{ "Event": { "published": true, "date": "2022-04-02", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-04-02", "timestamp": 1648944181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "6b6b6a42-bd49-4898-9cf8-996cfe5fe7bb", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c744a2c4-b290-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648909542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648909542, "uuid": "1822d8f4-ea16-44a9-b385-8b29a159a67c", "comment": "Malware payload (Loki)", "value": "aae6cb36c2a0d68bb5b1768df258910c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648909542, "uuid": "ca68210d-016c-43b9-b176-559808467993", "comment": "Malware payload (Loki)", "value": "012851c8344d897b5588b9ffe0079da9fac4a1fd41cbdfc56d81e39d2611dca9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648909542, "uuid": "0c0a4029-a247-4dfc-928f-9c60fdc50de4", "comment": "Malware payload (Loki)", "value": "9ed430a3a613fcab5fa7dd9b43c6b3ced5e1adcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648909542, "uuid": "2579195b-d759-4f67-ba56-7ae42dcbd624", "comment": "Malware payload (Loki)", "value": "7d234c5e4e0ab6dae3054dec8d05a1f5c6b6d52ee88088eab648981ca7bbb176da736f1656a2e7e00bb31b49fcfbc10b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648909542, "uuid": "851f91c0-6be7-41cd-9ff3-f9a1215d7440", "value": "T130151250F1F90A6AD97753B95C2590001737FB3B001DDB4D3AB2319A6A723C252ABF6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648909542, "uuid": "66c12b3c-e021-4746-b73c-fa8c9116df6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648909542, "uuid": "cfb67855-3888-422a-9816-1fa745a712d9", "value": "24576:sqgjj2Zw67Qu7Xi7iIrgwN9fciYuBBSGp0:4uMIXSnrgwPYuBfp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648909542, "uuid": "4486b5b3-6e05-4a52-92a1-ec598e0a7dce", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648909542, "uuid": "cb2f0473-972c-45a2-8b77-7e98daa865e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648909542, "uuid": "41ebd14f-f3b6-49c1-b933-6ff07623dc1f", "value": "aae6cb36c2a0d68bb5b1768df258910c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149df01c-b290-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648909243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648909243, "uuid": "b56cab0e-d7ee-40e0-af24-01d13010213c", "comment": "Malware payload (RedLineStealer)", "value": "19eab19c0d0a0b062c8eb85a94a79cc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648909243, "uuid": "55d3f216-0e3f-4356-9135-2bd77e76cf91", "comment": "Malware payload (RedLineStealer)", "value": "02eb6c61b19d347b9b6846285991142bb0d7515401f8fc4cf7f961be72a3c215", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648909243, "uuid": "3a07071f-f501-4cf5-9b34-9bceaabd2098", "comment": "Malware payload (RedLineStealer)", "value": "3f0e2e88b9ff61e2e56edc473861cc4373af525a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648909243, "uuid": "c5092377-b3a0-4329-a6a2-090d7bfac708", "comment": "Malware payload (RedLineStealer)", "value": "a26dca2dc167e582d880588703b95a6fcbc20b8bad6ac8776f5e2c59cf51dbbb11d069d178ea5109d592f2e676ad4fcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648909243, "uuid": "e4c9038c-02b3-4dc9-b76d-9acff9cc5449", "value": "T191A35D20679C9F19EAFD1B74B472012043F1E08A9091FB4B4DC1A4E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648909243, "uuid": "a5d1b4d7-7f42-41f4-885e-9994545a3d93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648909