eeed327ab949d99a810ff64e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596440, "uuid": "ae1e12eb-9bb2-4481-9801-df3f54a65bd5", "comment": "Malware payload (RustyStealer)", "value": "b9f71ed4b08c93a7fc5468bee23660e3129e1cf9c84100d4d40ad70fb7c851fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596440, "uuid": "8e5e3192-9d61-4087-aa87-bb12b65dbdd3", "comment": "Malware payload (RustyStealer)", "value": "3668e6ca6e282334535c796a3a8817c6a23b6a50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596440, "uuid": "c17f746d-f38a-4e83-acb4-4ee782d2a3e1", "comment": "Malware payload (RustyStealer)", "value": "4f0185df1670f01975f653c31a167c5b0a872befbac299ecd559268aa0b4d9a5b93b151a539c1572b59a20591226b6fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596440, "uuid": "c9899ec9-1e37-434c-ad9b-f97d7045aabf", "value": "T118765B53F66290ECC16DC1B4831A6632FB32B88A073476EB57D086213E66FD06B3DB55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596440, "uuid": "54622ba2-d969-4a0b-a1a3-dc67769f8ffb", "value": "c6968d4f1c415fa3e43f6c6377cd6b0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596440, "uuid": "eb39694e-bd35-401a-a156-b0850de74741", "value": "98304:0i3Qm0vuJyIvFbWMVqqLKYhebCtjlKSObn+:7CpQvK17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596440, "uuid": "8d1a8219-0e24-4a8d-8f0b-756092fff703", "value": 7608320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596440, "uuid": "09e69795-8d9f-41de-b7f8-035d5f67fbb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596440, "uuid": "f7b41ff9-d525-47ed-a0b7-43942160df9a", "value": "SecuriteInfo.com.Win64.MalwareX-gen.25346281", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3bacf1-29f0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774624854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624854, "uuid": "be25daff-f9e2-442f-9d76-43de76af7a79", "comment": "Malware payload (Mirai)", "value": "7abee1ed45fb0a1175a0f882d93c38aa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624854, "uuid": "155c8379-6d06-4cc9-8939-c440c15b01d2", "comment": "Malware payload (Mirai)", "value": "b9ff5b1a87001fc513ca0526b5734b1925bdb673f3ed159a36bf6d078e453d5d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624854, "uuid": "16a67d90-11db-4c36-bc9b-b5654dafb1f7", "comment": "Malware payload (Mirai)", "value": "bdc772d9f92a42f882684448a35db7c99d3261aa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624854, "uuid": "c0fe1f21-cc4b-4112-83b9-333799d3af44", "comment": "Malware payload (Mirai)", "value": "4919b8a7ad1cad49b91b0e68f788b0e68cfa80a81b51b79d2c2fe1e316ab05f0f605b9312e66c458bacda217430578b5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624854, "uuid": "2eaf79a5-bf9f-49f6-b289-e552162659bc", "value": "T189733A46B98085EDC189E13803BF763AC415F17D6279B1EB3BC4BF17281CE611B1E66A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624854, "uuid": "8396ed99-9b68-448e-aece-957224a96a47", "value": "1536:YFpycwNfg4s1vmAvvK502NvULYROQ6UefFOXn3yMJvET40CxMMvLa9k9:pc+mvmmvK502N4kOQitOX3yMh90CtvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774624854, "uuid": "04606903-8b21-4754-b634-149dc6ad7036", "value": 80544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774624854, "uuid": "28459bf7-4f85-4536-aff6-d1c630680247", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624854, "uuid": "89188a3c-f0db-4a42-91b9-208e52c1a79c", "value": "nullnet_load.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ba9e06-29f7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774627763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774627763, "uuid": "a103115c-19f8-45b8-8294-64b411e91424", "comment": "Malware payload", "value": "9b53543f342693884355db6507969b03", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774627763, "uuid": "7e389202-5ef1-4b8f-8311-79d7898d8707", "comment": "Malware payload", "value": "bafde1447184101db89b964f771dc659ab811e0c17a32f468049e8d94c9e7cf2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774627763, "uuid": "8a712514-0972-4b16-afd3-3a466e710a9d", "comment": "Malware payload", "value": "cd10a294cfdba92ae099ee16f2c0ca882a60e865", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774627763, "uuid": "0a365718-8c71-4edf-8eca-8a0fe3464645", "comment": "Malware payload", "value": "af702a3dcc0a1a913a1cac761c80e0397b9c03222b0b95305f01cc12db92e57a4e9359d62d75296fd2967ec72cae51be", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774627763, "uuid": "8ed2c91a-0e4e-484b-952d-97d6325dae33", "value": "T14E952302B8C484F3D4551C330B65A7612A7DBE202F668EDFB3D46B1EE9614D0EB316E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774627763, "uuid": "e4fa6422-fd65-44a2-bbb9-bac00a34df03", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774627763, "uuid": "a98e2f80-036a-4f24-93a1-b01be93f334d", "value": "49152:ABRhTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6d:a/TFM5pXUBB6BLXTuoEXx6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774627763, "uuid": "3f0cf4a5-39f9-4a42-b163-43d00156319a", "value": 1900544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774627763, "uuid": "eaa75e3d-8fbe-4230-8fd2-24060cb71abf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774627763, "uuid": "d8309d0c-0eb4-4b54-bc2c-a56071a8f349", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8073969-29f0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774624928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624928, "uuid": "68ab3d7a-419f-45de-8acf-6e590e858e62", "comment": "Malware payload (Mirai)", "value": "b117bb31f1f546a91ec8edb569dda676", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624928, "uuid": "380ccc0b-3016-48ff-a5b1-c22170222705", "comment": "Malware payload (Mirai)", "value": "bb1a45b9565214a01f8fe010584d7ffd50c5bdcebb2395b7a435cad844093bb1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624928, "uuid": "e872239a-8334-4f7d-8c5e-c7e912e8304b", "comment": "Malware payload (Mirai)", "value": "7af00945bea835e2da8fbfb809de34b62b9c6e45", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624928, "uuid": "1e3cc8f2-436a-4218-9467-1a89ae114bdc", "comment": "Malware payload (Mirai)", "value": "d2112e9e6921628fa04a4a06345bba9a9e9d41cc38b9cd9683cfb77ef445ad16aaec2b5c81cc7854eb5b9312d147557d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624928, "uuid": "0873d047-4e2a-4a7b-9c47-21997cbbeb0e", "value": "T150813DC81330C7327DA28526A1B95AE433C495D355EB8FE1B2F73F619848E1C39A4B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624928, "uuid": "51ab556c-b008-475f-b106-9df3b9772305", "value": "96:vfIGIBfIPIXfIcIlfIKIBfIlITnfI+IhfIrIjfIvI5fIwINfIDIBfIkItfIG7IGl:XD4Q6P8rYSmf5scCCQ/o2oRUpUKeSi8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774624928, "uuid": "74e08941-b577-4c57-8e52-0150cb95b675", "value": 3825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774624928, "uuid": "b4a11ba4-14fb-42e9-ab15-6087446baf15", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624928, "uuid": "3ff654a1-2ec3-484f-807e-a5aa3e74976b", "value": "nullnet_bash.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d855d223-2a1d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774644309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774644309, "uuid": "425a452f-c526-444b-bed0-ec6b2e9940dc", "comment": "Malware payload", "value": "a4e3e5d32bd3af5900f4fa8e93784b67", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774644309, "uuid": "6ed4a9a5-932b-4e68-8f9b-6d1c1f45d855", "comment": "Malware payload", "value": "bc90528eafc36558eeaf6a2255b573df36eae72a7bcf0c645291a942187f30a8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774644309, "uuid": "b1be93d4-2a08-4e67-8fc0-e1ea2ff75236", "comment": "Malware payload", "value": "f921132e93057d4919b046032ef80f70e1c273b7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774644309, "uuid": "461bbbe3-5b24-4ce1-aec1-8555864b8bc8", "comment": "Malware payload", "value": "ec046301bb8eb81195a7a7b0fa020cb6fd5da825928cd1f93f92e6ec15d30db58edc071a5df3c409ab2aa63db718a13e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774644309, "uuid": "f6ecd8bd-bfa4-49d8-a296-96789afb15f3", "value": "T140A6335BB98E7892FE957376739389E709CC92CDA1915FB0799412E260307F34B9320E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774644309, "uuid": "5cfec60e-1380-4865-8cca-914a4aaa2d2d", "value": "196608:ZmafINMQ5hYeyKh5yVHZRw+h/aUbg+dHa99PVVMuGKsURT3oZbrXL6:nfINr5U59hC0g+VqVdGKsCqX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774644309, "uuid": "11ffa01a-6569-46f3-ae54-e8ad3281e701", "value": 10224225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774644309, "uuid": "9ac19262-9106-4594-8417-5420cea1ea08", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774644309, "uuid": "b43a025f-a5f4-4751-8cb8-085324f3a7c1", "value": "pouroneforher_FB-652d68aa-2714-4b84-843e-edb3d0375451.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73180c88-29b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774597754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597754, "uuid": "4bc4964e-5377-4653-be90-a8021e4d4e49", "comment": "Malware payload (Mirai)", "value": "74df16aa80ebee9b0a3507459ba516dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597754, "uuid": "32a8ef63-7f00-485a-9aa5-d651ee3be418", "comment": "Malware payload (Mirai)", "value": "bcda6a09f766b4e12a493da81cd7680296cf2b74b8eb99f45be5e9136fa7b433", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597754, "uuid": "169a7c15-6e68-4698-9c7e-009c5c1a8f2c", "comment": "Malware payload (Mirai)", "value": "258a8aa27ac030a8fb9757db7fd678db1cbba9bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597754, "uuid": "c34d7960-c450-47db-9e5c-1a6b08aeee83", "comment": "Malware payload (Mirai)", "value": "cdbb759b3e0690d8ed4b01dc582c0ddb430ed360897d2ad546265eba8b2cf70947d712977c836531e7b5c3820455ef42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597754, "uuid": "8476610a-4bdc-44d9-8470-278a02118ebe", "value": "T1F3F30787F901DFB7F40AE37649A308157530FFA60C625A72726379AAE9390C51473E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597754, "uuid": "a96c4b8f-8e63-4c1e-a7f0-d0c8492c45f3", "value": "3072:hh1xftQN/StAcy2s1iC/ryTQNKPXLfUxWcXJjchpVjjbizLA6jBY:hgzyToKPXDUTRch0LA6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774597754, "uuid": "4c95ff03-51c3-49b3-a2a8-8b4fe86ba066", "value": 164236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774597754, "uuid": "570a44b3-116e-4d0b-831a-9cd33bc3804e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597754, "uuid": "37cf7de2-214a-4b40-a96a-185ac085dcd2", "value": "delaware", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4cbe780-29f0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774624895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624895, "uuid": "bb0c4166-18d7-426a-9a91-1fa855fbb943", "comment": "Malware payload (Mirai)", "value": "5ee04076652e95f5fe5f1f98a6b035e1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624895, "uuid": "b38362f0-d5fa-48e8-80d2-83464f80a7cd", "comment": "Malware payload (Mirai)", "value": "bcf5aa14d139a865aa901f48c665139971a00918a699f4179bd4c468868d04da", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624895, "uuid": "fe41a536-de19-4f6f-987c-c61fc2379d68", "comment": "Malware payload (Mirai)", "value": "4db073ac74ddb19a28430f92a0c8ed54a4b4a743", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624895, "uuid": "a444bfb8-4c02-4e95-8fe3-b1d420b351c7", "comment": "Malware payload (Mirai)", "value": "30fcb5fd345f3ac7bf70fe46dc7d56a4286543e4a2bd128fa44f5ed952e2bb8a4dd299d05d09a4cc0fc3ca935a7fbc8f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624895, "uuid": "a0115704-c628-42f5-b255-10dfb35c1939", "value": "T1BE832981F8C741F5C4078D3460ABF23FDA32D57A81719B6DEF9A9E36DA37701911228A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624895, "uuid": "90c2ef65-464b-4ae6-bcb4-f9924eef25bb", "value": "1536:kXZocb2I1nkG7CT75ehFvwtnWic53ZYeJLUQXE5mkt:kXOE91nkACToh8nA3Z5JoQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774624895, "uuid": "cb29abb3-10e6-472e-a0a8-238a4e2df06d", "value": 86800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774624895, "uuid": "fe2f90cf-0a2d-41ab-831e-4318f6c26dc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624895, "uuid": "6ee58c71-47f7-4360-8a4e-f89ae6254e5c", "value": "nullnet_load.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41aac881-2977-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774572760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774572760, "uuid": "f36a00ab-5a85-4761-a7c7-590554a12730", "comment": "Malware payload (RustyStealer)", "value": "af93090871dea0e4fabbbefe6da57151", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774572760, "uuid": "e7b17ccf-6460-4595-80bf-584abe0e1045", "comment": "Malware payload (RustyStealer)", "value": "bd1e3a1620883ba23f135d979eff609054496fb0dd139d9d89add1c4942d6c74", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774572760, "uuid": "c73e7ac9-29e8-43e9-b25d-45ac4c0d343d", "comment": "Malware payload (RustyStealer)", "value": "47b12cee82bb3849d4803c7014d860249c58f81e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774572760, "uuid": "05e39f51-d16e-4201-8f24-a9c47d462cd3", "comment": "Malware payload (RustyStealer)", "value": "55822245af7f08c381f526267c61fa8719774feeb328d51356b798aa14fe2cbef465205945e5b5653837d5f073c3e30c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774572760, "uuid": "2b16f067-74df-44f3-8554-2d72095f595d", "value": "T18C86CF93812A56EBF3696734BC037192C0E975AEC71C9E3122F6E63CB954D64582FF80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774572760, "uuid": "1dfe1cbb-5e11-4b3a-ab9c-0fc0d807d0a7", "value": "be2085eec435a1549df9720eb686778c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774572760, "uuid": "0e18d46c-033b-42c4-957b-ba2c190e67e7", "value": "98304:jaMDOixQe03PZca+I74123YHj2z13iNnkT92I8693p8MgVPmfnBIjBcnUGp8u2wM:uMDmKwURfI+zEQCS3Lo2DtVZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774572760, "uuid": "e1282829-b851-4585-beb6-69e325b020a7", "value": 8034470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774572760, "uuid": "163757fa-e0c4-4658-ac51-b8cf25f78842", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774572760, "uuid": "c59bd88e-2757-4063-8625-09167be9dc4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbfd60b4-29f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774626652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626652, "uuid": "8ebab506-3cde-4baa-a3d5-614777f2c666", "comment": "Malware payload (Mirai)", "value": "b387406bcc3ad0a58b2169a80d6b60bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626652, "uuid": "1d5f666f-b5d8-4c5f-9a10-7b2fbb05cdd8", "comment": "Malware payload (Mirai)", "value": "bd459249e7e5f205ccd2632dd97e8ff39e9718f5c5610e478554c2cafd97c14a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626652, "uuid": "ff503c54-03fc-4a70-bcee-94786dc6587d", "comment": "Malware payload (Mirai)", "value": "aaaf6fc45b068364c28e0c480bad50231bac7f1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626652, "uuid": "5b5eb27e-b853-48a1-8300-47ba6255153a", "comment": "Malware payload (Mirai)", "value": "001f132ad9adc4d8ed63d707e5df823eacac1095cc18969701ff2943b05b36b37ff47af43f20a77cb4b0aeeeb699ff04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626652, "uuid": "58ae3c58-8f4f-4500-b404-ef3d81662f18", "value": "T140F208A2A7B94727C0A0637864F26703759A6FE404B0C34FBD440D5E6FD6390EA27BE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626652, "uuid": "48dbb6b6-cf54-4973-8019-0bfc7567cb6b", "value": "768:fzzrYOcGmu2XtSjD85iSP9cc7Tm3EKnMJtd7GVFHwTwMIZudt:rzrYxu2X885irg7Gmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774626652, "uuid": "cbbcead2-64c2-4fc7-9ba5-491d4bef02d8", "value": 35916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774626652, "uuid": "305a607b-e208-4d92-a8a6-ee25b03685cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626652, "uuid": "31c001d9-809b-412c-92ef-625df048a270", "value": "attd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ddde1e-29a1-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1774590885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774590885, "uuid": "480dfe5f-39c8-4ce8-9a2c-24ca22a1d64a", "comment": "Malware payload (PureHVNC)", "value": "b0ddf6b5d659968970673db2c70f8d7d", "object_relation": "md5", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774590885, "uuid": "90bfe9d8-ba03-4eff-b520-6c323621b872", "comment": "Malware payload (PureHVNC)", "value": "bdaf322335ba4001214867b81236fc4cb3d068e871f49554d250aa9a476b3fc9", "object_relation": "sha256", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774590885, "uuid": "abab2e9e-aee3-4a3b-be8f-5fad25acb31b", "comment": "Malware payload (PureHVNC)", "value": "77633e4176ab08e432bc46d78b60d71686be9b85", "object_relation": "sha1", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774590885, "uuid": "8147b704-ad4f-43c6-9eff-f7e5c0a1a6bb", "comment": "Malware payload (PureHVNC)", "value": "1863cb17c02a6c5748ac402ceb261a911700d8683be9bb5d6cce904dbc8bbd7ffedae96eae8a9441ce7b862aef3e3b72", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774590885, "uuid": "e4124c7d-73aa-4cf9-bcd1-99b3245fe13e", "value": "T10DD58E1DE723D819C98FE006EA1309F7E7BF6C14D45B591DBD0AB13986168B8325E0BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774590885, "uuid": "003765e3-4682-40a2-b643-45c07d1765f5", "value": "49152:4dlnRziGQ5pHpMl9l76eLqCsfLNkv+bsnY20e12Acq/U:B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774590885, "uuid": "acae1375-2efc-46e0-b0e6-fb98e6df7563", "value": 2878623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774590885, "uuid": "fd669ae2-a144-435f-97fd-6938cc8478b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774590885, "uuid": "a8b9ad7b-263d-4134-9c68-95e9456bb71f", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78de414b-2a20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774645438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645438, "uuid": "fd640bb5-e11d-4e7d-b853-0d2fa8d3d174", "comment": "Malware payload", "value": "2e18a52e67f61ff80f10a3a60f628637", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645438, "uuid": "9a4db1dc-05c5-4a62-9025-354e50050147", "comment": "Malware payload", "value": "be01508c3e99f52c8ab02c173ef4ef0b0aa7f3335877af56bbd56ea228a3285c", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645438, "uuid": "c0372470-9ec9-4515-a1ac-aa33cf111094", "comment": "Malware payload", "value": "0092a2b1772104be44fe4d3e2e92af3d390c24a1", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645438, "uuid": "e0b43d2b-22ce-4208-b128-320df5c852aa", "comment": "Malware payload", "value": "fdf322fd4c83d5c54b8cd60cfe771c3a3c32f939ca27a6d066de2d091abe6a4afa21dc8cb97692340e525eae1f52a4ff", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645438, "uuid": "75c9d6a5-3561-4e12-8f6a-338ac7525774", "value": "T127F633E229D580DDDE78907F63B1638E0A36D0FBD010E4B6632CE27EADBB571214198D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645438, "uuid": "d36fc703-2664-45a0-8eb1-27eb9ad9cee2", "value": "393216:zaYhKLTo61jUX5z+66/3q65gTH8z8v5Y7tE0F4wRzJfVKSggp7o75R:GzjEKj3qlTc4e4wznxho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774645438, "uuid": "dc074437-be07-4acf-a36c-aefd530a0b83", "value": 16758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774645438, "uuid": "2f09add0-92b4-4fbc-a2ec-cf763da8b800", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645438, "uuid": "efbcd30b-649d-4ae2-97d6-559a773f364f", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58873d54-2a26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774647960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647960, "uuid": "edf4bb5b-efee-4eac-a67c-509e4d5c70c5", "comment": "Malware payload", "value": "25491f8e4d312a5797fdaaa8eaafeda1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647960, "uuid": "32e2dce6-d277-4ecb-8a53-c36a43fd5df5", "comment": "Malware payload", "value": "be2d5ffaa8b7dc6d05530911f5e6a950a96c9ac65d7a64561ea80bb4e0c27944", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647960, "uuid": "0d9d2d32-48a7-4a1f-8054-e840f6d5d130", "comment": "Malware payload", "value": "9318ff3b904c581e0dce28f29653804ee3cf3787", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647960, "uuid": "56dba7f9-f39e-4a5c-bd14-baeff02420c1", "comment": "Malware payload", "value": "e4ed679f60de0164404fb04036ba5afb9a970ce7db0fde3db73ab0f2bf450accba42b40b4fa7920322ac665d0453b79b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647960, "uuid": "a09b8eb7-b3f2-42f8-bc47-d4e3e0d7c5ba", "value": "T13B546326EDC75CA683D3DBA3E2E7D21CBEA884EC801B5DC1F5B8C6825461D690349F4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647960, "uuid": "8db9b968-4082-403b-9593-3b422306ca4a", "value": "768:BU9x0pQRVrq6iEYkWRdM2oGX0Dvf1AoRbEmjBjhkC7Khj6sgqnb0+tsGtGmuUHET:wnKKevSGcd7Kl6XIPf0ecRGK3vyIwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774647960, "uuid": "385d5823-a493-4165-95fb-fe7115fdd359", "value": 295786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774647960, "uuid": "c1753dc6-0256-4f45-b053-af205ae5760d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647960, "uuid": "64b8978a-2d8f-45b1-9038-5f5d1f4fb869", "value": "test_seeds.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f5003c-29b4-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774599052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774599052, "uuid": "e43149a7-4da0-4580-8754-3f077767ee58", "comment": "Malware payload (RemcosRAT)", "value": "cb7fc17a937340ec93ae1a9eb2af8b3a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774599052, "uuid": "dd01cb70-46e0-4d3c-a5df-b3edb953f9ed", "comment": "Malware payload (RemcosRAT)", "value": "be38bb3d0febd6cfca7fee8eae103ac9f3cd7396c69312309ae36261766e3e17", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774599052, "uuid": "5a337e8e-11d6-4400-94cb-c410514b538a", "comment": "Malware payload (RemcosRAT)", "value": "9682d1582b2614cea077b586904a0a690c04e231", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774599052, "uuid": "37100c65-a92a-483e-a9cb-27028cd3a05a", "comment": "Malware payload (RemcosRAT)", "value": "c505f393693f635139549a67e2ff00c82e9c79268a111f03160488daa3018bb47a0ee23d389997ace0c00a7df01f340f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774599052, "uuid": "54b2c186-0ce7-4d1c-878b-2cf202a66c28", "value": "T168460805720CE3CAF6F8AF26841E7BF75F14F47B8EA0DA4939444C9F2574A067B21A25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774599052, "uuid": "c1fd7b6f-0ef1-4a92-adcb-0d2d79fdfec1", "value": "98304:sKt2JlEwpHVtSYxG0fWf8C59ZkYiQG71aYmkydsZOTR4vukrxFP9GYH5O4oWo95X:FylEwp1tI9T+YtG4YI06WFNaMFyCKL60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774599052, "uuid": "e6045e2a-2009-4c04-bce8-854ed64bea7f", "value": 5781763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774599052, "uuid": "30b40d4a-1e1a-404e-b1ec-ae50902b1f02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774599052, "uuid": "bd369d95-d11f-4de9-a410-5cc2db38fe73", "value": "New order_2026_101.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f0b3e1-29f0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774624956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624956, "uuid": "4aa2d2d8-f5ee-4b9a-a112-997242c27427", "comment": "Malware payload", "value": "4b9f5c2b4036a8d0a5d131c63d0b49e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624956, "uuid": "ea014dfd-a463-4717-a74f-236fd4d094ab", "comment": "Malware payload", "value": "be570de0dc914402e7de5f2f8082a5878552d105dea0e0700812d6769f7424a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624956, "uuid": "aa80949d-751c-4483-ac99-c1b5c0e1663a", "comment": "Malware payload", "value": "eea747710e68bf5c02f4bed98e2fff3d08149f55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624956, "uuid": "5c5268aa-1b58-4526-9b74-7b6e6c8cc84c", "comment": "Malware payload", "value": "c6974b6e75d0e2e61f6a2061bb6a99591b005c1f4c191283ca7c0fafc6897d519e971b8a8d65d3ef98f7bd8641f76330", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624956, "uuid": "d738c356-8fd0-4fbd-acc4-32cefa5d3bf1", "value": "T1A2B52343B3C34472F8AA0E38C87591149E373A7844F6A46F2EB9CD5D5D7D2828876B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624956, "uuid": "c988221f-412a-4ae9-94dd-7a9491c465a2", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624956, "uuid": "d770dd1e-d90a-4c15-b1c2-8bf54d608f99", "value": "49152:8BJM4+6Q8xMHHlg3qOwN1zSkKrIAu7jpLiW/u00rpLZZlqnLSKhj08:O+dUMHHlexIRSk6qpLiWRUjlqLxjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774624956, "uuid": "34ab415b-1d6e-401a-a967-f202c03fb0b3", "value": 2391960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774624956, "uuid": "e82ad276-a422-4720-8068-90039bbcc626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624956, "uuid": "d0dfeaa0-6b76-4fe9-983a-df1b39417730", "value": "infatica1140.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "769f00b3-29b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774600766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774600766, "uuid": "a9d86c21-1360-4cd9-ac33-4a55fb99c4b2", "comment": "Malware payload (Mirai)", "value": "1b444dff328a4f9fcd0d2fee75965d14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774600766, "uuid": "1fe39c24-4812-491d-860e-a2f5506d12f9", "comment": "Malware payload (Mirai)", "value": "be7af8b9c2b2a2c74ecdf106692d871364b39bca245c579e3e88b913a0b1b8f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774600766, "uuid": "ca187361-f5cd-4152-a547-71868d4c177e", "comment": "Malware payload (Mirai)", "value": "ef782b9862a5c913002de6a19c1e6022606c64a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774600766, "uuid": "1cff2b16-7835-45f3-bb12-b0481eab1d1b", "comment": "Malware payload (Mirai)", "value": "f465c4c75f1307cf3aaa6371cc2f7d640e06fead2989575fcfdcd20979cc0ad5733c4ef304c2806a9d789c5a24e3beb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774600766, "uuid": "2553027e-a6cb-41d2-826a-241d555fde1d", "value": "T13D4629029F442EE7C4EBCD325E3DC75344ADAC83518C6666797CCA5C7AA620B1E938DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774600766, "uuid": "be0b238a-b44e-45e3-9634-dfdfadb5e0d2", "value": "49152:B9eYdE4ZRg/e3J0qIRLCBtljQQ36zVrBhrouJ+yVUoHP3J:Bd14eERLCqQMVrBhrBRCovJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774600766, "uuid": "d78b50ee-541a-44ea-b42c-93f966249669", "value": 5422876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774600766, "uuid": "9b106c33-fed1-4236-886f-35a13e037b52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774600766, "uuid": "75279429-e8e2-4ba7-9ff5-e9334a7e6fb1", "value": "wlan.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca3240b-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774625123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625123, "uuid": "6b1dd71c-0d46-4676-b28c-7d101888c56c", "comment": "Malware payload (Mirai)", "value": "ff0a2cdb57c312b465ddf1a183223080", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625123, "uuid": "a69a63f3-b983-4c72-b159-6d7d03f3e4d8", "comment": "Malware payload (Mirai)", "value": "beb6d9cb02645765a63886090ba380908487e8d8e6e670aa4c7921100da5228a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625123, "uuid": "1c9e6618-87b2-464f-b9a3-31f7515c1440", "comment": "Malware payload (Mirai)", "value": "e4049ef54bd3a52c4927b216fe76a93bf9829913", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625123, "uuid": "4de9e3df-7e85-4796-918f-1d633f7a42f8", "comment": "Malware payload (Mirai)", "value": "2e8e3f6da7e9ee036ce61bebbf522c9e58e21f485bed10217e13da1534284e7af814596826828f40e4c26c8582068d2f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625123, "uuid": "432244a8-115a-481a-8020-4280e8a0aeae", "value": "T1F5330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625123, "uuid": "7e57de3a-dae0-4334-ab6f-2ce9c4155ff8", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oG/:r/hqaJMcjeqK806MHdMfQXoHuC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625123, "uuid": "1aca27ef-d897-4c96-84df-4bf514ebc66e", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625123, "uuid": "7137d666-a600-40f9-acbb-03cf7440baaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625123, "uuid": "45b4c849-aff0-43c3-8036-75f65f639cef", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6eedb5-29f3-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1774626039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626039, "uuid": "5f40eca2-9eb9-41b6-98d0-bc5c8adb947c", "comment": "Malware payload (PhantomStealer)", "value": "b2ac26804b19be5139122cc7c8d51bc0", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626039, "uuid": "7a4763ac-3eb6-4d8b-b663-cbd63ee03660", "comment": "Malware payload (PhantomStealer)", "value": "befc8f1c2008a7a3d19b91abc9b84009216ad4c8847fe8bf34eab08aec8ad9ef", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626039, "uuid": "ff959b25-8772-4cdd-a3f1-082c44f14af2", "comment": "Malware payload (PhantomStealer)", "value": "bec1bb7988d5101d3f6e942d4d9d31f53b4c83bb", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626039, "uuid": "ce3ebd9e-f069-46fb-874b-65fd78c848b0", "comment": "Malware payload (PhantomStealer)", "value": "8e75541223b13df2dd0e7d85293f770bb9a39124e3999abc701f06d7958bd915dfd4290eeb0536c73799476d62e0b8ed", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626039, "uuid": "f288ec30-ae9d-4f6a-91b7-8f543b0930b3", "value": "T10624232457B33EE303AF1916379D15F21B210477ABE20CC437D39AC12D5AAE7526BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626039, "uuid": "b7c4adcc-c933-4e2f-a6b3-9fa779f78a9b", "value": "6144:iClQqoGm++4mXcg6W0zvBlIIBg6dYOwS75EORX:iClQqoGm++LMqsVg6dYWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774626039, "uuid": "0fa370c2-2425-40cc-a527-203f4c336774", "value": 219603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774626039, "uuid": "7a708b76-85c1-41a9-b655-f9d4ff321cc5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626039, "uuid": "cf63cbeb-1930-4afd-9253-c3b5188d3118", "value": "#1920029920944.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e908a7-29f0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774624651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624651, "uuid": "a5c75390-af6d-4c5d-8c89-d4eef93cc5f6", "comment": "Malware payload", "value": "b3481213b5ffa7b1b95d591c9b569b2e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624651, "uuid": "50c8f8d1-1812-4427-a0a2-ea3aad677fe3", "comment": "Malware payload", "value": "bf527adffd3f8f2c4c96e0815174c97899041243a39cce816909765c859d64ce", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624651, "uuid": "ea0a81c3-e6d9-4e21-8564-bf3fccfcd3b3", "comment": "Malware payload", "value": "a815d780195ddcf3ebc1f32eb125d9876f1c1cf3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624651, "uuid": "4c858cc0-7240-4ec6-8fff-ccf07bf534fd", "comment": "Malware payload", "value": "0411d577bf5e6c3874e7efd8f44efc91f31518f5da4161c6cb4c3afcb2393a9dc226a70336edd97446ed8b6fc1eb13c8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624651, "uuid": "e981d45e-2301-4606-9091-d6756c999564", "value": "T1FFB012A720307200C30CB4409C3B8A1E6023C3D111741F0C78ED0730CD44400F810E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624651, "uuid": "c9cf65e4-b33d-4bde-ab58-326fc4585f61", "value": "3:zBMXBglIa0lIeP4vSXacweFGBzSEyLTUWLY:tfD0trXbgIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774624651, "uuid": "fd2febd7-b177-449c-b15c-2eafdfee1dc9", "value": 100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774624651, "uuid": "3bb17012-2838-4c58-b0a7-5e0bced120a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624651, "uuid": "866519b1-e2a5-4979-b752-1e2783f23699", "value": "p.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a68ae8-29f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774625682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625682, "uuid": "f4c2f385-921c-4c1a-9e96-658656eef3c9", "comment": "Malware payload (Formbook)", "value": "37685e8f86e314d72db011dcfa40a0eb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625682, "uuid": "e5580908-07f1-475b-88eb-3dbe15e01d02", "comment": "Malware payload (Formbook)", "value": "c0422a6f05507edaca77fc6bfcbf2edc1acc82e82877d281382aaa829f7013d7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625682, "uuid": "504b7f34-4e60-49d6-a7f0-4cfcfe16a701", "comment": "Malware payload (Formbook)", "value": "3939f6fb4badfd3233885a9d3f1b13b4faa54784", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625682, "uuid": "3d9c4fe3-9f77-4e57-bb06-34959e5c4b16", "comment": "Malware payload (Formbook)", "value": "7dfb79d4915243ac6099c80863b8f73f469c360627d2e3dd36b27449f92d739a9b1141ccd410bb04543de1ebb37aefd1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625682, "uuid": "73a59832-678a-43c9-8849-ccd4a2afd812", "value": "T187B65A84930D897DF65EEF1CD17ADAC0D98D23A645C9EF1D342DD2287B4A0536B8B0CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625682, "uuid": "fac2aefb-0e20-4181-a15b-549e9f58080e", "value": "196608:7mDE+NP0IEfxlpp/JMux+bEOoIAuvAmFQPIgcNa0DTrNTVve8H3UbpMJGIN8GOtA:7GE+NPifFDz+bE2AzmFuIgqaQ33W8H3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625682, "uuid": "0e21db8b-4c79-4ad7-b014-c507ed8d4f18", "value": 11053388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625682, "uuid": "f479bbcc-f6d8-4741-aa86-61e60436dac4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625682, "uuid": "48e9c935-9f92-476c-bb6a-d2a54d5eac8a", "value": "SWIFT809827736829.PDF.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3160490-2995-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774585943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585943, "uuid": "a50d2380-6b7b-43f7-83a5-d9d3d09b3a85", "comment": "Malware payload (Mirai)", "value": "f02e570f6519cc997cefea540a60cd9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585943, "uuid": "559b6561-2676-4d40-af1f-a81e5a98fdfd", "comment": "Malware payload (Mirai)", "value": "c098729c0f24b5e370613bc43a757e2c6114f1be9bffc8f6fee865ddd45f29ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585943, "uuid": "feb94a0c-e091-4838-803d-83cafb605188", "comment": "Malware payload (Mirai)", "value": "765fce36aa0ecbf1ee0278b724f9f5f019e89bdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585943, "uuid": "b8935f17-3261-418b-b9d9-33c3407be100", "comment": "Malware payload (Mirai)", "value": "32218a0f3e801892fdddc9f781ada22d012c71c6c28bf883e2574d87711050dd9c55c86075120f8452d4871e51dcc0c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774585943, "uuid": "48efdb18-d9a2-4f98-8ed0-42df0e26f803", "value": "T1D92619176F31DF1DF229813425738D725AD516E639E0859A933DF62C3E20A5B380BEE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774585943, "uuid": "a1ea8d19-04fd-4e02-aad7-b863cef3a9c9", "value": "98304:yQt3upJeX3z/da/r1nbCdfhCzA4CIs/QZ:1t3upJeX3xuNM4ls/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774585943, "uuid": "2cd1cd21-ffe9-465f-b8c0-c3ce71c62014", "value": 4599252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774585943, "uuid": "a800c1d8-ea81-4418-968b-4999360b8faa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774585943, "uuid": "cadb9505-27be-4e38-b880-faae63eb177b", "value": "wlan.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f3719a-2a22-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774646471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646471, "uuid": "357d2112-0e1c-4d6e-bdd1-50dbec43610f", "comment": "Malware payload (AgentTesla)", "value": "74b1f2059eb5f9d40a7e436294a4db88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646471, "uuid": "847184c5-bdc3-4bc8-b312-2e99ba1b5404", "comment": "Malware payload (AgentTesla)", "value": "c0f929fbda0636928fd4d45a72103f40cd108145c67d8b7e5d53485665cea25d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646471, "uuid": "1fb3ad96-9f63-4870-a1db-21a780f6c655", "comment": "Malware payload (AgentTesla)", "value": "88bbce3a83dfe4535ae2142c079256c5c5066f7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646471, "uuid": "2fc05cd0-fc85-4de7-aa26-8d0d80be7729", "comment": "Malware payload (AgentTesla)", "value": "faf3bd484f0181c1bdf0a3bbabe33a942aa467f81fc76e6987b17c31383183c243b8c5b6894917da67661e7a9079f2ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646471, "uuid": "ca3690e3-3ac3-46aa-896f-ffc8fa98a3ed", "value": "T1C565021189C42FE9CFEC571D90FE190FA3A04A8E5416B989EB73BD07BFAB60412171D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646471, "uuid": "4dc3a972-64a0-4ba1-93f5-d41688ae2feb", "value": "24576:S1MFzn8JPbHT+V1dS4AJ+tpEgIQHPokkZ561pbg4IF3k8K:WEC028QvUuvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774646471, "uuid": "8fb23c9c-b40f-424e-8455-c298ca7cd6cd", "value": 1496783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774646471, "uuid": "ed0aed0a-6dc4-4b86-9ff6-1b3a7f534289", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646471, "uuid": "c834dacd-e9fa-4014-8925-996ce1a84247", "value": "MV_VALTELLINA_VSL_MAIN_PARTICULARS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bcb67b2-2a37-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774655160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774655160, "uuid": "d68c69f1-ec2c-4c8e-9993-69ebebc42277", "comment": "Malware payload (Mirai)", "value": "9ce495bf35e2be015a3a20e845e1b7dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774655160, "uuid": "5fe028f7-70e2-4f63-b504-d89d71a9627f", "comment": "Malware payload (Mirai)", "value": "c2255234f1a3d8b59014fd1b5bf43119aa164349f135d7c4a5595301e62d930e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774655160, "uuid": "89717611-a779-49e5-b5d6-29128f2992ba", "comment": "Malware payload (Mirai)", "value": "ff69329ffc3271acb813d52519f8b7c56027a61d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774655160, "uuid": "123bb02f-f83c-4dd0-896e-a01887978092", "comment": "Malware payload (Mirai)", "value": "164263ee9195342b7e797a7b43bb3cc180c033f92660111daae6bb45e25a63bb9082042f7aac8bee0505838aac9ec532", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774655160, "uuid": "27b59fe8-6aea-458b-bfea-00b49ce69d9b", "value": "T150532BC5AA47DCF5DD1405703073FF369AB6F13A2128EA8AD79DA6B3AD42602E00735D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774655160, "uuid": "83eba1e0-b99d-48f6-ba2d-22284df0f93a", "value": "1536:Lugo/Y7kAs3fRWTei0EgKXt0L9UdZYgS3N7vd6DuK7:LugyY7fsvRWTeicSCL6dGgS3NDcDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774655160, "uuid": "e571166b-bcb8-42e7-9f0b-1f16d7961274", "value": 66544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774655160, "uuid": "03ff5c5c-03ba-487c-b91e-c5829dd3d830", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774655160, "uuid": "7ef2f872-a8cd-40fc-bf3e-b40c56fec58a", "value": "db0fa4b8db0333367e9bda3ab68b8042.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e51232e-2a1b-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774643111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774643111, "uuid": "47c1561d-4948-4960-bfb0-38e03b21bfc5", "comment": "Malware payload (njrat)", "value": "cb1724d06c8dfd5449741345bfd6ec94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774643111, "uuid": "e698f1e6-f15c-46fb-b3ba-fc428fef085c", "comment": "Malware payload (njrat)", "value": "c23d69bfea7793258d6b77664fe5d32c8217246ddb9e827b69d6db03b917e3b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774643111, "uuid": "49d6c31d-1d05-4ff3-b1b8-21e456ffdbe1", "comment": "Malware payload (njrat)", "value": "31c6d92e6a5ca40363dc2b9707df33487886ad33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774643111, "uuid": "0c6cee3a-6a7c-4e82-a8b3-2f8a7369ed8d", "comment": "Malware payload (njrat)", "value": "84693583d79210063f5a310156645728fae869379ca415d8b77ca1f22f840ecc226ce5ed2b28d01c576a94975481ccc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774643111, "uuid": "e171ffe0-a30c-4795-9ef8-51ca68306903", "value": "T11A972311A7655B3FCE5A8F35A97A0015633EC3CE7B5A8BCF2A50A0643D427481F63ACD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774643111, "uuid": "876307ff-bac9-4a03-8253-142fc0fe3234", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774643111, "uuid": "ccc58d66-d769-4bd5-b1e5-65499ee2ee9e", "value": "786432:tzd9ymsz0p4tEGOom1+fdlgxRI6CtejL7GP3PZiLdnUwsTvYmvdk:t746GZmul4dPqHZqUwevpvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774643111, "uuid": "87a84889-86dd-4658-986b-5e943751b899", "value": 40158208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774643111, "uuid": "d09144f8-6007-466d-b323-bf41b2f4759f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774643111, "uuid": "8f949f2c-487e-4868-89d5-b9883d6e59f2", "value": "Syndicate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b112fea-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774625148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625148, "uuid": "64f2dae9-0be3-4e2c-8513-29e884e1bab5", "comment": "Malware payload (Mirai)", "value": "dba53f0a3e1bb9856c6af154dc32f6f6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625148, "uuid": "2fa9d0f3-7e64-4ce8-8fd6-e516cc3207ef", "comment": "Malware payload (Mirai)", "value": "c2f052c858b23137ac9f60e049136525b4363b72c0a1ec6acd8c52c24ec2e915", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625148, "uuid": "b30ab665-44bf-40b9-9233-e0f9fc50d5de", "comment": "Malware payload (Mirai)", "value": "a345137d7d9a3aac32697f8bc02771688b26710d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625148, "uuid": "10cd9ac6-921d-433b-952e-603f05c76bd1", "comment": "Malware payload (Mirai)", "value": "3a637d3eaea6961302925397ea63a4bc99eb268d48cc56038f6a8890512f00f95ea0f338b7ccb08f13c82362d834b45b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625148, "uuid": "8466d861-83b9-4354-bb31-179dcaa7f460", "value": "T1ACA2E115BF1C86CBC8326A3455E9FAD22292FC71F2ECDC192940C15FB5A33A92474F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625148, "uuid": "55671664-337e-46eb-a34b-ce65ae6ae056", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKO:O98o08kxofBE+ZkXaqGbp2F2TWul0c5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625148, "uuid": "cbfbe531-44d6-4f0a-bdd5-642557174135", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625148, "uuid": "c0e4dad1-ef1c-406c-bc06-6d0f29360e72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625148, "uuid": "b6fdeee8-4c65-4799-92f6-fe82c0114279", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbad4a37-29d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774612049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612049, "uuid": "1909200a-c777-4c24-a809-40fd2d08763d", "comment": "Malware payload (Mirai)", "value": "54f9c3195dfa856a070e84399e4e10b5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612049, "uuid": "10d888ef-2dff-4590-a8d2-c7e6955daa8f", "comment": "Malware payload (Mirai)", "value": "c3af4788511f89028804b44bacd4ebff2e9321d5ca7256da3cffc159159317e3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612049, "uuid": "d8d04636-f192-40df-a2fe-d1ae7cd05d8e", "comment": "Malware payload (Mirai)", "value": "8f8e74a40d997ef3b234ba76f8699c31e6db0f67", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612049, "uuid": "51f2bf05-6cc2-492f-9a1b-aca24ea5688a", "comment": "Malware payload (Mirai)", "value": "8939e4734cd6471775fb0aa2814733f923d8ea014e925d321778f6e8ed9a2f1f1f40628a2c13eb8929ebdaee52186d59", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612049, "uuid": "e1b819a9-7f69-402d-8b73-79332861677a", "value": "T192833A47B98190FEC499D03847BF7537C923B4BE1239B29B63D4AE262D09EE01F19746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612049, "uuid": "796dca2d-be5f-4a23-aec7-593603e107fa", "value": "1536:MqbF7IdAcsgpY+JqqWEVkCkj6Rv3U8GbdGrAyvQcol:TF74AcsgpPqaVkCdRvAbdGrXQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612049, "uuid": "c3c2d304-9c60-4055-9535-d243960ff56f", "value": 85904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612049, "uuid": "666f8545-2929-4792-94a5-e78666f01127", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612049, "uuid": "071cb967-b165-46d1-b118-d7690e1e7882", "value": "windy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fb9fef-2a2e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774651602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651602, "uuid": "6e01a26d-6ed4-470e-b53e-c32ab80a0708", "comment": "Malware payload (AgentTesla)", "value": "a2cb95b5d04055e9e517a37642b8737e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651602, "uuid": "037f933d-c66f-4246-9c73-1ef25be3981c", "comment": "Malware payload (AgentTesla)", "value": "c3b62680b34fbe6fdaf6e06f9d83adc29d93d0523a61b00681dc06017fc70095", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651602, "uuid": "af7e8b34-6982-4dcf-9862-a45b25d70c84", "comment": "Malware payload (AgentTesla)", "value": "89b99fc2877e9621274844ba96eea9e178559444", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651602, "uuid": "d3e22da6-6836-4799-9a14-fe7d00e0f321", "comment": "Malware payload (AgentTesla)", "value": "a412d2eb597b4a55ebffbc8af6dcadea6a43f1670ed463d965adb9dd6169aa0a7c58eb4d9ffbc33084fc4d1f96cb0b70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774651602, "uuid": "e33c133e-b9b1-4dd7-8908-6ed7b59b8e74", "value": "T1103533580DFCD0E21F3244657DA0E0A04B7B45E658A3F9729DF835528FFA2E533A079A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774651602, "uuid": "54504f27-38d5-4d4d-b842-632dc785a9e2", "value": "24576:HI+KcmamJ2e8YqBG6znkEQ+DyXtDpFdjpTxY4mvKOK/YemKG:HI+KdeBNVQ++LFdjpTxdyKfmKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774651602, "uuid": "8a130888-876d-43b2-81a1-280489c14384", "value": 1073307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774651602, "uuid": "dba83b6f-df0b-49ee-babc-45e0fb61e2f2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774651602, "uuid": "781f5baa-e8a9-49c8-bc5b-9b0702490283", "value": "MV_BRITOIL_COURAGE_ORDER4756578.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9240ee9e-2a0e-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774637749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637749, "uuid": "4f7d9604-be15-4b52-8ccf-5fd96f7319c5", "comment": "Malware payload (ValleyRAT)", "value": "ffd7f983949b2a14f9ab7e678ad5f63e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637749, "uuid": "52e5c9bd-2e05-493a-9c62-40bdee150794", "comment": "Malware payload (ValleyRAT)", "value": "c402d596da833821d27a1d75cca1679455cac65ed3b94ce3e28d155b6c71b5e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637749, "uuid": "3ec00deb-2f47-42ab-b805-16f521c035f7", "comment": "Malware payload (ValleyRAT)", "value": "53920f48176af2f3c3a10ad32d3188c83493bbaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637749, "uuid": "9c51154e-390b-4b3a-9b29-1cf30b2192c5", "comment": "Malware payload (ValleyRAT)", "value": "52fd5976dc24b8b3ad57b58d84d2fb9517a61e2a7a8a697f1ea208a31905a80cd08c609267f87395de961a46a454dd43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637749, "uuid": "d80c9148-8909-463f-b376-4eece13617f5", "value": "T1C68733FD339E5959E8AC617B05B497A4C306721B02DD9CAB9840CB3A34E38D5636CDF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637749, "uuid": "5998dd1e-ada2-4684-a535-b2683ac091e1", "value": "8c4c69111630d8599dacdb4710373322", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637749, "uuid": "c84a8867-0b2e-48ff-8b79-73ef1fb9c82b", "value": "786432:RVTYnr6SAGzln6N2UErcApnYLK6mOJJdyoIEWikaGNt6o181vNOXbRNZ:VS56N2UR8y/IZ6NfOrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774637749, "uuid": "2c78f8ce-58e1-493b-b7d1-0dd9c124e8c1", "value": 38720849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774637749, "uuid": "66077fcd-79a4-4727-9512-b6d5da7f0b97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637749, "uuid": "89bf6c8c-5e03-4c4d-a9f6-968d0ba46eea", "value": "fnvpn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f39b5c0-29b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774600727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774600727, "uuid": "540db9e9-0656-48b7-9834-829068584d0e", "comment": "Malware payload", "value": "6694648694e6a5049176d7c777ae78f2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774600727, "uuid": "93bb51b3-78b0-4d60-8f3a-f143cacfbf05", "comment": "Malware payload", "value": "c5494461becf319fe4ee0e385c611b2217b140c1584c1ae0509e4c71a958dbaa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774600727, "uuid": "89ad6461-2b1c-45fd-9e6c-157e4ce3ce1e", "comment": "Malware payload", "value": "400a472b925489fe0eb8e4cf5e7b6cf523a2fa7a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774600727, "uuid": "da465ca2-a2f4-4cbb-aa6c-6fe89f47a64f", "comment": "Malware payload", "value": "4426c51104763ce3ebedeb99eff7aadd3839472c8ba66fc36a0d7befabe44f3e4884854cd990bd808f63090fc3eb09e6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774600727, "uuid": "086d0a27-19bd-4fd1-876c-25049f4efad8", "value": "T114925BB916496C79BBC1CE7D9F3C7F0CADE881C02218A39CBA4F39715A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774600727, "uuid": "aed7cc7f-57c4-4434-8ca3-350ef184cc3d", "value": "384:ar0M3vgRjGlsaq72zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:afmjfCzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774600727, "uuid": "2254fafa-82ed-40f0-a6dc-b2a1364e8400", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774600727, "uuid": "dc4bf363-b45f-42b0-9e3a-cfd6049fe95c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774600727, "uuid": "fc491ae2-74db-4e1e-a384-2655ec1846d9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3523281f-29e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774618695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774618695, "uuid": "890f4b5e-0bd9-4964-9bac-55f54ef88fe0", "comment": "Malware payload (Mirai)", "value": "820b87f3b6cc99d825e668310de979d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774618695, "uuid": "5be607a2-4cbf-4e9b-be21-c6ef87fecd86", "comment": "Malware payload (Mirai)", "value": "c5a5563db33671e35515f974fa65d6e94c8c6ff9b9ccee596aa96269fa4e4e1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774618695, "uuid": "94a1a10a-39cc-49c8-8315-929a43d9085f", "comment": "Malware payload (Mirai)", "value": "45bd637404cdba71eecd6ada7300d6b76ac1ae9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774618695, "uuid": "f7d3d851-1cbc-48c1-8c51-4a259259610c", "comment": "Malware payload (Mirai)", "value": "00cab95bc58458eaa08e6ad3fe53b4cba480485cb723ec139890f7458f53148e5d54ac876ae08c0e740df44c9e0e9305", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774618695, "uuid": "21abba6c-3774-4a8e-a3d9-1cb23f88a5ff", "value": "T1D4833B07F58280FCC48AC1751B6FBA36E832B1FE1238B15B77D0EB126D49E612E1DA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774618695, "uuid": "86c8f4df-46e1-4827-b269-e9949a4eb7d5", "value": "1536:tPx9wWTcpwan0FCsd9xJ3ZwzTRIUICrB3KCy71jS08PJsIseQdqMNDey3:+WQpPnQZX3ZwzT/13KN1jS0MsIJQ9ND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774618695, "uuid": "ffeb8660-3bec-4e0f-b082-6b22aece27b9", "value": 87072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774618695, "uuid": "2cfc529a-4220-4ce0-a06a-27e4ca160b04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774618695, "uuid": "8277f772-20f0-46c1-bf5a-2721c856bdc8", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb0166f-29d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774614819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774614819, "uuid": "b2274a0b-1c92-4117-8147-7b14c4f8e9cc", "comment": "Malware payload (Vidar)", "value": "7dd1a357fd85616e59f945af554d10a3", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774614819, "uuid": "e726daaa-43af-45ee-b3cb-fced5fa3c4ea", "comment": "Malware payload (Vidar)", "value": "c5ba01490fc242514ff588e060b79b1afbad2fb5afa8b5bcd5c7d61b65ca35c2", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774614819, "uuid": "89036c15-203d-4e85-9d36-661674ec2989", "comment": "Malware payload (Vidar)", "value": "cf5d0aaa23812fc38b842eac9234ed021cdb3db1", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774614819, "uuid": "befd1883-1a9c-4d49-bdc4-8809a41b1efe", "comment": "Malware payload (Vidar)", "value": "2b80c461bea653514d41fd292d95f32811b1b94e56c078f9616a3627ab3ac69c6089fa4a6f12ff82ecb89131d985c2e9", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774614819, "uuid": "f329673d-cdf2-4029-868a-c4c3770e67f7", "value": "T1F1B58B0BBD9458E6C46E937289B651927B30FC490F3223C72E90BA782F72BD06D75758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774614819, "uuid": "0dffefcf-64e9-4983-b8ef-d2a60633f767", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774614819, "uuid": "8deb5c5c-e22c-4a6e-b675-7a8e98b16dc9", "value": "24576:aDGgJ6fC1GBHGJyTpHt3hYRHLtMJ3dJAkLBPvWPFWtP1aT0xeN:aqmIC1GBHGJI3hYR2J3d+kt3WPFb1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774614819, "uuid": "6f95477e-cb39-49b9-b387-572d1781da66", "value": 2376328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774614819, "uuid": "9245ed7d-3038-4cf1-80f1-9177a714aba2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774614819, "uuid": "9d8d8993-4492-44eb-ae7c-785bb08dfa6f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1fabbf-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774625201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625201, "uuid": "888695ce-fef5-4309-a3f6-f572df04549b", "comment": "Malware payload (Mirai)", "value": "a1a4c972da447a0aaf4517b211ca7351", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625201, "uuid": "781b5621-6d29-470c-b43b-4f88841d70e3", "comment": "Malware payload (Mirai)", "value": "c6a4bc9029c96fb56875d30b699527acac92aa602c55a390fa276a5502733c81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625201, "uuid": "7d664684-7552-4229-a2fb-6184a218ec2f", "comment": "Malware payload (Mirai)", "value": "6dc94671760053507d0be6303b17906c7728dfee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625201, "uuid": "1e97ae97-24dd-423d-a083-94e8ebeef4ef", "comment": "Malware payload (Mirai)", "value": "0114cebcd6aef788e1bd60b43fd8605f10ab0782dfef0b909fa97f8cc6aaa718a79ac2b16055f80f70b9cfb29d0cb24a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625201, "uuid": "00fef6de-4ada-429b-a887-8e7d44a12dd2", "value": "T19B73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625201, "uuid": "b5ea069d-1c12-499f-99cc-9602bf835c97", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStZ:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625201, "uuid": "544476cf-f2e0-4ec5-bd41-5f2945d90af6", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625201, "uuid": "45bc781a-c925-4594-b42a-907f04486af4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625201, "uuid": "8a51d22f-aa20-4fde-8634-10ae5f696fad", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65ec39b-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774625354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625354, "uuid": "53c2d917-faf0-4eab-b838-0b124f3f5dc4", "comment": "Malware payload", "value": "bd8290f6811c575389f8df0c227149f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625354, "uuid": "f5dd72de-04c0-4cbc-afa5-4eb142bcf2e3", "comment": "Malware payload", "value": "c82d78c32bc597ab034b2440a9e666569ca3e635163f73aaed066dbccd573c6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625354, "uuid": "b87b42ac-9c55-49c1-a50f-984de5d74e6f", "comment": "Malware payload", "value": "f96c41444f929c9eea06f710808a056c0f81c0ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625354, "uuid": "0bbf3897-239e-473c-8a87-8606c8656b3f", "comment": "Malware payload", "value": "4a6dd9818ef04ba30ee8b5a276bc150ebb57e55f9938e8a63e5611817479f6c52c642db2882d2d7d06508310a76584d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625354, "uuid": "568c49a4-2167-431a-8067-68882793903e", "value": "T14DD4AF1B72458D60C1486637D1CB8400E3F169A6B667E70FBAC923560A473FEDE4E39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625354, "uuid": "6f4d941d-07b2-44f8-9ff9-7b48f7848b2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625354, "uuid": "22e5ccea-982c-4760-8b5e-d4dbfe9b517d", "value": "12288:ccFSdQpPZq9vESk7NTktGW6uBgyprmqpYLmCtQ+/U:8yXqVExwsKL5p2mqj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625354, "uuid": "5dd4ab10-5ef3-4b49-a4a3-b9022588f482", "value": 636416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625354, "uuid": "ec312562-6296-4626-bbf2-619cbccca2d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625354, "uuid": "b80a59f9-9692-4ddc-8286-308ef75a6b75", "value": "bd8290f6811c575389f8df0c227149f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953134a4-29b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Hajime)", "timestamp": 1774597811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597811, "uuid": "d80f3d0d-7791-4bf5-a894-c761c05b1fa9", "comment": "Malware payload (Hajime)", "value": "87b2f785a003e85ca75ca3b07f94c89e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597811, "uuid": "2c6eb093-155a-497e-967b-0dbd74c01869", "comment": "Malware payload (Hajime)", "value": "c8864a6db3f2fc370968e2cc6216f19b6d469a438f365143ba80e4b1f0a58694", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597811, "uuid": "870d71f3-b638-449a-af38-2aa1aa656603", "comment": "Malware payload (Hajime)", "value": "7c92b6b63edd3e5b52d622c98af73375b37e9b75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774597811, "uuid": "e63aa452-72d5-47bb-98a0-d260d0043e1f", "comment": "Malware payload (Hajime)", "value": "acbf97e95b28287572b9c3d7f5e9820a73ec015627d83518f791477da0fca21c65db8487cf7350f2d7da3d53bd8fef61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597811, "uuid": "9e1591f1-8ed9-4892-b9b7-c2c7b966c764", "value": "T1FF853393BAC4ACE56CDA41A385A27F3484D004E06D6BAD642547F92371FB17A13D13BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597811, "uuid": "20c21a1e-7dea-44e3-b562-f23f2ab46b00", "value": "24576:+yyWc9h5XQWlFEqEwYin0dxUS0hlAyMvqNtZHfxlL7T4OlRcFpbxLImhkWtHEkiv:+yyHlQWEqEws6jAYtZfxZQvLIUkWWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774597811, "uuid": "594bd9e4-d536-4d3c-b4cb-0aeed45d9480", "value": 1860976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774597811, "uuid": "e1e61ab3-3091-4dbc-a263-fa7c6d818380", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774597811, "uuid": "6ceaf711-a36c-4916-b46c-bbb6b1ece48e", "value": "wlan.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41379f9-29d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774612009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612009, "uuid": "d9b4ba44-3951-48dd-91ca-9f64424a2974", "comment": "Malware payload (Mirai)", "value": "81e2b69e2f9c557012d175ab09b92cee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612009, "uuid": "6329be58-82c6-45f5-a503-076966e38f6b", "comment": "Malware payload (Mirai)", "value": "c94788093ff41c68f89fb6fc49ebb56564e91cad5d3c211c38865c22a44b78cf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612009, "uuid": "94dc7478-42ca-468c-8d80-0abd7fcc7ae5", "comment": "Malware payload (Mirai)", "value": "9a94d2debd2fd12e9a2a2268940ce9057ace6cef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612009, "uuid": "97f69545-46ee-4039-839a-83681f3d45a1", "comment": "Malware payload (Mirai)", "value": "002e76d69c674aec59a746e203cf6c8dfb9ce84c58ea18ab0a1c76f8851a8655150c489d350c2e916e4e091563e7ef86", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612009, "uuid": "fa3f6a57-9520-4d9e-bc84-5780c49b0421", "value": "T1B8A32946F8814A21C5D512BEFA1E318E331357BCE2DE73129E14AF2173865EB0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612009, "uuid": "8e147d43-7231-4e73-88a1-e6360c5b11f5", "value": "1536:wAnTSlO27kf5J7ZLBpqpp8GBgHQxEE3k7uaRrtOXrD0Rilp2x/F0v7Xh5GYWv6:ilRbpp8Suik7uaRgp2x/F8ThULv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612009, "uuid": "f53046c3-9740-4727-b4b8-88f083354d43", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612009, "uuid": "add43257-5b62-46dd-9299-4601bec2018d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612009, "uuid": "e9a4411e-d071-470d-acdb-dfb7a413e05e", "value": "windy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915927ca-2a21-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774645908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645908, "uuid": "0b3637a5-27f8-4535-b862-57cd9c832c26", "comment": "Malware payload", "value": "8e81d63f54fbee3d03b88df55acd0799", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "fiker-cattermicoffa-sbs", "colour": "#11C8CE", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645908, "uuid": "b4962185-0445-4235-a8d2-9de26459831b", "comment": "Malware payload", "value": "cb2f9181c1bb359b2563f784edcb066f09c55d3ecb881ac8c7c173a2997958c4", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "fiker-cattermicoffa-sbs", "colour": "#11C8CE", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645908, "uuid": "0186c297-f9af-48fc-8c02-167545f102c7", "comment": "Malware payload", "value": "d517b2df8863c8c852aecd5254cf696dc11b9737", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "fiker-cattermicoffa-sbs", "colour": "#11C8CE", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645908, "uuid": "f69963a4-1a39-4b1a-8ba5-d2e5afc1d28e", "comment": "Malware payload", "value": "e21329b2b060b052145b57a52bee06b8c4bb8cc56cddc1b0ca90ee8688f577f9a4540441c1b344ef02cece1aab7cbb33", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "fiker-cattermicoffa-sbs", "colour": "#11C8CE", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645908, "uuid": "5810b57b-7f2c-4c22-b3df-e00b20112802", "value": "T174D6339CE5792084D56CAB3DA88F037267B1E30B1E69DB0FFF2931185CD71752A64B0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645908, "uuid": "039f2fca-e7ec-4a57-b211-f5d4a395f8ed", "value": "393216:+G7EqxBLGYtoxJGtdImVpXdAPPBgVK45bfgEdD1udNi3If:+G7tLGYt2GtNVpXdAm7hfBbgiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774645908, "uuid": "807bd2e1-08ec-47b1-a8de-0d75ad1ab82d", "value": 13589809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774645908, "uuid": "4d3272c1-535a-42b3-b9bf-0724507e5e47", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645908, "uuid": "58289627-8127-417b-bedb-c090acd14c74", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6eb4553-29c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774604310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604310, "uuid": "68ddff8b-6b06-426d-a3c8-ce7320bfdcfa", "comment": "Malware payload", "value": "cc1e2344c995c83124cca1162759f265", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604310, "uuid": "04ef00ea-cfe1-4174-a136-b9b9f933457d", "comment": "Malware payload", "value": "cbf744e397e2bc34ea2a8fe5cc533bdd575346231300feb7b7e3d8f985626112", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604310, "uuid": "e9cd1ebc-e85d-4a45-914a-d3afaaf6bffd", "comment": "Malware payload", "value": "f27b1d07e91abf8cf3fa75461263a0cdde4c5c1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604310, "uuid": "62fe7a81-ed2a-4a9b-9b0c-f46ba96f5ffa", "comment": "Malware payload", "value": "54df3b614d02015bdab8ff5b85894b09921b39d0949e41a91299cf6b87446c55f0a5a9a0ca299301299c4305ef61be77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604310, "uuid": "022a3ed5-8c8d-4c61-afa1-d18abd439a88", "value": "T1AD958D03F65585F8D49EC078835B9233EA32788E4A30B6EB6BD45B253E66F906F1D305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604310, "uuid": "0512ed69-d02a-4240-8140-c6bbd20531dc", "value": "30b79772c4cae75535ce3fa79f39513b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604310, "uuid": "86621b01-122c-4a5f-b52a-c0c834a0ddde", "value": "49152:dQZSGs0GjeYnb5kdXxF1Nk/PkrCL6CIWQx7aXsqCg+Ujg:kWnb5k51lmL6CIRisJNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774604310, "uuid": "cc4ba4e7-2b07-4f1a-a762-0c70d4184135", "value": 1879264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774604310, "uuid": "89170383-b1b0-4b52-9c24-b90b69255c31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604310, "uuid": "fdefc1a9-1c48-437b-805b-f7a2ae886018", "value": "Leaflet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a176c4d8-29d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774612005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612005, "uuid": "2fc7d3b3-d0f1-43f4-949f-e3c790dfae39", "comment": "Malware payload (Mirai)", "value": "ae09f3587c143866dccef3480c6f0cf1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612005, "uuid": "ba57f7a8-7d79-4f2c-a0cf-27b792eddbb2", "comment": "Malware payload (Mirai)", "value": "cbf9f922a247124ae27ed15aa99791a6d621419d3092300066caaaf87432ddc7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612005, "uuid": "e5defefe-509b-4771-9647-b90aedec7440", "comment": "Malware payload (Mirai)", "value": "eb72890e85f810d329b6eff4870b0c075424d1fc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612005, "uuid": "58e7339e-049d-40e3-a847-e812a7e9a95d", "comment": "Malware payload (Mirai)", "value": "2b5a4db238a8cbb6406103f4eaa9fc374e9c8548c2c2e054d8c64845595793540325c86440382d0ec56dbf372c41fe16", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612005, "uuid": "47609b79-5300-45f6-aaf7-9902ac45127b", "value": "T1B404BFA3B34F2491C87106F80BCB6B9D262361125DA7DAD76C6F753A5E375DE08023E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612005, "uuid": "0b480769-b04b-4d85-bc2d-d869b1b4ea4e", "value": "3072:ADBdjwnSSY0VLtsYPtkchPPd2WenqkxJjg/ClTK3KiyVq:mX0LsYP2chXdCqk/yCdK3sVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612005, "uuid": "4c0f9b48-d4b7-4c6a-821f-52654ca1d9fd", "value": 173700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612005, "uuid": "6b838f05-00b0-4cc4-9cc4-302f50a4b53d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612005, "uuid": "5a5a2fee-d13d-48c0-b6b8-88c745953db8", "value": "kurayami.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376b7ac4-2978-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774573172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573172, "uuid": "d29a69d3-0923-40ca-8b0d-7a2e6e9c3035", "comment": "Malware payload (AsyncRAT)", "value": "af073644925b2581d399d7ec5667a439", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573172, "uuid": "b6f516fd-3351-4813-a7ab-013e77167311", "comment": "Malware payload (AsyncRAT)", "value": "cced572145b10760c3ab272d2865c7143675384a642e17ec0beaa175d4b233f4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573172, "uuid": "f682d9ba-045a-4bdf-8276-177fe3ffca77", "comment": "Malware payload (AsyncRAT)", "value": "0378f2094b7918fa2bb93cc0e1b9977e17bc01bd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573172, "uuid": "5dd5b73d-57a3-4579-9b02-5e7cd09ceeb0", "comment": "Malware payload (AsyncRAT)", "value": "20cbd0b6195f50bc5f6a3c62d52c928c7f45fd0f5b07f73ba02285ac5f5c0b4431a9129dc6a292d5564719712ccd4d15", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573172, "uuid": "697db516-f3f2-4ea1-ab28-cd05713d54c3", "value": "T151E24B483BE48327D6FE2FF229B2910102759517D923EF5F5CD885AB6F67A8142013E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573172, "uuid": "5d8be5b8-1aa7-4c8c-8bc9-d806176f5457", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573172, "uuid": "b953a0dc-4201-43c2-ba18-3d41bac9a5ed", "value": "768:JrgECfLHrMYAoR/iw2uBFE9RR0OqhAbU:tgRTiw24FE9RmOqaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774573172, "uuid": "8f023fea-ac33-4170-be26-b197d4806b0a", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774573172, "uuid": "438933f8-a694-47bb-a82b-caa37ddda80f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573172, "uuid": "3cdf6284-00db-47ef-985a-9796a3b0e58c", "value": "XClient1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de867ee3-29f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774626710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626710, "uuid": "5250441a-4717-428b-ad4b-b58a335ada10", "comment": "Malware payload (Mirai)", "value": "b2bc50ce91bcbf762ccbbe3608f1f299", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626710, "uuid": "03564169-dd83-47cc-8af1-a83fd507dcc5", "comment": "Malware payload (Mirai)", "value": "ccf87a7f2bd2ebac2e6aad00634f961afbf20eadee0034b23b8d12e03d170223", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626710, "uuid": "85d6b9d4-ef88-4393-a85a-86b66e59cf8d", "comment": "Malware payload (Mirai)", "value": "922a09670bb4d97188834fea089d9b18fd16b814", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626710, "uuid": "402ab168-7c71-4c73-99c2-1c5865a4d628", "comment": "Malware payload (Mirai)", "value": "b51d9b9093ccf91bb37336094919225169a683c500178bf6be5478528034e1346c686b555f09e64ae1ac61ab52fb401e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626710, "uuid": "b79bfb44-196a-4016-989a-abee740489ba", "value": "T142142946EB404B13C09727B9FA9F43153323DB9497E773069A28ABB03F8779A4F62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626710, "uuid": "72f079e1-33af-4ab3-b2b8-ed2da35ea4ec", "value": "6144:JM1gG29y/eAaPvdpy+omuM1tCSTt+ZV/G0No:Jcgzy/eAaPvdpy++uU1/no", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774626710, "uuid": "feb532af-712d-4b9f-9f7b-3eb36b545088", "value": 204329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774626710, "uuid": "46629dea-fe20-411f-9e4f-b833b9fc1e59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626710, "uuid": "a0b23213-aad4-4142-9055-681dedfc6231", "value": "net-workd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b351ca81-2a23-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1774646824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646824, "uuid": "72bb350f-e83c-46fb-bfa6-4823ffeaf881", "comment": "Malware payload (Smoke Loader)", "value": "8fe298d7020f99428c4be9ec07dd8548", "object_relation": "md5", "Tag": [ { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646824, "uuid": "0a3d8145-eb3e-4696-a3e0-515d09b6f7c1", "comment": "Malware payload (Smoke Loader)", "value": "cdd664900a1fedc71a12aab41965a16fcab584ebd54576398d5630abf71de335", "object_relation": "sha256", "Tag": [ { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646824, "uuid": "ab4eb8ff-7610-4f3f-881e-4baaf1896fd8", "comment": "Malware payload (Smoke Loader)", "value": "609842877e6047036138a2c6fc784df611aaca56", "object_relation": "sha1", "Tag": [ { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646824, "uuid": "99bef8c8-b573-4e04-b544-480eb374a72e", "comment": "Malware payload (Smoke Loader)", "value": "ca02e1f6f233f52e7c8b281feda4bb5bdb513a0a46f1c0701e08d6f26db3bb2ee315e8253c877e7c0f4a995d231085c8", "object_relation": "sha3-384", "Tag": [ { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646824, "uuid": "6f15a8d7-0749-4531-ad29-6ce537f9bcbe", "value": "T159853A0BBC9544F6D06AA73288B36192BB70B8490F3123D76E90BA7C2F76BE05D75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646824, "uuid": "047f718a-ce7c-409f-a53a-d92e5a27970d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646824, "uuid": "58d25433-35c3-4d45-a89a-df5855f8e28c", "value": "24576:8G+VE4ULHg0sYBEJsC5LXzRkdK2stTN12DeleNK84HTwwb0ve:8G+edLHYYCJLxXzR2sjdzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774646824, "uuid": "3c40527f-d24d-4ed8-a644-0fc47233d1d5", "value": 1769624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774646824, "uuid": "a0fe7492-8755-4949-b09b-28530ff92ad4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646824, "uuid": "64083f9d-4013-4b9f-8a96-b7cc12c675f7", "value": "ublp1F4WyzH5KP0dtyROIvxZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85cdd1d4-29ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774623984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623984, "uuid": "a66ea837-c510-43c7-a86a-eed583f840ef", "comment": "Malware payload", "value": "efb4db4d7c60aeae53e64a1ceafcd19c", "object_relation": "md5", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623984, "uuid": "46053577-23ee-421c-88f7-dbaa0621dc3c", "comment": "Malware payload", "value": "cdf65c13a2ef7e4192f2654ad4a5d9c14adcf5279fabca793628cc3bcb8cf081", "object_relation": "sha256", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623984, "uuid": "839e9e49-6230-4fe0-a32d-10cf7ffe7ae4", "comment": "Malware payload", "value": "c5647593842e8dfa86318646144e6f20b76bf53c", "object_relation": "sha1", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623984, "uuid": "3c750e03-ca1f-4296-8d05-11ad89b7c91a", "comment": "Malware payload", "value": "886471b5eb8efdfe61d448c35286746d5ca2c4cce77e51e6a1d2aeea7455f73d6e00657d884a4b5f3a871e84a8ff64d2", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623984, "uuid": "45e8bcc8-fd1b-4543-aba3-3749ee7a5067", "value": "T197D4239BEA4B91A2FE214706E48F52C59DCD33632E7148E36C1CEC45FBD748C92E1268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623984, "uuid": "bc7c3603-4185-4927-a164-0e05966e61e1", "value": "12288:6QbplB7gjUEFAupn+TcO/aAK6oBjUoMMqWb75a1D5CuPaMdz8eolV8M:RbZydV+TBijUejba5TyMdsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774623984, "uuid": "b0762ca9-ae48-4775-97f9-176cc8bfe8a7", "value": 604738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774623984, "uuid": "f9d21e0e-8032-46fe-9a2e-c3b23549abd9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623984, "uuid": "c5f89e91-8317-464d-8b88-6122012316ac", "value": "image.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db2fedc-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774625152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625152, "uuid": "c0e7149b-0cde-4958-a228-337b530a2975", "comment": "Malware payload (Mirai)", "value": "55de1a5547c9a45945a29055a76252d9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625152, "uuid": "91f4a383-8114-4a11-ada5-e586aa337bce", "comment": "Malware payload (Mirai)", "value": "ce58a8bf2ecc9e3a5d39d344e270b6ba28bed86333a06c820f6842d9b5db52cd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625152, "uuid": "971b8bb1-e0d4-4cf7-a6ff-364bd4b28a49", "comment": "Malware payload (Mirai)", "value": "bc6fab78b4618c065828f4df2e82b0c79b0eeae0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625152, "uuid": "a4fff763-1f96-4a8e-ab23-a32979f0087f", "comment": "Malware payload (Mirai)", "value": "ca46f2ffd14eb565acd1b2aecd56c6da8d9c507ebde2734fa0c788f272d164adacdaf279cd1d9be227d8b52648f25cfd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625152, "uuid": "111d96ab-7745-4295-8493-80211bfa43a0", "value": "T1A551548553864C3C39A7EB13E6BA8B783086D05258EBAF95DAD4BAF84B4FD143140B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625152, "uuid": "845fd809-341e-4df2-9743-09c5d78e4177", "value": "48:vS797N7hSE6GSgMzPS0KWS2oUS727o7USfj3bSN9RSacgS5pVSMSOSo+CSzfTS74:vS797N7hSE6GSgMzPS0KWS2oUS727o7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625152, "uuid": "3de98d2a-d19a-49a2-a55b-81c79d249d42", "value": 2970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625152, "uuid": "89db0165-6757-49bb-b6c2-b5405dd5934b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625152, "uuid": "5259f045-15e7-4002-84ff-6bd2f96d1861", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325d0f71-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774625133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625133, "uuid": "427d9fd6-f9e6-4bc2-9c6d-3b924b2e4050", "comment": "Malware payload (Mirai)", "value": "318de4ddd0605000cbacd457bc414dc9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625133, "uuid": "d52d75d8-2f92-4a02-b13d-1498331ea9da", "comment": "Malware payload (Mirai)", "value": "cfb7f83f0d14d31635b9e584a10fa8f7b28a09c7d7fa7671e1308a320ef18495", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625133, "uuid": "4b981a4a-596c-4043-a4fc-a65a12e78428", "comment": "Malware payload (Mirai)", "value": "fda4e935ca9119d3d2213ceb64f5301c004e88f8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625133, "uuid": "f79410f1-3052-466e-879a-d830d9468feb", "comment": "Malware payload (Mirai)", "value": "238bb6eb1a2df827eb519f37db97e7372ad28a19804acb48311540615c6b484d4782ce80d021625f99ee9bb20e32d4b5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625133, "uuid": "96c141f8-29c0-49f3-9477-fc268067d43f", "value": "T109A2D025D3456EF4DFAF9CA057C1D3C27AE543C6278AC8E240EEAF013906046B788C59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625133, "uuid": "952c7118-5d6b-4b97-a207-fb54582e5893", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5OMh3M4uVcqgw05VxJy:mRxsSVsMD6xiJJE5zRWNk4uVcqgw098", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625133, "uuid": "ee8ddf44-ca14-4c95-b102-a71614bf4a0e", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625133, "uuid": "45035a15-8887-4a4b-90ca-c661b96b249a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625133, "uuid": "8723aca4-d935-465c-8caf-76d116198135", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64dd283-29e3-11f1-a769-42010a9c0008", "comment": "Malware payload (Kinsing)", "timestamp": 1774619422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774619422, "uuid": "5c935be2-4705-46d2-b070-e394db887c5d", "comment": "Malware payload (Kinsing)", "value": "95f028cf87a1f06d45f345a644a69eb3", "object_relation": "md5", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774619422, "uuid": "16e5435d-a1a2-46cd-b473-72a2e2e760fe", "comment": "Malware payload (Kinsing)", "value": "d10a2d0277129e5822360460b74a2d41685c61dc2260dc276117ae5df81810d6", "object_relation": "sha256", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774619422, "uuid": "2587dffd-3e4a-4ca3-9390-605ed8922c7d", "comment": "Malware payload (Kinsing)", "value": "123e5a1f34228a36032d8d365250991d763146ce", "object_relation": "sha1", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774619422, "uuid": "5b3109d9-51cd-4df0-b32d-72e63c25efb8", "comment": "Malware payload (Kinsing)", "value": "f471332b784d2c710da3a51fd571685bcb915ba61bf52dece9ff40bc0d6bb58e48e959ce6bb1f6b4f2e3d7b23cbee588", "object_relation": "sha3-384", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774619422, "uuid": "6fe2ab70-4107-4714-85be-8d45e320833a", "value": "T10472218EB011ED74295DC4B59CE2287D602BA00A4D623F10B45C7E786B9DA05F7B9BFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774619422, "uuid": "1fb30b8e-0cd2-4d6e-be14-45ba6e5ead33", "value": "384:rfcMihlH2wx2vUaQa5/eN86704s80ooJQYgykWT4yCtvUsDjdWOoJw+O:zcg7YJDj8OoJw+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774619422, "uuid": "f4c981c9-4a0c-43cc-afd2-a530db381b6f", "value": 16878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774619422, "uuid": "206bc377-cf67-4887-bbb5-eb59c0080d75", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774619422, "uuid": "018f748a-9beb-400a-9b42-c8253656237e", "value": "xx.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b050fb98-29d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774612030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612030, "uuid": "b654103b-8336-4622-accf-c4b142ab5ea8", "comment": "Malware payload (Mirai)", "value": "dd548c1525025ef1b2660c8b44fec34d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612030, "uuid": "11abf566-2772-4cfd-8837-ccfff8d4008c", "comment": "Malware payload (Mirai)", "value": "d1c7e7414ca4e1cc440c8c8e102e7e7921c7c0612c77504f09697041b49015cf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612030, "uuid": "64d7670f-4bbd-46ff-8cec-145c731a16d4", "comment": "Malware payload (Mirai)", "value": "42ae2d84e1a54b2deb639df8bd7057e850ae1c47", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612030, "uuid": "f0ed2a3d-f1f7-4278-9bca-22f24f14a18f", "comment": "Malware payload (Mirai)", "value": "a6c27637432f00a1baae9d5a0b4e48267a30435350daebf078ef53323b44459c2655a50d25396c6e284ac0716f024ada", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612030, "uuid": "1d4a13c3-9a76-4c5a-b643-1617a69c33fe", "value": "T1529318C6B401DC7DF80FDABB4463290EB631E36156831B26675BBE53AD721E05923F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612030, "uuid": "655ca3b3-620c-46c4-9a56-c3a523128787", "value": "1536:6sdLEbXJld35is6pRA7O7X71W0XM9FW2edNP/8b47e1ov5TaCkg0zjX9JK1Cm1kl:6DiPpAO7X72w2ed1nqeTadgqGCm1HqZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612030, "uuid": "19a6a32a-03af-4659-a103-ec6693cabad5", "value": 96736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612030, "uuid": "1dacb7c0-9b9e-4ac8-8e6b-d5aea97f8b7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612030, "uuid": "2250d290-5707-441e-bfce-0fbcebdb5690", "value": "windy.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8b1af4-2a22-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774646194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646194, "uuid": "d6479239-89fa-4422-876b-2b44c1871acd", "comment": "Malware payload", "value": "05d9a41c3d6b14221dc03a664a417ab0", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-5679", "colour": "#672997", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646194, "uuid": "47bc7698-5407-4d42-8206-664a4f93c09c", "comment": "Malware payload", "value": "d1c920c81aa020132d11adb04f7c068aef588a482433df5b1dabe3916fd72ec6", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-5679", "colour": "#672997", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646194, "uuid": "d580a7a6-7b6a-4e51-93e1-6be5f6c856ce", "comment": "Malware payload", "value": "e7c98d58eb371d36fbe7a0c737c8fb6c981c2001", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-5679", "colour": "#672997", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646194, "uuid": "35354682-b61e-4d84-92ef-e089b90f55d8", "comment": "Malware payload", "value": "23025ca1cf7c0554e0adadf605ceab37e609705c6b3fbf43d91c2c91aae166129058f263ede53985bd930c24160d285a", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-5679", "colour": "#672997", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646194, "uuid": "2f75c873-20fc-4165-807d-1066d0f2634e", "value": "T175E533CD44D4172292529696B1071B7482323FDB5EF2ECA4666AFC3F49B4A7E2D30D2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646194, "uuid": "7a1d3dcd-e8fa-4464-9f6c-077b7b9c703d", "value": "98304:K2fasEDvN+H1i1zgH/yB8pqmAZcrzQBnyO4Pr:wsiV+H1iqtpqmAZHNyOmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774646194, "uuid": "ba1ceaac-6786-416e-9610-d8c669407322", "value": 3268467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774646194, "uuid": "858b51d7-d18a-4aa6-a342-c115afe86d71", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646194, "uuid": "ab34d0c4-cc4a-4bbd-8542-1c531f60565a", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e77c327-29a2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774591330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774591330, "uuid": "f63bbfa0-089e-447a-ac89-3de279832035", "comment": "Malware payload", "value": "ce2521622be350a3c2bfb0d828cf4284", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774591330, "uuid": "32951ab6-1bc6-42f5-b5a8-b1753178c6b8", "comment": "Malware payload", "value": "d1dd04f9daf5aaab9619d1d426061fd78f714b70bbdafec9c03823ed4a179a28", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774591330, "uuid": "31ff94b8-4a8a-402f-b4ff-cf82610ecc2b", "comment": "Malware payload", "value": "f3ec6917716a1f9853dd8f6ec31a3554a6b25290", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774591330, "uuid": "6009bb9f-f38f-4f84-bfd0-1bade6da0004", "comment": "Malware payload", "value": "f2a710005cebc7f2c1e5c020ac9c2f41d9f4eb62ef0e184c834af4060015e88fc5a35884bd5f0800888db105c84fc4c4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774591330, "uuid": "ae1cc152-253a-482a-9b48-84ce5d8db142", "value": "T1D7510E35E98EC93511BD9B79C6AE58FEFB34933712405108B8AC168E1F7540791F82E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774591330, "uuid": "5c8a5fe2-ddf5-4846-b558-1f98b36acdda", "value": "48:WoX/ejI0/vFaabNjIXdwMx8MPzBmzT4yNhAvRY/1FK1bjILzjIdURsGaeYGhDeiG:pX/L0/YabSXdfxGhAvmwoUwjae/peR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774591330, "uuid": "47d09563-6a57-4443-ac0d-2af520f90ec2", "value": 2989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774591330, "uuid": "7c4321a4-deeb-4b78-9691-6e1fa3a3f8c5", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774591330, "uuid": "b008c089-0fab-482e-99e7-f3b05eb7eb74", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e11768-29a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774590380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774590380, "uuid": "6ba8de5e-1514-45a5-94eb-cad3be894b12", "comment": "Malware payload (Mirai)", "value": "cf8ad68432588ea9c56473673903bcb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774590380, "uuid": "9b255ccb-4ad1-486d-8edf-4406ce6c7623", "comment": "Malware payload (Mirai)", "value": "d2c72ceece9fb4be6c9efa6715dbb32f38393e232f9ac69f190981ad1726132b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774590380, "uuid": "41940eec-6a3b-4a21-bed9-609b8ca9cc55", "comment": "Malware payload (Mirai)", "value": "396c52c0ca929bd38b279b8f57ad2eca821d88de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774590380, "uuid": "ff152ea1-13c6-49f9-a376-4d50b86dcf43", "comment": "Malware payload (Mirai)", "value": "f26b85612c237ad29d55c263bc7d3722d53329066e9c6deb8466ee52d21a7661afeee372e5d5a53cb810a6567a99b217", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774590380, "uuid": "80fde9e2-23a2-4044-abad-78cdcd2bb291", "value": "T1A4265D56B6A314ADC15AC430876FD6236D35B89442327D7F2684AE343EB6E305B2EF31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774590380, "uuid": "133a6a2c-0731-4f85-aeff-23c8fbf7a45f", "value": "98304:jbBS4Sh9Pq0vEU+Y5P1rJm3xxYD+sjXoax:ZxbYD/XZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774590380, "uuid": "e1ae4223-d27d-4f4d-96a5-8fd37778368e", "value": 4572144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774590380, "uuid": "0da681e3-cf12-41c6-9264-309274df4e86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774590380, "uuid": "ac52b909-9e8e-4b1e-a697-a174c24c6fff", "value": "wlan.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ffb1d54-2a14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774640296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774640296, "uuid": "d3c9939f-8570-4a57-8014-d8af2fb1138b", "comment": "Malware payload", "value": "e8c9f75939e2e1be370d61d7547844c8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774640296, "uuid": "0f365901-fa40-4a3a-8324-c116c9af296e", "comment": "Malware payload", "value": "d41329e084ad90a62c37e906f18e1089002f4d5e7c5ce123f7753da90e410372", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774640296, "uuid": "81022ceb-b35c-477a-ad7d-f0b0b4c790a5", "comment": "Malware payload", "value": "79c8bc269de0cdc1405fa489a6c0f25648a01162", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774640296, "uuid": "86c79201-08d2-43aa-882b-1f384f848261", "comment": "Malware payload", "value": "7a5e5d613c1ce76fee8a4d1294ccf50c25532dd7d0a4135b87f887742dffb61d71bc938bfd72799094780d91d466e2a3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774640296, "uuid": "c8c9662e-1f4c-4332-b165-f249085222f7", "value": "T14326E085BB49A62FCC7755334EEA0732518B8D978E8297537814330C69B7AE40F5ABCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774640296, "uuid": "3c702921-d6f1-4443-84ed-5b2135db4976", "value": "98304:deBl5JsHd2ZrJQKgM1M1mGa0TyW+AdCzyxkPi11P+9DhXBdcr:MBl5CaQ1mO2Kl1mTTcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774640296, "uuid": "cb063807-b981-459b-b1a3-a5c0c1841666", "value": 4770986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774640296, "uuid": "86815803-9967-4892-8e6c-31cf6930a673", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774640296, "uuid": "afcc9417-a797-448b-b9c8-2dcd887b99f4", "value": "Painel Apelapato Trick 2.0 \ud83d\udc7d.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9878b54-2994-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1774585524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585524, "uuid": "c9a4f459-3a65-475b-bde8-c766e7f8e5bc", "comment": "Malware payload (CoinMiner)", "value": "01860fbb403012dcc5237e23ebbc8b08", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585524, "uuid": "ee155e78-97ee-42d0-91a0-93c276b7d2cf", "comment": "Malware payload (CoinMiner)", "value": "d4452ab74ca7c05fa736f681a266c46b48a581138b60058170763861e55f45ae", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585524, "uuid": "d416d245-4dce-4bca-96ee-44bdfb153a31", "comment": "Malware payload (CoinMiner)", "value": "1aa4fd10bf6a3e35472a0d20ef8a19ad1840c777", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774585524, "uuid": "10821382-ab14-47f9-a999-65972cef577e", "comment": "Malware payload (CoinMiner)", "value": "f9ac5ac2a9988deac09b09beb5759f591724b7420ac14c65d016b204725e0b671cd33186f30cbc0c608ebff69c8490cd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774585524, "uuid": "e407ba45-e297-4c62-ad5f-70cac507db49", "value": "T1FCE47E3AB69802F8E1A7D17AC9424512FBF1784A537167CF03E14B961F2B6E44E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774585524, "uuid": "8948ccf4-8fd1-4e14-b53c-d86bffbb7df1", "value": "bb87364cc0f16f0daf665a91db03453f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774585524, "uuid": "1ed93d91-7247-4158-b09c-b7b9fc4a0d68", "value": "12288:OnaTfKBUy9WPAT8wxQxsYmkdn00iSpBQuUD:uBn9uycsl00hcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774585524, "uuid": "ccbc89fe-d5a2-4b18-96a9-c0b1cf4a6dc7", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774585524, "uuid": "bfc9d04e-cd0a-4782-a336-01ba63a07215", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774585524, "uuid": "ce1f82a8-be07-4389-ac1e-3c34fa1844f9", "value": "SecuriteInfo.com.Trojan.Siggen32.30011.31034.1014", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a418d4-2980-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774576719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774576719, "uuid": "07a885bd-2479-414f-8337-c45d17b0557a", "comment": "Malware payload (AgentTesla)", "value": "f81f3d1167f03ecce715b769494b955c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774576719, "uuid": "d166ba04-d54b-4fca-a33c-30981c2f7b7b", "comment": "Malware payload (AgentTesla)", "value": "d446c8fccb4943c7e1bda127c663d4ab9dfe9948da1a0a9e2c2b458679bc978e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774576719, "uuid": "1c53c5fd-772e-496e-93be-c578c7300cd9", "comment": "Malware payload (AgentTesla)", "value": "605351aadc586d5851ec628d86b02a3453c79877", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774576719, "uuid": "f3e00980-9e00-4f0c-ab5c-c3c6eb68eda4", "comment": "Malware payload (AgentTesla)", "value": "93925bf4584a2d008aa269cb555aad54c3cda6364b156c330add72c12674d02d963f9ffde83b91dae5a7f1e844a8bea2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774576719, "uuid": "f4ff3ec4-f84c-4699-a4e6-6b5ef552509e", "value": "T12635331D1B0C46F2FBA15895A5B2D7AA5B4412D6F9E202E13CA4CDFA008E77F81CE671", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774576719, "uuid": "68abc989-98d4-4a2c-99fa-20f5ecc277a2", "value": "24576:P/W87uc/qmqPZhf0D4UTYmzWnvodIA0ht3mZh0MBsTX2:VuAqhZhW4UMnnwdGht00MeX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774576719, "uuid": "0d6c7037-941c-4169-b630-8dac0471dfe7", "value": 1073138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774576719, "uuid": "d3f1c2f4-25b6-4db3-bbf5-26cb85da8371", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774576719, "uuid": "6e430409-e940-4296-8e5b-f850e9080676", "value": "f81f3d1167f03ecce715b769494b955c.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ebacb29-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774596431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596431, "uuid": "1a51310e-ee25-4eee-97a9-ce4a2732ee0a", "comment": "Malware payload (Mirai)", "value": "f28db1e3eabd9d569e517f6fa220286d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596431, "uuid": "aa0f85c1-56fb-4f76-9572-f50f72948c5e", "comment": "Malware payload (Mirai)", "value": "d4a66df5d2c16d10b41fd9045ec600f554573324b2eaeaf18d7dd5e1b02d4f9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596431, "uuid": "a65ade34-4dbd-4c0d-9d08-6949047785c6", "comment": "Malware payload (Mirai)", "value": "242228c2bdda108b4e977465df6df0730f07bfe1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596431, "uuid": "59c6ce4c-2961-47f6-977a-a114f5cb1128", "comment": "Malware payload (Mirai)", "value": "aa0addec6188172077c1bcc10087850eb42726d92349c4f9252b36d89ae2d2a84075375a7f130e91c675c6df4087cb34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596431, "uuid": "b476e187-cda1-455a-b6f6-19287de7e4eb", "value": "T12FB3E085B210AA55C02672FCB1870A90D3B17E7B4B9A150B44B3F5B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596431, "uuid": "d959eab5-4eb0-4f5c-96cd-2b99ffdceda9", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wuc:as5zqhr5Nzy7wP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596431, "uuid": "da99fdf0-bcd9-4359-b3e8-2b91ba4befa9", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596431, "uuid": "40608f6d-0146-402a-9ef7-9682215981a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596431, "uuid": "560e7e82-4c10-4bef-8523-eb6ab960ad4f", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b6abe4-29a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774592181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774592181, "uuid": "0f91f6b7-0d6f-4c79-8e2e-cc20648e58af", "comment": "Malware payload", "value": "f9effa38b687f178ef93974d1343d858", "object_relation": "md5", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774592181, "uuid": "76126772-4696-4d24-ab25-b610bfc9101c", "comment": "Malware payload", "value": "d5487f85460486ebc0b5e31cbcd6b88ac7db069a09b51595a95d74f80776ba64", "object_relation": "sha256", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774592181, "uuid": "6c43443b-01b2-400d-8d9c-713478352f1f", "comment": "Malware payload", "value": "e721748b8be783ec2e5ab7571f6412107f45ac93", "object_relation": "sha1", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774592181, "uuid": "9cfcc80e-320e-422a-b664-f01788806f1c", "comment": "Malware payload", "value": "f507a70edd6b0eb69d49b754f56e7cf7224611d6ffb012b4ced9a2c81d97abad3a742426309c9cbae23d42a25069d586", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774592181, "uuid": "4832413e-40c0-4053-bdd1-5d2133d43969", "value": "T1C205190777C58E52D15A1333D1A708008BF2A6867777E71F3A4163A96C433EE9E263A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774592181, "uuid": "bbbd88d0-6d29-49b4-9607-eb1a5768f553", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774592181, "uuid": "dcfe6433-c704-4749-881c-942c48ea60cd", "value": "12288:N7mlfy/cV5SjvppQeQ3TSB76eMeUQkWF:MacVivrEmB76eNUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774592181, "uuid": "942079f3-516c-4d3a-af95-7d8a0b4f961a", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774592181, "uuid": "56316f24-02d3-4a61-a660-665ad486d72b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774592181, "uuid": "11746837-a048-45e5-911b-72cd12dd8f19", "value": "d5487f85460486ebc0b5e31cbcd6b88ac7db069a09b51595a95d74f80776ba64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc20cd4-298f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774583008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774583008, "uuid": "d05b3e1f-e62d-4dcf-b542-dd8276247111", "comment": "Malware payload (Mirai)", "value": "6d6a1de97f3914aafbc5bd0ee99c1b7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774583008, "uuid": "5537b61f-00b6-45dc-8ad1-1ab8aefb3360", "comment": "Malware payload (Mirai)", "value": "d5853c1f9dd0320f97d3eec0f12c67d4a8c21eaf61b6d2118a45c87793b1c490", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774583008, "uuid": "10a78db3-17eb-4ecb-ae88-49e4f1cca893", "comment": "Malware payload (Mirai)", "value": "523eea131a5c1a967bc838d44c4411c0ce3ae1da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774583008, "uuid": "6f20b9f5-d005-409b-847e-bd2d319d1034", "comment": "Malware payload (Mirai)", "value": "66235fa3be275805da43a79213f7af134602fbccb7de8cefe8711240224d4508c0a55e1b067fb3c5107d341db5fa1f13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774583008, "uuid": "a71b3570-3738-49f0-9fed-cce80a81e726", "value": "T12F465C1AB2B314ADC15AC430836FDA236D35B85542317D7F2684AE742EB6E705B2EF31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774583008, "uuid": "ef4625d7-5d2d-40c1-9860-f7687b3cdd3c", "value": "98304:wzQb634/m5CgW/fuTXvCpI7qu+JhaelWDE+g5mD2byw:g6uZelaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774583008, "uuid": "2f2aa563-56cd-4565-8072-890beb0134ee", "value": 5669928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774583008, "uuid": "ca5009c8-154b-49d0-8e4a-96c18665b92f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774583008, "uuid": "dd21a6b1-aab3-4cb8-bc7a-25ef379915fe", "value": "wlan.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb341212-29d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774612048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612048, "uuid": "4615e797-e249-4789-994d-02ad80e7011f", "comment": "Malware payload (Mirai)", "value": "164b538684823f404c8b43f65f4283cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612048, "uuid": "f8a0cd61-b8bd-42ba-a8f7-a1213aae06a5", "comment": "Malware payload (Mirai)", "value": "d6afc508d3cdc27026cbd9d3d4dea42b0dcfe0a92e93c8f6f1896fbb47eb6f1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612048, "uuid": "ad17e2f2-b158-4688-a2c3-0318dfeb7c35", "comment": "Malware payload (Mirai)", "value": "f15e73bb51f0212284944a902752df4708215c8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612048, "uuid": "4b144d1a-5ced-45a0-8013-a593d6a2f151", "comment": "Malware payload (Mirai)", "value": "39f1c7adf0adbc37a58144bccae1fd981b3ab7bff57b4aadc9a77d4c5bfdb49bbb8cb6a534f35d592f4d6de5216ca066", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612048, "uuid": "f3c426ce-6627-40ad-9c73-d5ef25dc729d", "value": "T15734C70E6F228F7DF7A987344BB79A20975D23D627E1D584D1ACC2105F2029E641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612048, "uuid": "1c58e633-b026-44d1-ae4a-77ab468964af", "value": "6144:FnhtuaDnTiWF45B22j40Qg1KVCiF/zmYADJk6l2b2Y/tFTDiczFtorIE2klxzbAC:spQXgnqojh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612048, "uuid": "fcc4112c-48e2-4f5e-b38e-8c90e23e8401", "value": 238492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612048, "uuid": "47e978e2-c590-46d7-9f1e-2afbc9d0def4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612048, "uuid": "84510474-29f0-4339-8a64-e90594f53df9", "value": "kurayami.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750ed48c-29a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774592174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774592174, "uuid": "aa31584f-063e-4e20-a7d3-9ca4bc46b49d", "comment": "Malware payload", "value": "8b9a40017a7a74712cbf5012999a0a2c", "object_relation": "md5", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774592174, "uuid": "b0ab7109-eb78-4da4-8729-97452bfc9059", "comment": "Malware payload", "value": "d877e0a9e2fc47d5155de403f50a3359c58b1a11b51ed0181ff8a1b2cbaf40ec", "object_relation": "sha256", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774592174, "uuid": "5e9d011c-1c8a-4994-87f3-428ed2a3b9b5", "comment": "Malware payload", "value": "58d18564835db6eafa8cc723b4ebc0974d3deca2", "object_relation": "sha1", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774592174, "uuid": "ffb7df8c-990a-4c34-aae5-219cd1a4e23c", "comment": "Malware payload", "value": "bc883d8e7ce520c98d8769594cb1d41061fbc862d511230533d6577fc4c1a1979221132f0599a38ad7f823480a681299", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-188-231", "colour": "#FCDAA1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774592174, "uuid": "c7a153ec-c921-4581-9efe-6b7025aa7a94", "value": "T133E27E1A9BCC43B0D8FE0A7AFCF2812197B1F6425D178F9B29D8445B1E737948B903A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774592174, "uuid": "cb988a47-67d6-4f10-9ea3-3a81ddd5d4b2", "value": "384:/m1LIHY7ZmZ4lfeSjyP3BB8TkO0b9AwGRR4JcI5JGomfotgaZyCxr9ZXOMhtWrsD:O1L2ON63BBbONwGRR4TxLXLur8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774592174, "uuid": "3d0eaece-bcf8-4de3-9f70-5fa057b42c77", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774592174, "uuid": "20c3fff8-f7d4-4db9-9b3c-bb198baecb1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774592174, "uuid": "cbd5baed-fabe-414e-b864-f394568bc9c5", "value": "d877e0a9e2fc47d5155de403f50a3359c58b1a11b51ed0181ff8a1b2cbaf40ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2406f2d4-29fb-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774629404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629404, "uuid": "d7c29ecd-df29-4964-a3af-c915059f0531", "comment": "Malware payload (RemcosRAT)", "value": "b1ae905c9ed01b3935c6e0a7da846203", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629404, "uuid": "bc127781-b6f1-4b75-866d-c874dfa968bc", "comment": "Malware payload (RemcosRAT)", "value": "d9d74cf522f891ccf27d2b66cf5f951ffa72810a8d54ec1a5bcde85183c1cc65", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629404, "uuid": "03012754-1efc-46e2-a645-a5ec8e9736ec", "comment": "Malware payload (RemcosRAT)", "value": "ae94ef60831fb6e566eaef554c5489c7269c60a7", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774629404, "uuid": "772c5cec-beb9-464d-89fb-11e07c0c1a58", "comment": "Malware payload (RemcosRAT)", "value": "5646c45e6765f0e798c2f6f5e7b408bccb70e16c1595e0f96803e1233ab5596e05e96906ecfc451a7cee4ae231e5a8c1", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629404, "uuid": "0e55595e-c29a-4040-8907-af38ea49bfc9", "value": "T18842B0442C2B00F0CD9CEE76BF159DCD3AE7A86D2300FEFEA2B47D96851446FA496510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629404, "uuid": "a269f7e8-7d7f-4564-a804-7411ed5ae80b", "value": "384:nhVXeksmM2zRcfOvoPvkjI21gCzM8MSEVA02HK:nhkkBzGGvo3i1gCQ8MHVA0uK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774629404, "uuid": "7a9d4fee-2e48-4e04-a0b5-6e44c72ed2ec", "value": 12999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774629404, "uuid": "8d877c06-fc2a-4e2e-8f82-f4c3f7a90293", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774629404, "uuid": "bcf9676f-cea2-4515-b2dd-dcbeb646454e", "value": "Shipping_Document_pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ef6acf-2a01-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774632115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774632115, "uuid": "ec5afa9e-597d-4541-a7d2-1c29225b599d", "comment": "Malware payload (LummaStealer)", "value": "7ce5db294dd34bec3fd1b05d2cb2db4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774632115, "uuid": "f43ad89e-ca75-497b-a6ec-efcaa7ee106f", "comment": "Malware payload (LummaStealer)", "value": "da34696697190fe15d1f9dee45fe38126a7f31933ba4946727aa00178e313548", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774632115, "uuid": "26e28ea9-0d98-494d-83f4-4aee5f512716", "comment": "Malware payload (LummaStealer)", "value": "552a25677bfd10736890722cf978d34efffcd929", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774632115, "uuid": "9c60dac1-c315-4749-bd54-69122aed3e01", "comment": "Malware payload (LummaStealer)", "value": "3fda7ee900fb202bea0cefa8be002d57cc472ff7383a676344c0d6b20af029747988bee1c3fe5a2fb38fdc2bfc91deaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774632115, "uuid": "0606fc1e-6349-413d-a78f-decb73e38a4b", "value": "T1EB749E0AEBB714A2DA4B057831DA737F8E386A1043348DA7DFC4DB89793B9D2453D606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774632115, "uuid": "0bfb87be-f1ea-4757-b957-b8dcfa26b555", "value": "ec9ff11681447dfc857be1d85cb600bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774632115, "uuid": "24500438-b8cd-4fe8-a592-6ab8299dc193", "value": "6144:QtSmfkVyiBFAmR3KRHhdfpQ9U0Nim07BnNA6GEz4FRjtHfax7240qEZgH6:ycVyiBFAMyhZVUEz4Pjt/ax7026", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774632115, "uuid": "c2ceb726-a547-4313-bcbf-0a7dc9cd0b61", "value": 345648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774632115, "uuid": "00acdb91-f960-45b1-8f6f-ab8e6f2e2672", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774632115, "uuid": "14cab7f6-b676-410b-b21b-fdfafebe39bf", "value": "da34696697190fe15d1f9dee45fe38126a7f31933ba4946727aa00178e313548.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6322aa9-2a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (RevengeRAT)", "timestamp": 1774636091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774636091, "uuid": "715b014d-6c22-4aea-a4aa-4e237e11930a", "comment": "Malware payload (RevengeRAT)", "value": "3eb5b3681101301f829cd343113a74f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774636091, "uuid": "5e74d7d6-8d80-4a75-9e23-cae30ec40ed9", "comment": "Malware payload (RevengeRAT)", "value": "daaf92a3eb075770eeb95d618f49046246d83b3dea7855ea503a91b249c8e87b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774636091, "uuid": "d9edeaea-2770-46e2-bec8-29fcb5088abd", "comment": "Malware payload (RevengeRAT)", "value": "e3f0e01a15e1ecd2b318eb288216080ca761db04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774636091, "uuid": "238f92f9-c219-4bb7-8394-1b071c136348", "comment": "Malware payload (RevengeRAT)", "value": "1dce350396a2cfbb5ce63d4f37ae68ba85c21ef783958daa02ca549f1953e22234939e3884de29b8a263bed0780b609f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774636091, "uuid": "0aef438c-96f8-4d73-9c02-984fc5e1ded3", "value": "T1C892295267F58622C2BC13BE192162326730C76B5616C3BD3DEC41FB6B633819A926D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774636091, "uuid": "5eea8bf3-3d4b-49a7-908b-1b7ac298b535", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774636091, "uuid": "9cb2d9fc-f797-4a15-9092-86d3d7f2dab4", "value": "384:TXPoeOQfy4q4MWsjvRPJnMga8T4pzOIDPXM0sVKXyrwG9qCzYcHe+Z:Ee+4qYKa+I7oJdzYcHe+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774636091, "uuid": "79f4d8f8-32bc-49a9-a8aa-b6e90172fd19", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774636091, "uuid": "66c30e75-a7f2-4a8e-b4ae-9209f6ace63a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774636091, "uuid": "9ec1922c-75b5-4a4a-8e30-47ed04653dd3", "value": "daaf92a3eb075770eeb95d618f49046246d83b3dea7855ea503a91b249c8e87b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042b471b-29d6-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774613459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774613459, "uuid": "3a59bb05-42ce-4ac2-81c5-c1d7e0c637e3", "comment": "Malware payload (ValleyRAT)", "value": "c4bb3d8c308cc0cf7c84c0aebb2fc3cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774613459, "uuid": "c2919a33-24c1-4632-bf09-bfda80202c7a", "comment": "Malware payload (ValleyRAT)", "value": "dc65daa965ef88b801f2ca4aa9775a9891c209319ac2982e80ba05a81bc0739f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774613459, "uuid": "e35f57aa-6200-4f2a-9507-dfaac704d68e", "comment": "Malware payload (ValleyRAT)", "value": "41a7e7fbd2c46fd3250b48fa8f99993f55e2f236", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774613459, "uuid": "71fea79d-1dec-4ac9-a8c9-3f0990ee84d4", "comment": "Malware payload (ValleyRAT)", "value": "f023b998f5cdef01e708a3a8c0b5149ab0914abd6c037026c3f2c879de0ec2febd4f38b68081beb209253ebb12df180c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774613459, "uuid": "7383b8da-7291-4c6b-bbed-39e7c42b8e98", "value": "T1FCE5331258E7C278DECB04719091B5EFF7D5200AC1A8CD3D7B09BCC769E2C5866EE269", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774613459, "uuid": "84ee3565-9293-4f47-8321-c982d4d6df7c", "value": "c12366bc928423da75a87d5e3461c7b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774613459, "uuid": "6e758124-98d1-4692-99bc-91480e801886", "value": "49152:dj6RS0+ccUtOuJIIXtn9IPjHF7WP7jV00j+Nvhi+ouIOPXEF4SrBywGxes33e2Bq:dj69+cFtOiWZNvoYVftZwU3e2BOK7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774613459, "uuid": "127de438-65d5-43fa-b42f-0aace7c9598c", "value": 3097600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774613459, "uuid": "2faaa795-3b21-46a3-a11b-5b411ea3d317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774613459, "uuid": "5caa26a0-cc35-483d-aa9a-b8458eb3f6d3", "value": "C4BB3D8C308CC0CF7C84C0AEBB2FC3CC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3894acf-29e7-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774621028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774621028, "uuid": "70857abc-4764-4a0a-90c5-befe16acd3f2", "comment": "Malware payload (RustyStealer)", "value": "7206ae122b5c610a31fa1743fe7e4a14", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774621028, "uuid": "c8cb3caf-ee77-47a2-863b-04e1b56cface", "comment": "Malware payload (RustyStealer)", "value": "dd2e5de5a6d9a4e2c482850ce0cb8aaa0e2f7a69352b0d53a893ffe4079f2008", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774621028, "uuid": "fc0f842f-7ffa-4c6c-be31-449d77e8dc08", "comment": "Malware payload (RustyStealer)", "value": "3ee8b2bfdba52a713091bfc1912c98ad622eface", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774621028, "uuid": "8168fa6a-13ee-4525-b7e9-d5e7dd27da1e", "comment": "Malware payload (RustyStealer)", "value": "31d5aa20a05cc07232e5888453a8690a66f67a7ecf806fa307f33b53e583c2f536d8f71849323641e86eb4a508c25f21", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774621028, "uuid": "d24e88c4-b245-4815-bb6d-bbf4b7874fe5", "value": "T11576A078725078DFFB2F927AD5965DED03722633874668CD10B865C21693AB1FE2EC08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774621028, "uuid": "abdd75aa-f5ea-4e72-b2b3-c9c6ea48a920", "value": "70b399d46210226ba1ed5033b0a0c7d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774621028, "uuid": "c0eee236-4af3-493c-af0c-65a1b24c2172", "value": "24576:yM/CGL8Bj2+9D0TP3ndIlyFzf9fRJ4MiGfJSr6NUtnOnC2LkGBXPsXykZH66iBxm:n/Cw8J2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774621028, "uuid": "c4e28b38-d406-4925-bf2f-fc93e71152a1", "value": 7213475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774621028, "uuid": "dffbae05-c729-4beb-b7d6-0e1ed6e0c680", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774621028, "uuid": "d3470050-cad0-4155-bdb6-fd8edd029662", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0d646a-29cf-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1774610628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774610628, "uuid": "c3822622-ae6f-480c-88be-1df25c372516", "comment": "Malware payload (GuLoader)", "value": "ac4f23c7aa6f3ae88a2f5bb032d95aef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774610628, "uuid": "81d9880b-c207-4dd4-b587-5253598ca0be", "comment": "Malware payload (GuLoader)", "value": "dd8bc2b78857c7246d675d109352df19a27885b42ad57e02cdb5f5aa4741624f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774610628, "uuid": "394a956f-4ecd-4a81-aa0e-322a16824044", "comment": "Malware payload (GuLoader)", "value": "30891c3980a2c8f198df53b4505336184a2aef0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774610628, "uuid": "a7c15e80-4c53-4015-b372-c28d3e968a71", "comment": "Malware payload (GuLoader)", "value": "025670ac41a1546f6246bbf943cb0dcac0630ed28e937816f0854b5ac756c12130e868f40ac86df691bc0564fd31175d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774610628, "uuid": "86982d7c-edad-430e-b130-0d684a88e586", "value": "T199A4D043360885F4CC769A32E92791692B3848FE12D4294B3BEC679F3D71B41491FB7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774610628, "uuid": "c757ab03-c70c-4cc5-8298-5ebdd67cbba5", "value": "e2f3f8ec66b7e1900c37978aca89d3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774610628, "uuid": "9f3ac2a6-e2e4-4f57-aa7a-7ac12e52266c", "value": "6144:kMBaOmEYWswbLTHw9qDC9lkHJy3GTD6oFMS0UYF0/F3tmKpSA4tj2cWoo0Z6NxAw:hoLwPbwqDPfFBrtF3MKpP4N2cfo04f6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774610628, "uuid": "7ca7a0ed-b929-4aa2-8dd7-db203ed52180", "value": 450344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774610628, "uuid": "7f762219-2662-4981-bc3e-a53b58c5436b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774610628, "uuid": "7d326d75-da3b-466f-a52c-c3dd82e0bc3b", "value": "SecuriteInfo.com.Win32.SuspectCrc.8337.17059", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b50a02-29d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774612037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612037, "uuid": "770b7994-a8e3-4b1a-85c8-a50bbe45d426", "comment": "Malware payload (Mirai)", "value": "472a8cd1e89567f4ca98aba37b64956a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612037, "uuid": "b3549e23-5c38-4612-bfb1-47bfc611c3f9", "comment": "Malware payload (Mirai)", "value": "de336c582462a01a7874c423b9c0a171bb35298ed5f5267b7f524ed7dacf5764", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612037, "uuid": "dd6fb3be-4481-45c4-9798-aa0faf4bbbdf", "comment": "Malware payload (Mirai)", "value": "cf6c5f769205651e9ee04578ff47c9a98059e5f7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612037, "uuid": "89adfa84-28f0-400c-8ceb-542b0c81ef4e", "comment": "Malware payload (Mirai)", "value": "5b0cf4552f13679a4a3f47c2d9d4217228d1179a6126cd45d872d9258907f51c0eec77ef56ef6f07607f16689c0076d8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612037, "uuid": "30006f7d-3b9a-40f4-89a4-a60b43b4b1fb", "value": "T1A2739E23C87618ACD25842B8B070FE3653B3E51056572FFB069ACA7A9447EDCF9453B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612037, "uuid": "14ea2630-a656-465b-8406-ae41a5738758", "value": "1536:0/Zd1XEc589PJ9E++KrpgE7YgJMiCYKkN3skR:0hd10L9UIrbhJMiS68kR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612037, "uuid": "47857cd6-51e5-4d07-9918-547cf079906f", "value": 80408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612037, "uuid": "36d873a4-a085-4016-b026-5a3778df1c13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612037, "uuid": "ae095166-4b1d-424f-b2da-615a3b42655f", "value": "windy.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8304e664-2a26-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1774648032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774648032, "uuid": "fed923a1-fb0e-4401-bdd0-0cd5cdbc907d", "comment": "Malware payload (Stealc)", "value": "cf3627ad2740c989fa2079818d924acf", "object_relation": "md5", "Tag": [ { "name": "83-142-209-192", "colour": "#801A19", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774648032, "uuid": "f39fa06d-9b73-4a7b-9112-bed091361b5b", "comment": "Malware payload (Stealc)", "value": "de6aa3a1a821b8a321bcbebf0a467166f5433ca2e3c1e50a7d11bcf9663aa09b", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-192", "colour": "#801A19", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774648032, "uuid": "25fdfacd-ec83-48f9-ad1c-fc2ed057f9ed", "comment": "Malware payload (Stealc)", "value": "528d80dda4e24ac2c16ecc3b460f4b385d34d684", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-192", "colour": "#801A19", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774648032, "uuid": "0402c32a-2650-4b78-a192-87bf017ffb1e", "comment": "Malware payload (Stealc)", "value": "794dbe748eb46bbfdf391016a1475b19b06fcddddacf9bf01f291f2ef79d2ea4f2b2465d721d027d79145cc994ca4558", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-192", "colour": "#801A19", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774648032, "uuid": "eafae406-274b-4dab-8879-d0dee5833860", "value": "T1A4E5332B1BF8B19FE1B267B246F3817387B0B454A39B0A9B7524945D8A35DC4F42370B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774648032, "uuid": "be6e9d61-2c89-4cc4-8faf-276b0b86ddce", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774648032, "uuid": "d9bcb5e7-e931-47c8-a5f9-ed9cfa203a1a", "value": "49152:vURwAyI7cQacnX7fIeuRhsMYxC0N6ZHhFnvkucb3hBRPpqh2yCgqayQoy:vURwAt7O27Qeuv26ZHn8u2XRPpqUyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774648032, "uuid": "e900c01c-27ec-43e1-8aef-260965041571", "value": 3046912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774648032, "uuid": "21c0616c-4cd9-43d0-bc2a-bdfca71da095", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774648032, "uuid": "1c213054-23cc-413d-9b27-a4e33d4d55b6", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3790b986-29cc-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774609250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774609250, "uuid": "8875fff6-9f29-4292-83f9-8a50d43049ba", "comment": "Malware payload (ValleyRAT)", "value": "58129d87ec49e2d15cd60f663922c3f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774609250, "uuid": "f6103ae8-bf82-42d4-aa0c-6b377f9ecd43", "comment": "Malware payload (ValleyRAT)", "value": "de8823ef8ec33bb67795b7014d3ecfd568e21d2a1f65957f501fe9e2c4aafc5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774609250, "uuid": "ff7a071a-9c5d-464d-b4e1-419c28f7df5b", "comment": "Malware payload (ValleyRAT)", "value": "33c16319fb405b128ac2860b98cadd74784837f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774609250, "uuid": "c637415b-d936-4c1a-be02-d82dd5116a1e", "comment": "Malware payload (ValleyRAT)", "value": "4ff68a466e1eae3dc3a3ce39212bbfb4fea5f006f5352e75e3853a5ee17e96c9729c0a56903511ad26c9dd13d9a50895", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774609250, "uuid": "8b13e493-f599-4c4a-a4cf-c0a4578ff078", "value": "T16E648D1377A1C077C69702324FE65B7CA2FEE5944D324A0777D64B1DEE75A038A2A322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774609250, "uuid": "71c96210-ee12-4a59-876b-da63baa41b60", "value": "c631b767fc7c30e6054886fdf2d6a680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774609250, "uuid": "f252d6cc-a3dd-41e0-a3f8-5b14d386b98f", "value": "6144:8lE/cY+VXu6mJhnBe7GnBcr4jretmQFxX:4E/cYi+bnBe7COr42J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774609250, "uuid": "a2693a3e-2d96-4273-9757-cdbbbf79a7bd", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774609250, "uuid": "4f208ccb-df3b-4698-b268-54964e991cee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774609250, "uuid": "ca1c274d-f82c-4f42-bb0e-0aa4ab5e0d29", "value": "de8823ef8ec33bb67795b7014d3ecfd568e21d2a1f659.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d4094f-2a21-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1774645723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645723, "uuid": "c0470c07-e117-41d6-8586-24ebe887ff2b", "comment": "Malware payload (NirCmd)", "value": "16ba3d37b8c1ef840595014c191f4b03", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645723, "uuid": "9bbac815-c0e6-4cd3-9059-ccef1661ba2b", "comment": "Malware payload (NirCmd)", "value": "dea049b37811b28eec9e88a881828021cdafa1d6700c46ce0e8b6d2b2eb70b11", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645723, "uuid": "008e0976-4958-4d82-b8f2-6e1c2784220f", "comment": "Malware payload (NirCmd)", "value": "638593fe4ff48516094992c5581294eb7b0d6062", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774645723, "uuid": "82cf95a9-17e4-46e4-92b6-b9629ca6499c", "comment": "Malware payload (NirCmd)", "value": "440b394f55f535e6bc201669d60818db411485fcab2360e7f5ed15e89b14fd2aaedfccd8c4f0b5cb51c0d020bdf1c23e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645723, "uuid": "dbe4215a-8cb6-4651-a4cc-9d1be01b80dd", "value": "T1DFA52342F8C485F3C4511C331B65A7616A7DBE202F268EDBA3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645723, "uuid": "b23670c3-e7ea-47e0-bfa3-b0832b59f0ba", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645723, "uuid": "2d01e4d2-e8cf-4576-b1a1-1e28db79c533", "value": "49152:ABR4Tpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:aOTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774645723, "uuid": "3d213b9a-5652-49de-8d5a-e1e4745a28a1", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774645723, "uuid": "7377a671-d56e-4909-98ae-d2d4f69087aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774645723, "uuid": "f0982cdc-e429-464d-8e27-e0dd20eb023a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8816d731-29ea-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774622270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774622270, "uuid": "26029557-414a-48c8-9ed0-104ac2865204", "comment": "Malware payload (RustyStealer)", "value": "62ed545cab0c010bb657aae67c5b37b5", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774622270, "uuid": "28db48e5-ec00-4a38-b39a-72deef3c4c8c", "comment": "Malware payload (RustyStealer)", "value": "ded1fef0fd446ee7b8586d1acdabe633dc3968480eacd6bd8f097cd25c3dcc8a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774622270, "uuid": "06e12eda-6423-4fdd-a643-3fa37177b035", "comment": "Malware payload (RustyStealer)", "value": "c830423a1e59230aada003e7393bf56ff094d39a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774622270, "uuid": "cdf5619c-308a-4322-af08-87cb91711c6b", "comment": "Malware payload (RustyStealer)", "value": "d7f1ab7779ade84a675ee9219272c8f3307a1926b96bdf7987b1e30e8085df6348d2d072246ca9eafc788fa1283430f2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774622270, "uuid": "40085a57-15b3-4ec2-bb4c-38a369b7147e", "value": "T12A76AFB431541CF7EA2F66BBCAE53CED43B22722479A64CC21B4F6C11653671EE29C48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774622270, "uuid": "bec5ef31-5f27-4b9a-a984-e0b85a7671fb", "value": "24576:s7+8qArqZpp9tHxqQ+JrjlqomILNAwcO8pMGIjFgMyW4x4iY8lDthXjo9K12cO1w:s7fvOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774622270, "uuid": "50b1e2bd-7b18-4ffc-957a-e5503404f43f", "value": 7176192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774622270, "uuid": "3c20f29b-d40b-4415-941d-f91c84c410a9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774622270, "uuid": "f5a0885b-7a47-42ca-a996-cd894e1aaa04", "value": "Launcher.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8026ff2e-2a25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774647597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647597, "uuid": "8c7df3a0-2968-4587-963c-9725e75d8610", "comment": "Malware payload", "value": "829de5c9651855315f2e7fd608691a4b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647597, "uuid": "913fb995-7638-4aca-9739-9d45fac5dc02", "comment": "Malware payload", "value": "df073b7ba7a188b4b89f1c0d510429d5d425ba33aca085d545a0f679556d5e0a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647597, "uuid": "fd7c6a97-08c5-4799-b903-6791f01e4502", "comment": "Malware payload", "value": "9041f24452510e07b81a42825347f996c427aaf5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647597, "uuid": "333b09d2-cb7e-4a5b-bf7a-d0f1f4cfa432", "comment": "Malware payload", "value": "fd4758e1ad9bd8bde066229b330247b233f5892f5c3b22e93b92efa7a01cf62889e554265b01521573cf833e77073f5e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647597, "uuid": "88377374-9316-42b4-b2f9-b51201d378a1", "value": "T10C46A3D97AC457F0A529ABDC8247B4CD0394A17E6FBB580C02E448BD3D1AE1766E0CBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647597, "uuid": "75cf6cc9-d114-4bf3-8a72-ab5ceab27110", "value": "24576:erpP8gGo3PgxRHjkN9Euz6B0KYGmo+SYxg0mFTwzpsSQ3zq6Z/pxDZASqZ+ZeeYm:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774647597, "uuid": "5870d77e-bf3e-4a15-a4c7-6ffd5ff62f4c", "value": 5533420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774647597, "uuid": "0f415a67-d451-48cc-b948-9a9338c067b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647597, "uuid": "043b5363-7f22-4501-82d5-7e981458c8d2", "value": "chrome_300_percent.pak.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f118e3-29e6-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1774620740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774620740, "uuid": "26beb486-1ca7-4289-91aa-d0e0e3199bdf", "comment": "Malware payload (Amadey)", "value": "d2c04f408d12a67b5d8990e6021c3d05", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774620740, "uuid": "322ae497-a57e-46ba-8731-9a4b8f9266b1", "comment": "Malware payload (Amadey)", "value": "e0e2d1cd33fef3594051992c8b37bf1cfa94c642594caf1d54a4026396d14632", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774620740, "uuid": "7c8484b4-7228-4474-8fca-7d7daa0aa727", "comment": "Malware payload (Amadey)", "value": "9c1bdb677327db5adef7bd088ac74c431e89336a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774620740, "uuid": "1a1ca636-425f-4015-b1b4-78051d91e06a", "comment": "Malware payload (Amadey)", "value": "0e80d68f801f93edb7947c253b3b462c60eb5a3d04c7b8042ee599c512d2729875ca830ea43322ba5a19068222fbdc15", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774620740, "uuid": "4f045e53-4a98-4c14-af33-7e0b835d49d5", "value": "T1F414F18377F84628FFFA47346A7265652A3BBC116D3ECA0D21A9611C1977A508B70F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774620740, "uuid": "9e303acd-61f2-4630-beef-cdaace3a6b91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774620740, "uuid": "e8948b9c-8991-4aac-9e11-af7c1644c186", "value": "3072:3y2b0BTfnelrRADuPj4R+O9x6nLU1e8uB79qxTDOUo0aIMmpj2mh/dBa2Hb1saJ7:tb1RVGl5K4xTDt6mpJtnf+qb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774620740, "uuid": "7db2ffec-32b5-4a48-b415-9f6294b73e21", "value": 190464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774620740, "uuid": "c46af6fc-e948-4fb7-8720-4f2c6c659b45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774620740, "uuid": "6e7bc568-fdaf-4f86-b2c4-98b3f5a25615", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3043bceb-2973-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774571013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571013, "uuid": "cd899571-90cd-4bfb-aa1f-9ad21f2cef5f", "comment": "Malware payload (SalatStealer)", "value": "547cd92bd14451f5687e22cfd89396dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571013, "uuid": "8336405c-59c1-4f5f-83ef-446a786667a3", "comment": "Malware payload (SalatStealer)", "value": "e0fd0bf11c48c7d2af01f459cd68acb1291ba395292194ff1588d0d320d55758", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571013, "uuid": "509ec33a-a1af-4c8f-832d-1df17ca2a808", "comment": "Malware payload (SalatStealer)", "value": "937f376beedd1691c32f98823215384dad5d04fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571013, "uuid": "92110d5b-7037-4b67-8632-f5f95709b61e", "comment": "Malware payload (SalatStealer)", "value": "dbc277563600cbbc4103e8a616541f4bfce72ca75c1bb85790a9e3ea65a1cc918d089a1ea4bd1d678c1e25e3c33d525a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774571013, "uuid": "6c62246d-38d9-4074-8364-e83d4dda7a4a", "value": "T1A1C66C51FA8B64F5E9030931406BA23F63315D449B38DB9BEF187E2AFC776821837619", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774571013, "uuid": "41e45972-2608-45d5-9fe1-a18b0faea71a", "value": "49152:xQvZ9mDQluFf5CNWHAUu4xZAZ50AnlrzyAUwFV6kNskVf+7dQjmUIvl9vjHwuZKW:Gh9mDd55LwFVCkVm3v3LUbNMuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774571013, "uuid": "1a9dab35-3a1f-417d-832d-c0c0c7887ae3", "value": 12108288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774571013, "uuid": "498d9509-25e8-444e-a5b7-9a5054c1715b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774571013, "uuid": "5050c1b4-253b-460a-9a3d-517a3c3978f7", "value": "xe0fd0bf11c48c7d2af01f459cd68acb1291ba395292194ff1588d0d320d55758.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df312918-2a2e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774651622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651622, "uuid": "b06e047f-0ef8-446c-bc30-55d1d0ff35bb", "comment": "Malware payload (AgentTesla)", "value": "904a608a3492fda81d0f2fbd1197ce1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651622, "uuid": "470fa826-35fd-43ae-b82b-a6a56d6c7a3c", "comment": "Malware payload (AgentTesla)", "value": "e235c5765ffbbf6224a70e68ca1e66e036f4c3da3a4d128226d78e8f3659766c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651622, "uuid": "7eace555-ae40-41a5-934d-dff14b1d3fbd", "comment": "Malware payload (AgentTesla)", "value": "8e32e0b259fa63fcdef128dc042d18d9a28966ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651622, "uuid": "515ce9c3-9d4c-43ad-9f17-f008c7d33e14", "comment": "Malware payload (AgentTesla)", "value": "a6e1735e847c55b96c6afff2d896bac3caef0a7213acec994d08761140a06ed56a023c277c861494c62e48d6124917b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774651622, "uuid": "c777ded3-53c3-4760-b07d-a941b899855f", "value": "T124F2318C76EBB164020634B33C6BB0A6F16DC85CA45CC058FDE66C9DF8AE729C179974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774651622, "uuid": "13e5d676-1805-40d9-adbc-3df15598b771", "value": "768:ruxVvihbYmbpJYcrsfADgV5KIW0iAyX2pLnGD+YRxQTF:reVvnmbnYKuvKltAyoLn+HeTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774651622, "uuid": "b369e0ef-34e2-4ba5-8eae-d564d6a42b1a", "value": 36674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774651622, "uuid": "7670aee3-4496-483b-bcaa-94b5a557cec7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774651622, "uuid": "40b030ad-e29d-4a35-abdd-6fd9a2231084", "value": "xxxxxxClean.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bbde7ba-2978-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774573099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573099, "uuid": "faf5d071-7de3-4cfb-9b6b-b07ac6acdb32", "comment": "Malware payload (AsyncRAT)", "value": "6bf6a2f47335159f52183112671518c8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573099, "uuid": "54ccc249-2766-4c56-8f77-cadda8222866", "comment": "Malware payload (AsyncRAT)", "value": "e2f3eb803ed35313e66472f56bf345b11e8b5ea4a59b2b6c504a117ec558bd65", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573099, "uuid": "af77c015-1c85-4216-9a4c-62a1c09a9b00", "comment": "Malware payload (AsyncRAT)", "value": "63681a5407fa70a2ec9abc71d1d73409d5b2b0b7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774573099, "uuid": "00caa296-18c0-4142-a78a-ad49f2b89f00", "comment": "Malware payload (AsyncRAT)", "value": "93fb44f1e108d7421a86b0a59a2da002b12121b7ca160c1afea5d6b5a2d1485ff2393bc62c4a9f46840b8399e3261d16", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573099, "uuid": "3fee28ee-8013-404b-aa7b-e3ccff97644c", "value": "T1B83733C0ED9E726AEC77B8F3B0510104621A9BE56098ED7B6F8D47CCC8959189837D3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573099, "uuid": "1ccf7a06-fcd1-492f-a145-b424bd7f0e22", "value": "393216:nwfBSWcRQovWGIYFCRwFbGgYU+WsW7PG/SnRVe3iZtUPihP/j+Wi7Oqer+eiQUei:wNcRQoGY8e+WWSc+uPihPr+WilDeW0o2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774573099, "uuid": "bfad52f9-d442-492f-8243-4334199c5808", "value": 23128576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774573099, "uuid": "adf169b7-9e67-49ae-86e6-2d266c081ff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774573099, "uuid": "a295782b-d4d8-4ebe-9a4f-96c8b773f673", "value": "ExLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a9a313-2a14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774640251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774640251, "uuid": "9ef6161c-6c24-454d-8ad2-74e0bd873924", "comment": "Malware payload", "value": "0b002b7729943bdf771b63cea55dddf7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774640251, "uuid": "94df6de6-d81d-4905-8180-6089f3bc8a3b", "comment": "Malware payload", "value": "e34e3ed8d59086ad95acfff43c6e6fd230a0f345bbb9b6d1cc9cac1c4a771df5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774640251, "uuid": "5de5ce5b-2864-4e74-8ec1-df7855f166c0", "comment": "Malware payload", "value": "901cf8915a2f29dd9d2f264e1f1c0d617e79b806", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774640251, "uuid": "d1dacfe7-c339-4583-94b2-e52c430772c4", "comment": "Malware payload", "value": "4cdd2949e6d945c1c902e53ade07dc113385bb7c9ffe5fd9d1c7714ae2c373a32a1a731b78ab9b408f3cf298cec80926", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774640251, "uuid": "1a91e012-9a85-430f-804e-a440c48b9a64", "value": "T1B80633D0EAF2AE3475549FD8C4A922AC75EF4F42716224B3BA3C340D71D6F8811B59B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774640251, "uuid": "8117168a-3c33-4ec6-b34c-8fe841de8ff7", "value": "98304:RYdiIXqptuWE+sIW3/HMu/8a+qPjCvwRTGMolsRRVL:Ro0tuWEgG/XUeP7Gha5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774640251, "uuid": "7a849fb3-1b24-4463-81d6-d4973c969fe7", "value": 3837379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774640251, "uuid": "8a47c56c-b2e1-42de-b268-8837c4613a39", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774640251, "uuid": "a1971ff8-e400-47be-b903-b4b60bd7c6fa", "value": "e34e3ed8d59086ad95acfff43c6e6fd230a0f345bbb9b6d1cc9cac1c4a771df5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64cc9564-2a23-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774646692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646692, "uuid": "b253d967-b334-42e7-92e2-97c91266f21b", "comment": "Malware payload", "value": "0fae031b84995e57650f52035a4da5cf", "object_relation": "md5", "Tag": [ { "name": "193-222-99-18", "colour": "#975370", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646692, "uuid": "91cc1cca-85fd-444d-932c-b47c1f061e81", "comment": "Malware payload", "value": "e3cba5d606abd572dcb2cfe755213c9ba5b859a7cd9225c3f94626668049e2b8", "object_relation": "sha256", "Tag": [ { "name": "193-222-99-18", "colour": "#975370", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646692, "uuid": "7f0cfec6-995a-4109-86cd-f2a4928fe451", "comment": "Malware payload", "value": "b58c7ec0cf1c54c00fd56b667af4b16bc55a38c2", "object_relation": "sha1", "Tag": [ { "name": "193-222-99-18", "colour": "#975370", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774646692, "uuid": "ad69c63c-5a52-42d9-8884-824cd3affd1b", "comment": "Malware payload", "value": "0cb5402faff7bae4dca426aa17b1344304743546ceb9de83790e3990a36431199aa60a3b29c0cf5b7dfde1a279263eb5", "object_relation": "sha3-384", "Tag": [ { "name": "193-222-99-18", "colour": "#975370", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646692, "uuid": "1ebfa58c-2af2-4c90-8640-f8bae9f0bf0f", "value": "T1BAF73399D5552023EB7995BD102024BB02A76E075BD92DEF09C026AB83F19ECFF9CC5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646692, "uuid": "5a189b1b-890b-486b-baeb-454103b6d78e", "value": "7a5e2524b66da5177b4ec46d305a3dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646692, "uuid": "367965a1-09e3-496b-aa61-2ecbb26f990c", "value": "1572864:vswyBODpwUJDzJIIaZ0EB7H5OQ8BPNqwcVQipXTmqwPZVV9vM5UG8MCt:v/yBCGIDtIIaTBD5D8BFqwceiRTrwPZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774646692, "uuid": "b8ae3bc1-2b67-42ca-ab15-cca23a1a69f3", "value": 74631603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774646692, "uuid": "9eb60d22-7695-4b49-bd14-e6789207054c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774646692, "uuid": "ebb73972-161c-4101-ae9f-4f140026c0af", "value": "ProjectFiles.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e471dfd-299c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774588565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774588565, "uuid": "4f8b5845-51dd-469f-9eb8-83a93dbd0be5", "comment": "Malware payload", "value": "f1af8da445722db3beca15370a4bc3d3", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774588565, "uuid": "10a9bc8e-01df-4801-97b9-61b805ada6f6", "comment": "Malware payload", "value": "e44de22b1db2d7262c3229ce390b3baeaef4f8ca5ae5a2c266081ae07bd15ded", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774588565, "uuid": "ccdf9235-c62d-495c-b7a1-f07c8881b5a3", "comment": "Malware payload", "value": "ab1dd96e56fdb59b84713f77d766fdf63a817f77", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774588565, "uuid": "04e720f9-cb21-4048-aad9-b2c026101f2a", "comment": "Malware payload", "value": "fd417a9060253c090c85d64ed0a6f8e967d2f869f71c058e39a574272d424741a86604a79ddb5c504fc90bc7b1e47285", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774588565, "uuid": "f9f4ee5a-84ae-4a0a-a932-2bc128a78227", "value": "T1F9563901FECB59F6EA031A3111A7727F67341D058F24CBDBEB40BA6AE877A911C36245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774588565, "uuid": "b496c9d7-993f-4c2a-9fda-ca74c97fe9af", "value": "c6fb30ad4dce883317a7260ffcbc1a17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774588565, "uuid": "eee33086-4861-4ac6-9661-3eb4637c6e93", "value": "49152:CtDF7wpQbskT4fvd1ysxKP7ggrN9VehptBmc3zGe4MqDNu5P76U5E:CrwSbXkXd1yF7ZVyptPqJG6mE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774588565, "uuid": "f56fc5ab-2c0d-4f3b-b2b3-86033f99e313", "value": 6027776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774588565, "uuid": "574aaaee-42d3-4d81-ac47-59efe4296447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774588565, "uuid": "cd526512-ed62-4ac6-a967-db666355fe77", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f17223-29e3-11f1-a769-42010a9c0008", "comment": "Malware payload (Kinsing)", "timestamp": 1774619428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774619428, "uuid": "0fe5abab-6c39-4426-9794-d6461a9b45b1", "comment": "Malware payload (Kinsing)", "value": "946cf98b381af1ef5fb347a95430a77b", "object_relation": "md5", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774619428, "uuid": "9a5db7e4-60f8-443f-818b-84926797f89d", "comment": "Malware payload (Kinsing)", "value": "e533f1531ca20a072c5bab4ddbeeda3d7014e408320ca8507802e2b7b402261a", "object_relation": "sha256", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774619428, "uuid": "e7824f54-4452-479b-a091-04b3ad286242", "comment": "Malware payload (Kinsing)", "value": "b66e7d530c645a29819f319d1245c1e188638cf9", "object_relation": "sha1", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774619428, "uuid": "0ebf648f-8768-4457-9caa-78d520937d20", "comment": "Malware payload (Kinsing)", "value": "89c96a5f72c29452b46a3a77594e6ecf5b212173ef26ce1cf58cfb2366696c38b9e099ad0dde76334e481c29474144e2", "object_relation": "sha3-384", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774619428, "uuid": "2948ae83-b4bf-48ea-ab44-51ddac1a7410", "value": "T16A72218EB011ED74295DC4B59CE2287D602BA00A4D623F10B45C7E786B9DA05F7B9BFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774619428, "uuid": "755bc9cf-7fd9-48cf-865a-0603cc29c747", "value": "384:rfcMihlH2wx2vUaQa5/eN86704s80ooJQYgykWT4yCtvUsDjdWOoJwW2:zcg7YJDj8OoJwW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774619428, "uuid": "710eb322-b93c-4316-b90c-ed3d2ca87a46", "value": 16878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774619428, "uuid": "5899962b-385e-4711-a68f-c16cac50d6d6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774619428, "uuid": "6d7770eb-52f6-4eb7-9c71-3785cc2bf274", "value": "ph.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85cb184-2a25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774647745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647745, "uuid": "beb38f7a-bec7-40f7-9621-92704f28fa21", "comment": "Malware payload", "value": "a9959568e30c249e3712a40a1a3bdb96", "object_relation": "md5", "Tag": [ { "name": "5-8-248-245", "colour": "#8543B2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647745, "uuid": "a03b1e20-67af-41d1-b63c-eeee34d0f6ad", "comment": "Malware payload", "value": "e5913bd62d99ac77cbf91d38a0929b07de53d36e9bbcd591512d40ee3da8c3fd", "object_relation": "sha256", "Tag": [ { "name": "5-8-248-245", "colour": "#8543B2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647745, "uuid": "cf5f46ce-3735-446a-871f-563cbbc41f0a", "comment": "Malware payload", "value": "e31f9ca68bd950d4183f0bd5e0c00fca6aeca9df", "object_relation": "sha1", "Tag": [ { "name": "5-8-248-245", "colour": "#8543B2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774647745, "uuid": "a4d4880e-e62b-4f7d-8694-cd3d4691ba02", "comment": "Malware payload", "value": "f4a5c57f834911d9e62779194b9a1cea754020fec40cd6f6ae62863c7463d4522e01eb87c1016f1035a1350ffa3b8c0e", "object_relation": "sha3-384", "Tag": [ { "name": "5-8-248-245", "colour": "#8543B2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647745, "uuid": "6ecfcee6-1f47-4e15-bce4-e0f9892efa6d", "value": "T141B35B47B7A400BBE0B793388AA38A16D77278521731ABDF465441AA5F377D14E3CB32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647745, "uuid": "61b0bbea-34ee-4ea9-a5ec-646f62d6a6f9", "value": "1c1a10a1396dbcbaebcbf840a6c50361", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647745, "uuid": "f08ef7b2-67e2-4fd1-8a50-13ef8954be00", "value": "3072:SgGChyNQF5B4HLifFlJgTJvQpGGUyZq5VDf0XYOar:SgxyNNrueTiNUCq5VDfaar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774647745, "uuid": "e3f4df2e-8ed5-4b9d-940a-8f0f59d2f552", "value": 107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774647745, "uuid": "ec642c59-16fd-4290-a208-dbf4e5af9930", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774647745, "uuid": "3b096612-fb69-472a-9f79-16f73436384d", "value": "amd_ags_x64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435b4d61-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774625161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625161, "uuid": "e80a3136-66ce-415a-9d77-b58942944539", "comment": "Malware payload (Mirai)", "value": "cee341f162353bcb3cc84416c502c6b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625161, "uuid": "ca3767bd-d269-42fe-9e91-15945c3279e8", "comment": "Malware payload (Mirai)", "value": "e6fe05478fd8116a996246ad92ea85f00e69513a1236d9381a45642e8a4cd8ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625161, "uuid": "8c142445-1fe2-4ed4-a7c0-52166c1def7f", "comment": "Malware payload (Mirai)", "value": "b2ad27375cb79d34fd26640f8cf654b0cde2aedd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625161, "uuid": "c5f5a059-b56d-4f7b-849d-6acbdf61d322", "comment": "Malware payload (Mirai)", "value": "0c1c97dba8450b24c427398e62b3326acf1822f4304f2aa86e0b2cb6811410a06a27a94d715aeb8017fa0dfb5d2020bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625161, "uuid": "4ca0e805-0826-48f0-9e49-41fbf59394c3", "value": "T15E63951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625161, "uuid": "cf8e1d33-3145-41b9-b2d8-9ba858df013c", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAT:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXz4L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625161, "uuid": "466951ab-5cfe-4f36-887b-5287a767aac5", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625161, "uuid": "9c7d8a94-32ef-4b81-956b-32873e1f353a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625161, "uuid": "a986bad7-a4d5-4106-8311-e0cf2627ae04", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70736a82-29ed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774623519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623519, "uuid": "f6b8d324-6cef-4ee2-a7fd-0774707897ae", "comment": "Malware payload (Mirai)", "value": "9ca2bc6094a8102be4f20a70cbf1dea6", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623519, "uuid": "15a539f6-db2e-4a40-b9d3-8f97ae8ea442", "comment": "Malware payload (Mirai)", "value": "e993811b292c79fc83ee134e86f6a0608a634dd61f932e57bf0038ca496ab6d7", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623519, "uuid": "be54cf0e-49f3-4467-8b2e-b0b780b055fb", "comment": "Malware payload (Mirai)", "value": "e5ce194db6e2253a3799c9b7fb69dbc7f09ed612", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774623519, "uuid": "ccbb58de-7af4-4e4d-b5b2-1492a7008073", "comment": "Malware payload (Mirai)", "value": "060424c67fa4611d32d96f9a637e38ee1b845d41a068ae3e1d744e89131678bf4ccf461e5b4b1e6e4204ae1de81a38b2", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623519, "uuid": "369c3b99-8a2a-4af1-887f-c650953b7d77", "value": "T15BA2D02176532D56F3DD1C3CC9AE8317F9A71BFC90F5327569416620C94E21A2E38A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623519, "uuid": "c5e9ae9f-8353-49fa-a320-5f1112029ad2", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjhUMhymdGUop5hL:vvQn4j+ZO5fKAlxKMs3Uozt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774623519, "uuid": "914b85c0-324f-44b6-94ff-e65676aa4adb", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774623519, "uuid": "336a79ad-1ec5-4c10-bbe2-87a71979ee2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774623519, "uuid": "0a6dd4ea-7b6b-468a-a7ae-62bacdf5dd71", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2c8187-29cf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774610682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774610682, "uuid": "9eaa49ea-2eb5-49ab-bfed-4e2222452cdf", "comment": "Malware payload", "value": "210f60b26ef14fcacca95b0a9fa1fc46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774610682, "uuid": "3e327ea8-6745-4de6-8280-b55dd319434c", "comment": "Malware payload", "value": "eae8cd926d6e304636c68e9923bc3f8132aebf27e330ecb61c8f5c8c7e77f385", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774610682, "uuid": "884ad87d-eea7-4c2a-8d34-b88858092ac6", "comment": "Malware payload", "value": "ecb9db239426ee36e9bf1598e6be7707d4ffba40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774610682, "uuid": "e7cd2af0-c1f9-4178-8f1e-048ba12e4dcc", "comment": "Malware payload", "value": "0ccdf19cd11c83d0a86c05d3371dc3ae96b573d6ec7011fdd41851cc450083a1ccbfacf7d301dbb9d0ae01ddb5a3f76a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774610682, "uuid": "2ff619b7-18b3-4bb8-b1fe-85908f4ad60f", "value": "T1EF770116F3F901A8E5BBC178C6635617E7B2781517209BDF55A08A682F33BE06E3D321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774610682, "uuid": "2018e613-c534-4645-8ead-26e53dc4a31c", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774610682, "uuid": "76922bc1-ac53-4328-98ee-1851e02aa266", "value": "786432:25gUyE9ISAlo8PBCck1D6KxCfa7dLfY7wsKF2:RNSAlvCTgff29f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774610682, "uuid": "34380668-2481-4234-b6e1-72b8f41ad368", "value": 32721016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774610682, "uuid": "003b7e8d-96a8-4903-b283-734658fd6f72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774610682, "uuid": "7133c494-3b6c-4917-b5d2-076eee399958", "value": "ETDucky_Installer.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb41835-297b-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774574686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774574686, "uuid": "7dfcfded-315c-468a-9c4c-4f7f9bfc514a", "comment": "Malware payload (LummaStealer)", "value": "8e721bf9a37c7032b2f3543c40ab0527", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774574686, "uuid": "6d954a2d-6383-4b02-acfd-2590c468b927", "comment": "Malware payload (LummaStealer)", "value": "eb87b7e0879db7feeda52158fd7eead952cfda82c4c027a8f870e2cf8b200767", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774574686, "uuid": "186a84d5-67f2-4c17-8cc6-240b85a164b5", "comment": "Malware payload (LummaStealer)", "value": "69eab88949ed3a067704b55772bedd95560bc214", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774574686, "uuid": "ce50c0c5-836c-4133-924f-de8045a37728", "comment": "Malware payload (LummaStealer)", "value": "f6402c8e5be9e12656641b0ad5f4c6fe8ad00b44e05138f5a2a1e7000c75c158d2bb74cf047df918d69d5c4af1dd35a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774574686, "uuid": "936407d6-4d47-4bb5-bde5-48e319908215", "value": "T1A1D48D46D7AA59E2D44B0B7C10E6763B8D20BB340635DF539BC0E9CB695EAD7423CB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774574686, "uuid": "d20a047d-a6ff-4951-b881-66fc5eeb4e2b", "value": "1e653360e5d89e605a51795acc75a784", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774574686, "uuid": "93c3c93d-0330-4059-9abc-8723a22869cc", "value": "6144:F/QUjk9f0ZiyPST4xRJnff6ws7VsqPO5MhMqclxxrBQL5Q1/+dyjfL1PJdrJQJnu:F4l9sUMbRJnff6vVsqPKhzQl0+8phZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774574686, "uuid": "3afb77f9-561a-4986-af3c-94366ed97555", "value": 617596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774574686, "uuid": "384807df-1973-4f82-ac19-ed8c726608e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774574686, "uuid": "44fc743d-99bd-4de7-b04b-3d4bcb319d0e", "value": "eb87b7e0879db7feeda52158fd7eead952cfda82c4c027a8f870e2cf8b200767.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0134bcb-29d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774612056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612056, "uuid": "98529a5c-9181-4002-abbc-4ba6f0ef0569", "comment": "Malware payload (Mirai)", "value": "2c41cd5bf7294a372354584c1c14e2f3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612056, "uuid": "6aaf973d-f63b-400d-b93c-ea4a773b66e3", "comment": "Malware payload (Mirai)", "value": "ec7ce77aaf4822fac971b8ace146f71129ff3b465fe3f40ff4190d1517494baf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612056, "uuid": "69c7487b-b691-4162-819c-eb6f88abeed4", "comment": "Malware payload (Mirai)", "value": "aedf4b4f5de973a74e8d10d34570324409c04457", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612056, "uuid": "965dc9eb-2601-4196-8368-761d174e62c0", "comment": "Malware payload (Mirai)", "value": "cbccba1f7877602383989326899cd0280dff01e17a1c3dffa0bb74b2b378b3d04e5b733a870cd75f7a9a12c381b69ae3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612056, "uuid": "ed335cef-cf15-40e5-af58-a34c2af5efc8", "value": "T1F2935B22B539193BC4E4947722F35326F2F6438A14A88B2E7E710E8EBF156D036477B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612056, "uuid": "2141b504-6824-40e2-b8dc-9ab2929efac8", "value": "1536:08RsLd2/48pr4LaYqPoQatq3KtHw8Ym5owAtQIttxB:0USjsF6R9YOlWxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612056, "uuid": "e9f002de-84ce-4374-8039-9e9aaaab5673", "value": 91968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612056, "uuid": "8a392bb1-9766-4043-b5d0-f829774d00de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612056, "uuid": "b8a0a0a8-53ad-456a-a214-410ee0877da7", "value": "windy.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0cdbb6-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774625095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625095, "uuid": "ff066a4c-5ac1-47c2-bd3a-6ccdf532eaf1", "comment": "Malware payload (Mirai)", "value": "148e2a411a1048a477a2504d27685940", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625095, "uuid": "a95ded46-a7ea-4283-b60e-5fe10c4056bf", "comment": "Malware payload (Mirai)", "value": "ecba636ba0ea98bfe34fa33bee6d18e453ec3e9c35461c095e55c6bf4bdaeeca", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625095, "uuid": "6213263f-23c0-4103-8f91-8f68a7f73a1d", "comment": "Malware payload (Mirai)", "value": "7f8632f8807ebbb19cafaba00fa12f69b7a43c73", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625095, "uuid": "41fcab93-89d3-4734-b7c0-2ad86b869171", "comment": "Malware payload (Mirai)", "value": "c6d9ae8b6d78fbec595506a416049c5b4a8cd4c0a9be5ca81764155f81a213efb170cce188aee869d8220f0fe9088844", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625095, "uuid": "54840f79-f847-425b-a152-a5f680ac774c", "value": "T1A1B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E76C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625095, "uuid": "201534ae-8cfd-4557-b034-cdba49587cfc", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1u/LWy:c9sSyzz36YaWWgg1uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625095, "uuid": "abfa2153-1f07-4766-9f4a-2693610eec4f", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625095, "uuid": "4e0c1509-c520-466f-904f-ea38897cc085", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625095, "uuid": "6e30d761-0bb0-424d-a6db-2e58d74d397a", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede06f29-29e3-11f1-a769-42010a9c0008", "comment": "Malware payload (Kinsing)", "timestamp": 1774619435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774619435, "uuid": "f78157af-c836-493b-9708-6a0c796d8b5c", "comment": "Malware payload (Kinsing)", "value": "afa715748a685b765ca4195726dcada8", "object_relation": "md5", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774619435, "uuid": "1d159404-727e-4748-b1a8-522c52ebbbd1", "comment": "Malware payload (Kinsing)", "value": "ed55afb12f7e6428561841b34660e1fb6be59fad2269d876cdfac038ee8eb0d9", "object_relation": "sha256", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774619435, "uuid": "88ca6dff-40ee-467f-a1c0-54e7c1b15f1f", "comment": "Malware payload (Kinsing)", "value": "936f9d0ad6fd70436f5eea7eadc297b1838c1240", "object_relation": "sha1", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774619435, "uuid": "379fd214-d8d4-4d0b-81a3-1cfd242978a5", "comment": "Malware payload (Kinsing)", "value": "8fd3e7fa1531a7c65f9368355717c6b49042b1f377ac5dec8a8084af22fbe7c2d6fdfb93557486dcd01cf6bcdf266998", "object_relation": "sha3-384", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774619435, "uuid": "6ae0f851-9b00-414f-b830-d84493ef9efb", "value": "T1DEF2374D9072ECB52D65C866DEE1322DB0BEF088C5F37B88AE253D3C55A4005FA715AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774619435, "uuid": "2b9c02a1-0d87-422b-b5a9-0e6472e5524e", "value": "768:NcY7mzQ5VFNcDAFLcIwgnoYq0xFB/ytOvuv:NcKVF+D6cIwgosXmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774619435, "uuid": "e04df32c-2a26-4f6d-b750-947f887bb1bd", "value": 37425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774619435, "uuid": "9fea317e-4db4-4693-9a4d-aca1f696b717", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774619435, "uuid": "bd2bf9c6-c911-4951-a390-bd029bb43e50", "value": "sa.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78117e33-2974-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774571563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571563, "uuid": "b7c20766-702a-421e-8e49-6fb458619737", "comment": "Malware payload (Vidar)", "value": "cbf51022789c85dfa09bdf2cd09fd67e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571563, "uuid": "10afe4f2-0e08-4e96-8f6b-7d1fecf33efd", "comment": "Malware payload (Vidar)", "value": "edfaf90bb5e075540e4a654758b05671bfa589b9ccfe943c5d45b701955c70af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571563, "uuid": "8c70e82f-0a5e-4e92-a72d-01e33d8f89fb", "comment": "Malware payload (Vidar)", "value": "56ae53af5e2ea9b6eb7e31e23c0e2bced5ede96e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774571563, "uuid": "c9cd78f7-8b0a-494b-8799-9de9d25bb6c6", "comment": "Malware payload (Vidar)", "value": "e53e970cca72f026bbad6276ea95ec426dff312715927a3c8e1889fdee8b79484ab54a53a11dd36efad2cf63d1a40828", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774571563, "uuid": "03e358a7-dbd0-4530-9942-8c436942d5c1", "value": "T18C76F86B73588169D1EB91BAD0B2BE1CE8F370756B37C9EF029103549A858F4DE3B520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774571563, "uuid": "6811e949-c4dd-463a-90f3-a65fe83b2ee3", "value": "e155a97482a7bf6208d6cbff0a364137", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774571563, "uuid": "9105b26d-3e99-4e5c-a31e-f390b7da58da", "value": "49152:TJi1Vb1BC+nqKPB81aUvk7rKQSrfHykzFDviIjHW6Z:ido1RW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774571563, "uuid": "e01968f7-d36f-484e-ace4-1ea42690bd51", "value": 7492096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774571563, "uuid": "fc5e598a-1b17-4411-9c6e-e4d8ca62e59d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774571563, "uuid": "e903bdaf-f204-4fd1-901c-551ac17ecaa7", "value": "SecuriteInfo.com.Win64.MalwareX-gen.12975364", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc6a092-2a2e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774651616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651616, "uuid": "ea1837a6-9116-47b2-9a77-78dedfc98dad", "comment": "Malware payload (AgentTesla)", "value": "84ef4d9432eabe5400ee8a54d5d9c2c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651616, "uuid": "0e015892-5eee-4a4d-97c5-c4feae90484e", "comment": "Malware payload (AgentTesla)", "value": "ee9ebdade525ecd62157fa849b664e0d549aa2654c5ed2915e290100b3571519", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651616, "uuid": "c162b5c6-a749-4e2d-ba69-fa54d7ca35b0", "comment": "Malware payload (AgentTesla)", "value": "244621ab1df588760517e9286be1c7ffbe0774d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774651616, "uuid": "c5e64a7d-70fa-4966-b696-00df77ba3238", "comment": "Malware payload (AgentTesla)", "value": "5e07e9a924d89190f0ea62cf5f6ee3a518d4fb47e11adf38895f48e5253ead6f23659b15032bcde6959d486dabaef828", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774651616, "uuid": "e9b961f9-aa61-4858-9433-2c942d598d3b", "value": "T10A65021449C87FB9CFAC561E50FF1609E3A08D8A6019B94AEB33FD4AAFE7E0451171D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774651616, "uuid": "9c3b97ae-9b3c-4000-b847-e5c3bcef64e9", "value": "24576:n6KapMBEhVn1jPRwqLEZ0WMk/lqPw0B+VWQ+R+1FpEPg:haSBYjRbLEZ0V1Vhc1nL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774651616, "uuid": "c11f1935-09c9-474c-b512-3fd74c01ffa6", "value": 1516998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774651616, "uuid": "6e7f2e93-0ad4-444d-81a4-aea2acaa92a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774651616, "uuid": "f019bd25-af0c-4904-9ddb-f415576895db", "value": "PO G2605-3445.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af148ba-29ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774608343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774608343, "uuid": "34b5b4b4-ab97-40f6-9fb0-96f3c2ddacbf", "comment": "Malware payload", "value": "70b258a8f23674355ced1074c047112d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774608343, "uuid": "9dd015f2-9bea-4177-8a10-9b6f793303d6", "comment": "Malware payload", "value": "ef7d83d56f7f9e13b05b5d6de77bf15d3645efc86cc5b3bfd4f3bc8a3497b196", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774608343, "uuid": "ab8cb735-1ad8-4b01-81e6-3e301259155f", "comment": "Malware payload", "value": "ad700f2f622409039909e1689825b778a0dd1308", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774608343, "uuid": "d9272bd8-6aa2-46fb-baeb-e9a1e73642cb", "comment": "Malware payload", "value": "b0ba7dfd8c27eb1cf115d756f6a43034a3a1966de8d17c3eb83ec361b2390dfe6eacccadf09ac953dded5d8428619019", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774608343, "uuid": "c10e6165-4dc4-4197-a17f-0bc1e973c1f2", "value": "T1AE2106EB67D31003EC40AB77E52AC93FF24D2E9A3A4830380437B037AC110A6CA60E12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774608343, "uuid": "2c0bfe0b-eb82-4aba-8e9e-a82147b8cd59", "value": "24:941Di0aab1vM9H/mZ8vsWF/JCqCkwc8OsWWuCr9sNXO5bbyqMF2w1vCG/:941Dpaab6s8vsC/45kEOdjCpsU5bW7F/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774608343, "uuid": "433f2b89-8798-40b5-a663-7b1d0f790dd7", "value": 1173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774608343, "uuid": "f10efc7c-7b9a-4d18-9835-121cde9a344d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774608343, "uuid": "3720c794-f0f0-448d-aa69-a62424e3eed6", "value": "DOC_Ef1xaU.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe00a89-29bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Arechclient2)", "timestamp": 1774604003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604003, "uuid": "1120eb60-f484-432e-87c7-f8e784ca56e0", "comment": "Malware payload (Arechclient2)", "value": "fef0466698b22f314b9e7a1933bcecfe", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604003, "uuid": "9f7eeed9-9204-4d59-8a9f-24308496202c", "comment": "Malware payload (Arechclient2)", "value": "f062ad651c7e214b1bddc45fe9a927182ef2143a4007b7bbc48389e321855767", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604003, "uuid": "f51548fc-0bd9-4621-a8ac-a693b5610492", "comment": "Malware payload (Arechclient2)", "value": "f69b28f403599b6f86fb608f763be14342386f7a", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604003, "uuid": "03c26a6f-1423-48e9-a70d-23be4eeefedb", "comment": "Malware payload (Arechclient2)", "value": "04d46bd35d1ccbff171f613ff7fe0e02d35923c95c0e98d5324259238d01dfee9af2322095068111f4e8af3d2ca02d2e", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604003, "uuid": "ab33bfbf-59cd-44e6-8154-711296d3931f", "value": "T1EED6AE99EE29128AFD7669C149EFB7A54086BB223D014C37957C1E0847341FF79A382F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604003, "uuid": "9819b238-889f-4891-94f6-8388782a70a3", "value": "3aecda2a2dc01100578f886a8a5a21d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604003, "uuid": "2246829e-3dcd-40a2-b7fe-85421d967a51", "value": "49152:nTa5Jk2237xAr0arV4uqE1g76rySen8VKDn/HBwLPUmOkPbNZmWepC6/G+PgfDpr:nmbk22D+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774604003, "uuid": "cf5b554e-6113-448c-8d04-be1ec6ae04db", "value": 12861944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774604003, "uuid": "0af98257-c151-4759-853d-da67a4c50ef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604003, "uuid": "c4ad8100-5bf0-4166-9413-13b4f49566ee", "value": "AppPack25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5c4c53-29f3-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1774626059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626059, "uuid": "7a79c326-3a34-40a2-865f-c7e4988fcda8", "comment": "Malware payload (PhantomStealer)", "value": "80ab57542f5f1b646d6958e1189acafa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626059, "uuid": "8cf663e3-3126-4139-8c7a-9bd392df7a36", "comment": "Malware payload (PhantomStealer)", "value": "f09a097b958bc565b990c17bb42765b488386fc2803a41872296db6923f09c32", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626059, "uuid": "bc1cc8ab-df95-4ff4-aed1-759bd2d63053", "comment": "Malware payload (PhantomStealer)", "value": "f4de39bedf10a75f9f118f28d0d8a0aab3982e20", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626059, "uuid": "bf370190-282c-46f1-a7c5-f784a1267733", "comment": "Malware payload (PhantomStealer)", "value": "2d3e7f9e0233e47b07073a3399d2bf1a09d7d894e2730fa426fb4c1ec27c9f60684b787dccd439b50cae4316bf86a14f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626059, "uuid": "1755eebf-1b6a-43d2-8278-a4f2150544bf", "value": "T18884494293F94519F1F78F58BA7A50A14E77BE5A1C78C42C26A8140E1AF3E148CB67F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626059, "uuid": "d3e9c4d0-856a-41fb-a80e-70d9e4b92e49", "value": "6144:bcjvuxLVVVNqIxRHf6+N65BU1diSjfxyFdl1OVu5cNHrbsM/+vt5V1L0JUolYzLe:bcjvuFVLNqQi+NaSYHlHiNHrbs7vt5iH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774626059, "uuid": "f078bb1c-9129-41df-9df8-7bfcb775ddb8", "value": 390674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774626059, "uuid": "3a0475af-7abb-4322-ab86-3eef0704e7a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626059, "uuid": "7b0ec2ec-9db7-4ab0-9f9e-bf4ec8ecab51", "value": "#1920029920944.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a9de31-29d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774612014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612014, "uuid": "784179a8-1ceb-4ab3-84e4-660f6ad2370a", "comment": "Malware payload (Mirai)", "value": "1b16bf5316eac31a73a03b0ba834e7c6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612014, "uuid": "4ca44b9c-e1c9-4c25-b8e3-2e350c39ca5b", "comment": "Malware payload (Mirai)", "value": "f0c9795445633507e1b8fa7af3497fb19a84660ade4a9e7ecd93fd94c37c58be", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612014, "uuid": "00b192ed-1381-463f-bd77-0dd544cc0307", "comment": "Malware payload (Mirai)", "value": "c3e12243c9f5ed33ff06cc38dea132b760793c8a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612014, "uuid": "fe74ee12-2a12-46aa-8e42-f432ade33460", "comment": "Malware payload (Mirai)", "value": "83256c91cf38118d8a766d862b92df3e92f0a1e929a3132723b8ed54b325764343a17a9f30c22841f8791b94984a88d8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612014, "uuid": "5e16d478-bedc-418c-9040-95b3ab2574c0", "value": "T1758329C1FA8BC0F1D91B89304067F63FCB31E9695061D75DEF9A9E36DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612014, "uuid": "e6f3504b-14f2-4dfa-8bef-453eee998931", "value": "1536:iXDwDhVtcU4xiUWaqH3FgH3IeEMWximKjfTsv4gz9F7vH:kDWKzQLH3FzjwmKjfTc4gH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612014, "uuid": "1f86dd1b-7fc1-4f28-aa78-433569be2c27", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612014, "uuid": "020c9d56-7053-4af8-945d-a3cf25fa1deb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612014, "uuid": "582374be-dafa-4ec3-b599-5f6081a3c0bb", "value": "windy.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c57d1ec-298b-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1774581314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774581314, "uuid": "64c29744-79f9-477f-a370-c552493c30ff", "comment": "Malware payload (Stealc)", "value": "1cfa5c0d2876ee7ec19e795a0b9b8f6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774581314, "uuid": "e6552dfb-e35a-4861-b731-6dc86b8dc915", "comment": "Malware payload (Stealc)", "value": "f13a0b383fc477d28b16fc72e8104b9587647b0da7de9b0fd03496e16e5f1929", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774581314, "uuid": "35bd512d-81fe-4dac-a31a-2d14c70a0e68", "comment": "Malware payload (Stealc)", "value": "bcb94c46c8f21c322a1fe310fdafc677c0c34f68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774581314, "uuid": "baa605c9-89b5-4ca3-8b2e-3eef2879b56e", "comment": "Malware payload (Stealc)", "value": "2c5e5aeca8edb3c6f19c4d514226475fd3db7eff52d5647514af846e7db63b50bc2f14c509117e0867e60612084c153e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774581314, "uuid": "ec14b09a-11f8-431a-be7b-9122d4b90547", "value": "T150B45B21B3D69868E57602300F75A1E0EB3779676A14D86D358C331E1FB26924B37B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774581314, "uuid": "c701fbb4-85f9-4540-a88a-175c30269e32", "value": "83d1b8095e33f74e23ddae505b88bb37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774581314, "uuid": "f1460c27-36ab-4d43-a311-0c6058873f5d", "value": "6144:Yt2mZnLLPG6af8J2TVIj3LRtTobuD5oHX2cDzT4jp48WNTx:Yt2mZnLzGpo2TiLpla99x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774581314, "uuid": "d70b7a68-7634-4d8f-b05e-aa070a32e16e", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774581314, "uuid": "00a48e6a-64fe-4931-b3da-75f7c199c899", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774581314, "uuid": "247dbcda-762a-4c11-9cc9-20eeff062183", "value": "1cfa5c0d2876ee7ec19e795a0b9b8f6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b27b711-29d7-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774614088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774614088, "uuid": "121bdf2e-9212-4c61-9f32-43e8e1684d0a", "comment": "Malware payload (LummaStealer)", "value": "6439772aff3ab93d55e95f8546c98a21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774614088, "uuid": "99f24da6-2fde-4ff7-82af-b1dd97887cbc", "comment": "Malware payload (LummaStealer)", "value": "f2731f3e8c386a76fdf1663c0cb0d4565768ba57aa453b243936da8195b489c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774614088, "uuid": "2f8ba486-fd00-4260-a71b-b99d62650b41", "comment": "Malware payload (LummaStealer)", "value": "389372eb58b970d58f8e90ac107fef5b31fe5769", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774614088, "uuid": "b49ca30a-13e1-4dc9-88c7-970e0ce5099d", "comment": "Malware payload (LummaStealer)", "value": "e1c3d3bbbac94fa332be573dc4dff56b2e4d951ac89296d1a3c3ff5a8102f3314ce2d01cf03d58ae8a8874522a65b738", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774614088, "uuid": "8ad3d42b-c18c-48f1-ac07-c552aab3c924", "value": "T132845C66E6A368E5D84A1B3878B7773F8C106B0543284E939680DFCB7D476D3843DE25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774614088, "uuid": "84a73a22-eb91-474d-ae22-b47165f364bc", "value": "9fe6277fccf8c3d3c4d748526f6474cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774614088, "uuid": "a5167dfe-31a0-402f-bbdf-fe5acafd18a5", "value": "6144:17UP+Qo6aS+Dgj5MVvVonaYJNGJiYMlVVk2GMVeDJ/JLJZJwJBJwJoJwJN:5UGQF+Dgj5MVvYJN9YwA2Dy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774614088, "uuid": "82430d75-76fd-46a0-b22e-3e0eed146036", "value": 377168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774614088, "uuid": "4403f8ef-257f-40b6-a871-f4515839b79f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774614088, "uuid": "a637c4ab-f794-4f20-83b7-8f61d722ca15", "value": "f2731f3e8c386a76fdf1663c0cb0d4565768ba57aa453b243936da8195b489c9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac378043-29f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774625767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625767, "uuid": "15fb6a4e-13c7-4bf5-bf10-471156927645", "comment": "Malware payload (Mirai)", "value": "f88375b64cd3047417c4cf457d3f09c8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625767, "uuid": "fd7eab05-cc71-420e-82f3-8794a2fa7ef8", "comment": "Malware payload (Mirai)", "value": "f4153ef21c78c1816431e23e8e086b6ccbc475df467d5590880940f82ccad0a0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625767, "uuid": "2df49daf-1455-4a65-9e78-adef40deda44", "comment": "Malware payload (Mirai)", "value": "3f30a4b01135d1de442de93d77bcb5c35aa2458b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625767, "uuid": "b4fed033-fe71-4ba9-a9f4-510379294f4f", "comment": "Malware payload (Mirai)", "value": "4ab3222000ed87272aefc31983da913d61f81c638edbb37650dbefaa729ca524bec7e4b57de694c9c8036c1d1d8ad488", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625767, "uuid": "b3454965-e36c-4f78-9007-5e3214e85cb8", "value": "T16DD1D9B4F125D630D88FCAB612A9BD1DE228B8C3D4E58E59FB7E15646C04FEC3C64942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625767, "uuid": "122801b3-cb27-44a1-a933-2dcde2f83ecc", "value": "48:bUrFrf0rtqTBKorKzhqkLaFf6svqEPBPhA+B0RMfd32uAkRmYxnMPYz0aT9+xyMS:odUg2hMez61BIQzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625767, "uuid": "c313fdfa-f5a0-43ec-89a4-64a73720de21", "value": 6214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625767, "uuid": "71f362e2-f309-43fa-817e-eba46f7ce485", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625767, "uuid": "e3e4194d-7be2-4707-b407-555138554a6a", "value": "update.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f845e82-29d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774612243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612243, "uuid": "65dbd24c-818a-4f46-8e39-6e0785f8a85e", "comment": "Malware payload (Mirai)", "value": "88f7a8ad5443070aa42a974e2296075d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612243, "uuid": "06c8997d-a31a-43f8-891f-baa40aaeec1f", "comment": "Malware payload (Mirai)", "value": "f4f1e463a4b20c5e20fdc4ce98258845c21014831086d0d5562b0b199ece11ad", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612243, "uuid": "da4ae1a5-8952-4b35-a637-f5e9e837606f", "comment": "Malware payload (Mirai)", "value": "05fba29987ca791eef63a7a6be6f43ede2ab01bd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612243, "uuid": "3289fada-5d77-4c48-85b0-ae20cb0db577", "comment": "Malware payload (Mirai)", "value": "1ff91b5552523b4be5c7e8e15f02e38d7431bf7c0194c102aedd54f1508d5bc0197fa40b977f1a8a9c3a8b0ac6aeec55", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612243, "uuid": "4bffea29-665c-4dab-bfb8-db89cb2d45cb", "value": "T19621B7DF746418B5774C8D3EAA5249D80B9A3417980A2CACB8CE48553F38678F0F8C12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612243, "uuid": "6f5ef893-a57b-4c74-8f32-dfb3a16bd1bb", "value": "24:mknXK0fWe3hlyFMtmKy51L/5MA2aSRVyq:1Hfluw/yrL/5MA2aoVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612243, "uuid": "942951b5-0a79-48fb-a3b6-ce8adfe2b38b", "value": 1146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612243, "uuid": "11f2f447-8e5b-4070-91f0-b4b7d643d302", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612243, "uuid": "a36698f4-9244-4e43-9751-c82c6d127c34", "value": "nz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86adad07-2a36-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1774654910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774654910, "uuid": "d40f0050-a8cf-4da6-a701-63170a1e0393", "comment": "Malware payload (NirCmd)", "value": "2305debe0b1105e4b78105363ee2df68", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774654910, "uuid": "79d6e81c-85a6-4e62-a980-7166370d529f", "comment": "Malware payload (NirCmd)", "value": "f54c8dde501193698b54501f89d8fed9cd8b80526f1af44b718491f89dbb74c5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774654910, "uuid": "ca24c817-c672-4514-b0ad-f2c3a8bc5e88", "comment": "Malware payload (NirCmd)", "value": "d0a2cf45e3db99e5a386fd5c0aa5b1284ab5aed2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774654910, "uuid": "5074c35f-7eee-4fbe-84ce-7cfdaa93717c", "comment": "Malware payload (NirCmd)", "value": "40a6b0f7358ffae50911f21878fc40483c98ca4113597f361d76f747a75f3611d1a36991957052699aa0ae0bbfe85359", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774654910, "uuid": "40b30400-ba02-41cb-850e-521913b5fb8a", "value": "T133A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774654910, "uuid": "814683a4-4364-4865-9cdd-06bef15e9500", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774654910, "uuid": "fada3c15-d3bf-4db3-af56-cc62af417ecc", "value": "49152:ABRPTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:aJTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774654910, "uuid": "1361de54-eb6d-4954-bc46-96b9707b119b", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774654910, "uuid": "4a0a33c7-3be4-4bef-8cd0-e0808c0533da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774654910, "uuid": "d89b5471-f4ae-43f4-90c8-73eb9f914f04", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471a3947-29ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774596391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596391, "uuid": "15117b8c-96c6-4e88-9a94-c08aa127ea8b", "comment": "Malware payload (Mirai)", "value": "cdbf957e8a3850de5d13ed9a14fb9187", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596391, "uuid": "07482cf7-07a7-438b-8670-70ad143039a0", "comment": "Malware payload (Mirai)", "value": "f5993fc13954dffc409be76117877dfe1bec4334225455ca6924a1f65ee6056f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596391, "uuid": "ee160c9f-125c-4e7e-84a9-26fd0028af9a", "comment": "Malware payload (Mirai)", "value": "468e5e1e5f0fffbab6d29163546cf7a92ffdc3c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774596391, "uuid": "e106e54f-2896-425f-8ce8-5c0ba711b172", "comment": "Malware payload (Mirai)", "value": "a319194fbdc12f798d0efe3fa4c5d4f24376a5a869f475338b4c2070d21886ad4bbad95214e20707ea253b94bb25a1f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596391, "uuid": "3ff7d672-b914-4385-91e8-55e50a0e9b8b", "value": "T152D3CF32E0086DA0DD2117B43476597C0340DEB40AD59243EFBEE5AE28B7DA57DEDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596391, "uuid": "257d5b72-a9c9-4ef7-adf4-c3adef1b54e8", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0Zx6:xOFgpOEoVv3MXL5NhGOx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774596391, "uuid": "56c61acd-11b2-436f-aaed-9d8a95ce7ace", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774596391, "uuid": "3e694318-94f5-4044-8a9a-40b951d110fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774596391, "uuid": "25f517f8-4410-4d4c-abdd-399ef72a7d5a", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3240f3a0-2977-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774572734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774572734, "uuid": "35dff0fa-6e25-4acf-940b-05e269d723c2", "comment": "Malware payload (Vidar)", "value": "09167db34ad66f4f4fb3d60821581cf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774572734, "uuid": "d926b99f-e95f-47de-a415-9dc071ab7410", "comment": "Malware payload (Vidar)", "value": "f618bee5a913d8c93b6cf4b375a7020e4387060add9965b26a45424ca32da648", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774572734, "uuid": "d3da680a-ae17-4aa0-b46c-8f253af76c66", "comment": "Malware payload (Vidar)", "value": "904073f1791e8ea9d42f310ff1458bd0b9e8c558", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774572734, "uuid": "38ab12f3-f7fc-4046-9cde-93bc3c6aa5c8", "comment": "Malware payload (Vidar)", "value": "0c390c62767fcae62ed25053a179812baad53e2f1629adeb8a434ff3f60ad143c81c096bbf310b3e31af661e0778cb13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774572734, "uuid": "366e72dd-186c-4a7b-85b6-8a8c36039093", "value": "T160D42BFE9D60E325F60DD0BAE247D7528F2138011236A6A329BEA3141245873DB677FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774572734, "uuid": "3f5f9da0-a41e-455e-86a6-8dcf83439352", "value": "12288:rWauuPSlU5B0umJF9Iv/ht+JSe9gke2nHDxH1Wg17RWc:aTuPSlUzuj9Iv/q1PGgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774572734, "uuid": "ae15656d-4c4b-4c43-8dbc-30d33aa2db49", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774572734, "uuid": "98d16658-fbc8-43a3-8ce5-7ef32cd1e6f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774572734, "uuid": "0b8821a8-1abc-41ca-88ff-642f84c048aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca131624-29f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774626676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626676, "uuid": "adacc94c-1a9c-4d1b-8333-910a351e31af", "comment": "Malware payload (Mirai)", "value": "180b9777b8f25b6b23caa702ab19fdfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626676, "uuid": "910e0aac-d235-4160-94d6-e8fef54b4af8", "comment": "Malware payload (Mirai)", "value": "f6e66112249f33a9d60e50cd21122e6866e1a699764aab84b04551e40ea91622", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626676, "uuid": "bcbce933-aa8e-47e8-add1-9ffb2f416220", "comment": "Malware payload (Mirai)", "value": "0af4b877f6332ec4c87cb4c20879470873f4aee0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774626676, "uuid": "7652d631-b5d1-40f5-b6bf-be3a35683e25", "comment": "Malware payload (Mirai)", "value": "4bce2850b0d8e4298798dd71c73d27853523a7d4fbfa8e0b85c2871a52d23f8cc48c3cf91388bb017c74a42bda1b3428", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626676, "uuid": "5d1e5ce1-52e0-4117-ae23-94ee70aec41b", "value": "T11DE329C7F800EEFAF40AE73744534909B130BBA249925A337357356BED3A0D84567E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626676, "uuid": "dfaa32ed-843a-4d8d-80ad-2e4476149e64", "value": "3072:LcXLjFS750W80T41D3ym5lf0Ad894VajbiPLx3Vry4O//:uJb1DCmgS89ILxBy40/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774626676, "uuid": "4c6b7eb8-b7d6-4f71-b2ed-0cbc8c40f4ba", "value": 154572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774626676, "uuid": "bf5c360d-c652-43e6-b3fb-72e55e1014b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774626676, "uuid": "caf64458-360a-4cfc-8500-77bd1416ea4f", "value": "acppid", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f0bf5c-29e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774618634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774618634, "uuid": "fd704754-266e-46fb-9851-47cd9a2d13a2", "comment": "Malware payload", "value": "2824a980e20e1bba0f3413b57fb12ecd", "object_relation": "md5", "Tag": [ { "name": "efis-sipom-pm-ms-gov-br", "colour": "#E3B6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kak-is", "colour": "#BA873F", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774618634, "uuid": "c7f01398-ec1f-4a8c-a2a2-26662e00d1a3", "comment": "Malware payload", "value": "f7ffcbb73bf9265ef842966048d7448f395a99e60bee72dd0d230e674d6e218c", "object_relation": "sha256", "Tag": [ { "name": "efis-sipom-pm-ms-gov-br", "colour": "#E3B6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kak-is", "colour": "#BA873F", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774618634, "uuid": "d6082d7b-3e2d-4a88-b3d9-6b6c2f718121", "comment": "Malware payload", "value": "e87265df898648da584aab4f56ffed2c4f2432b8", "object_relation": "sha1", "Tag": [ { "name": "efis-sipom-pm-ms-gov-br", "colour": "#E3B6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kak-is", "colour": "#BA873F", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774618634, "uuid": "8174e341-9dec-4d61-8e7d-8dee36818d36", "comment": "Malware payload", "value": "f01e7600884fd678f2bfbeed7c264c30b71f028e685ccbcc702376fbb3f30b65dab8969b9695a6fb3415fef0f738ca8b", "object_relation": "sha3-384", "Tag": [ { "name": "efis-sipom-pm-ms-gov-br", "colour": "#E3B6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kak-is", "colour": "#BA873F", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774618634, "uuid": "e368be20-dbef-4657-86df-9460c157a8db", "value": "T198357D1A62A901F8E0ABE178C9968606E7B6744603715BCF03E056772F27AF15F7E360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774618634, "uuid": "d055f12e-9421-4055-af2e-3eca2b798b77", "value": "306ca5f4229b4129f4c9de1002a17db2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774618634, "uuid": "59990304-0748-4e23-b91b-7b7be3f7ac25", "value": "12288:grE5cypsgKqeJ8hrWgXLLalzKRdxblaQra2OtCOX3X13h0YomR8YKdxDs4v3mc5I:B5cLgKLVusaHnktCdiYGt3VN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774618634, "uuid": "2ba58de7-7c02-4219-862b-115b9bc10bf7", "value": 1147904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774618634, "uuid": "0d502ab7-e1cd-470f-9961-ac96d535fa5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774618634, "uuid": "ba9c2728-3a72-4f6c-b599-f156ed34c293", "value": "Oficio93201932026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d9033a-29d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774612059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612059, "uuid": "b0e3363a-de40-48bb-8764-a35d4ac3c50c", "comment": "Malware payload (Mirai)", "value": "7c425bc1372f5982e2dd8d5d23287605", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612059, "uuid": "0f3979a7-a7ac-4f9c-a954-78c81103ca10", "comment": "Malware payload (Mirai)", "value": "f8274b271e54f32ee52baff234db0800dfaec945ad5937807d9d893885d75dad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612059, "uuid": "3a2c53fa-90a3-4954-ac4d-995830214835", "comment": "Malware payload (Mirai)", "value": "ce4ceed57f1f11aea87a328470d640eb93df49b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774612059, "uuid": "d765a3d4-999c-4d70-a5ce-6bee05337b62", "comment": "Malware payload (Mirai)", "value": "01844de63e1e0dea736f619739b4e4ac990a7034ac092726f3c697101ff0f61c8a3ac5b7170fb3ec11f7eab27484569d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612059, "uuid": "36039cb3-ce48-4224-878a-8bc8ab60189b", "value": "T10614C70A3A228FEFF56D877147F34A30976976D627E29684E26CD5101F103CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612059, "uuid": "4c7e64c9-6211-4cd3-89d3-3b1ee4ac557a", "value": "6144:496eQCbeoufx4Kdf2dp06GtCqjYW8nY1j20WI:Tely4Kdfap06GtCqjYW8nY1j20WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774612059, "uuid": "4ba015bf-de74-4b1d-908f-782bac8c5d02", "value": 202077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774612059, "uuid": "f98cf4a4-3b40-4e2b-92e4-cd37921ca2e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774612059, "uuid": "b964a4ea-7c7a-43bf-ae0a-e37a4da1ef48", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4565425d-2a0d-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774637191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637191, "uuid": "9664fd4b-84c2-46f1-8963-6cc5330aeab0", "comment": "Malware payload (SalatStealer)", "value": "a568678f0be3be4a088fbd64d4f008d0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637191, "uuid": "459e3be4-e46d-4c9c-b302-9e0d6e127a0b", "comment": "Malware payload (SalatStealer)", "value": "f8a26bce0b29bfaa0351133aff6b85e31dfa7c46280c8b9559829857b6ca7681", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637191, "uuid": "8e808c37-222e-443b-974c-b9183bfcbf58", "comment": "Malware payload (SalatStealer)", "value": "a5493e0fa353f14e9a652ed27f9c6302a34f39b9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774637191, "uuid": "e1e2785b-a58d-498b-a674-f38bcecbc2ec", "comment": "Malware payload (SalatStealer)", "value": "d2a2edba5ad9c16102f26991da6512fea8bebea4eba137480e8f99d3bf6f9092961439cf03dfd15e7dfbf06e9b713436", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637191, "uuid": "fbfe5b4f-929c-4b50-9115-5649adf1e79d", "value": "T18B26339B36F0B2F6C427427EE053AA42F371703206485B6F038543976F67616FE396A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637191, "uuid": "4cc5c396-e3f5-4a0e-a396-487704fcd666", "value": "bfee7c7e234d73184f6b414fec537224", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637191, "uuid": "e3fa0afa-21ec-456b-a05a-b44c58b0812d", "value": "98304:n12xIZT5pBqSwqgK6dP6UfQbUxK6I/X0x7D8Y9MzwnTYDMnyz:nYIFBqSwI0YcK6u0x7IYKKWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774637191, "uuid": "460b0652-12fc-4f8c-919d-00d2ecfcdfb8", "value": 4786176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774637191, "uuid": "e7f23dca-247a-4e54-a245-259e20b4aa0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774637191, "uuid": "4fd4567e-242b-4806-b8f5-b6e02906e311", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "197bd4d1-29c2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774604905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604905, "uuid": "662a1f19-bf9b-48c0-8800-cfae5c16f602", "comment": "Malware payload", "value": "42fbef62c7f40cfc588dc4ddda485536", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604905, "uuid": "3c393a45-dc91-45ae-a125-8087a2f89bab", "comment": "Malware payload", "value": "fa0139d1901c147372f9b715ede43fbf251938e58612b28692a7eb23d37700ef", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604905, "uuid": "715182c2-bc41-4288-bb2b-f2469256d3e8", "comment": "Malware payload", "value": "274d14feb4429734e87a41948ec42ff01295ae7d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774604905, "uuid": "388ef76b-5735-4750-b85b-0e62d87d9e41", "comment": "Malware payload", "value": "442aecf683ceccc06c37abcecd23b046f95f1f56d9c2d2ea6078694d0f5cfb92f41529182bc268163bb4505f1f333536", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604905, "uuid": "81bdfdb2-bc9f-4a6f-9cdd-2b9610ae4522", "value": "T1F9925CA916496C79BBC0DE7D9F3C7F0CADE4C1C02118A39CBA4F39715A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604905, "uuid": "167fc042-73c4-47c7-acdb-bebea4b21091", "value": "384:8Mf0M3vgRjGlsaq74zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:8MLmjfMzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774604905, "uuid": "16cb3b39-c227-4eec-a0ef-6972c3ad307a", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774604905, "uuid": "60b3666d-df42-4161-9b41-c4c58dd738a6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774604905, "uuid": "72970879-de00-49b5-8358-544704487319", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819b149b-2970-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774569861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774569861, "uuid": "c54b343a-2d43-4dc6-ace2-3ecc31a87f3f", "comment": "Malware payload (SalatStealer)", "value": "1ac3674114ee912d99f95ac581930c17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774569861, "uuid": "8ddf717f-9e3c-4569-a83f-31bf2692f88a", "comment": "Malware payload (SalatStealer)", "value": "faffdf60f8534aee8771bacbdeefc8186e516743c458dcf7e19ab5b84dda3541", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774569861, "uuid": "138d74a4-5a9b-41ab-9637-b87226b36124", "comment": "Malware payload (SalatStealer)", "value": "fba2956104e867268e7747a8a7e088cb67ccdeaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774569861, "uuid": "2e547f45-9e39-4438-b872-707fbd0022e8", "comment": "Malware payload (SalatStealer)", "value": "48c595c7ba75ea595d41b09f2303da1770f0aad3723275f34d2b7f0c4de01e218100c0850ac6c8974c0e9de5f0624b3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774569861, "uuid": "d4a5189f-bfb5-42d9-88a3-67e34824a00a", "value": "T145F5334767BB00A6CF8DF07828B75FE89FB9E45F099D449314052E0E62F015E89DEE86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774569861, "uuid": "bad74e45-2f8c-4616-b9d9-e9783a6a4c58", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774569861, "uuid": "90ba70d4-5d24-40d3-8b0c-d7d23ee57792", "value": "98304:iGA5pmwjj54dhNo0i2jvsqOYpnK9tpLyYwpdOiRpn:oawsWSjvfK9t0YwpwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774569861, "uuid": "a56d8ed5-6cf6-4316-87b2-a48075462fc9", "value": 3594240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774569861, "uuid": "e117724d-566c-4090-b7ba-2d2ea7dfa5e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774569861, "uuid": "6c141664-8ab7-4049-9d8b-234091e8a21b", "value": "nixwarecrack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06a1859-2a1e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774644699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774644699, "uuid": "03c622c7-8d75-464b-b546-b53c1fc85b59", "comment": "Malware payload", "value": "f8df6bd893586bdb13f0fee965a6224a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LemonStealer", "colour": "#0B8996", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774644699, "uuid": "efb0a202-a479-417f-a3c1-3f1cf20ec924", "comment": "Malware payload", "value": "fb3e6d6bb2781c8a737c38f4d31beed93a89cc2ff9b8c00e7682f04c72fd9a60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LemonStealer", "colour": "#0B8996", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774644699, "uuid": "4b368727-b665-4f3b-926e-53fbecf394e1", "comment": "Malware payload", "value": "4790bf650e143f60b95eb060ab6f17f3f1eb7de0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LemonStealer", "colour": "#0B8996", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774644699, "uuid": "73442cdb-14d1-499c-9977-cb362f8142c2", "comment": "Malware payload", "value": "27f5eb3599e3b01736d0238517d063550f4eede9485238232671effde02a1d4d5c8da53119937cc586a3b593ef6eef7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LemonStealer", "colour": "#0B8996", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774644699, "uuid": "3ca69f4b-4457-4822-b1ab-86e2e4a4f1fd", "value": "T111083394666412A0F256BC3357704E9A60CC63558F63BAF1D7BD22BCF9A3E0CD52A30D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774644699, "uuid": "4d7bce3a-8077-42d0-b98f-995eb574062c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774644699, "uuid": "d471d0b8-d927-4ac1-9d02-904fda84e48c", "value": "1572864:562um4Ndc27Uu1NBYK1S0dm3iRfIWR3xcz4tLZt9qurxNuArqKe:56Tm4P9UunBNS3ellez4tLn9qurBrqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774644699, "uuid": "79adc46f-2778-4458-b0b7-9ce50da5f38c", "value": 77470025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774644699, "uuid": "97faa8df-f5b1-4c44-852d-5518c11afdff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774644699, "uuid": "c606828a-83bc-4a05-8857-1da903755e49", "value": "lemon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d264476-29f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774625151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625151, "uuid": "385d54e8-c9d7-4507-bd1b-55ce80b61ba9", "comment": "Malware payload (Mirai)", "value": "a38fe5854a3494be66eddb5e9769ebda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625151, "uuid": "192b1ab5-4d97-4c07-b61c-7ae8d91df4cb", "comment": "Malware payload (Mirai)", "value": "fbf43d55f121f00400e60cf2005526acec3527d3d8c5978510f1bcd4eac30f6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625151, "uuid": "fc9f9eaa-60d7-47e6-92e9-d4dabe04f414", "comment": "Malware payload (Mirai)", "value": "16227498cf7684e3b8c9429530264130cfaef0cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774625151, "uuid": "702e5700-3d55-4016-b402-3cf4fe529022", "comment": "Malware payload (Mirai)", "value": "5e8633861d222847242538fa5531cbeccc182385d9091ce6043fd4205eb42396c5cc8dbe728ae7c9d67cbeac3826468f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625151, "uuid": "dcedb8b4-7663-4d6a-baa8-f5400371a2f0", "value": "T1AB630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625151, "uuid": "6f3952b1-1c88-42de-a212-01e51a939ce6", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774625151, "uuid": "01671371-ad6b-41c7-a77c-508078969af5", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774625151, "uuid": "4d401426-741b-4fea-8cf4-779fbd985504", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774625151, "uuid": "13f3e9e1-e9cc-4126-8761-926c12156145", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b515dc84-29ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774624493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624493, "uuid": "290ff27a-0e9f-4dd0-bde4-766b68ced577", "comment": "Malware payload", "value": "9e425c2a5388123ff8bd9d982b00e5b2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624493, "uuid": "8a733569-f105-412b-a6f0-429c9431b9f7", "comment": "Malware payload", "value": "fe4ebf98fb0de925e3c19411bee6081fa0bda4fa4a3e8a0eb88a0be16aa6493d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624493, "uuid": "04ecdd00-2bfc-424f-abf6-1b7f5f8fe78c", "comment": "Malware payload", "value": "e73c45fefe483ce72ac684f7b2c6c65e2bb950fb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774624493, "uuid": "075559c5-28cb-4a12-a753-11451bc641ec", "comment": "Malware payload", "value": "423f23e74fb38501fb468d9ecf3e88f3caeb20cf51c7fe603436f80e2a1a19dcd2fbef4747a18ca7e956e6c526b7be74", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624493, "uuid": "cf0cca09-41e4-4ba5-ae59-6d268fc567dd", "value": "T182F41846AF503FBFD82FCD3702994B1A258D984722957F3A3538D904BE5B50B4AD38AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624493, "uuid": "2a38d4c0-deaf-44e0-ae7e-d97c13c5f64a", "value": "12288:dDT8/LcD0U0yBSo2VwyNalxE/hC088FfL6LS:dDT8/LcD0UOo2VDaMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774624493, "uuid": "a6f79844-1f09-4fef-b10c-0b5504f6f417", "value": 748452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774624493, "uuid": "b0d99014-b7d9-46b8-88fd-0a6d82eb0c6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774624493, "uuid": "e42b19a6-2151-4439-be47-12d3e11e70f4", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246ba792-29f8-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774628116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774628116, "uuid": "56285bb9-06bc-40b6-b654-f623b6d3ff96", "comment": "Malware payload (RemcosRAT)", "value": "fbe1b3a55867614545d658512eb4a8a9", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774628116, "uuid": "49101af1-a66d-460f-90be-23f762b39ebe", "comment": "Malware payload (RemcosRAT)", "value": "fed324185ed119a3aec41ebb55d7745f004cce90ba5935ce8d2d07259856f0c5", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774628116, "uuid": "700700dd-3de6-4206-9013-5e003350369a", "comment": "Malware payload (RemcosRAT)", "value": "5de0e1fa69c3c00953267e8cd0f3ccdb09e50d8a", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774628116, "uuid": "0e8f8d76-8ab2-4605-88dc-4510b4435477", "comment": "Malware payload (RemcosRAT)", "value": "ce267fadf33ae1b24fce01fd5b1c6d978bd3f130879b3c655708cc86f033ed2e114ce1cb76d5b7b845998a90f8e19323", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774628116, "uuid": "8a746203-64fd-4066-975f-e0c671612b71", "value": "T17D54AF4C2560D29AA1470CD02E07EEF8EE2FE1D32F732A5CA6E705C25556E7DEC416AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774628116, "uuid": "67fd1011-3f41-4ee1-8472-04133ca914b1", "value": "384:FNOUVeryCyxYNqiPxaDDhXbDvCyxYNqiPxaDDhXwOUVeruQv2WDpDhhy7vX2QxFY:F37NZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774628116, "uuid": "b179ee0e-d9f0-4ca2-92b8-ea7231697da6", "value": 301909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774628116, "uuid": "2f43f32a-d7a5-4b21-b071-a17fe1996a8b", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774628116, "uuid": "7257162f-7ae4-42ce-99e9-d85c7fb293af", "value": "goodpeopleswithbestfeeling.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78bab1b4-298d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774582301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774582301, "uuid": "e2e4c572-15fd-48d9-88d5-0dcbdb9ca6c9", "comment": "Malware payload", "value": "61fc4ef6aadcee379281cd26af7d1ef0", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774582301, "uuid": "b5f3998c-56a6-4dc1-8f76-52aacb7ffbb2", "comment": "Malware payload", "value": "ff878ecdafee5bd6125d297ac7b30dd750ace38b19e80970897bbff415d26114", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774582301, "uuid": "439d048c-b19d-4a57-baf9-893e9d47ee53", "comment": "Malware payload", "value": "7813b945752e380f0d7ae6034c544b702dbb0506", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774582301, "uuid": "a2064a36-1a2c-4be3-9995-0637f3362d13", "comment": "Malware payload", "value": "aba002418061e8eb5b3a976c439865595cc2cca0ac855cb5832a6d083763980ccd7dca889cebc078fbffd9a64647ce05", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774582301, "uuid": "2d7ab474-e595-479b-8fce-db424adb90d1", "value": "T1FFD322DF699EC8ED8B5F5468411F5C42DD9F5223051DCE607AEEAD843F22EA030B98D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774582301, "uuid": "b746914a-6778-441c-813b-ae257d56ff5b", "value": "768:XuCQFUIZRVZ3dCKAefAWhXivZjKJqiJX8owd0vI26o4RJBOJga6lvsSL56FfrQ3/:+f3dCK/hYi1lNQDSTs3ngnhtG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774582301, "uuid": "e3d0d053-9548-4ff6-a0ab-f4941d4b98d5", "value": 137266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774582301, "uuid": "acfb67c6-5299-4c95-9b5d-c802e3f4f0e4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774582301, "uuid": "6418d2d3-0b16-432b-a6a1-a1f25601c728", "value": "Summary_Beta_v2.5.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }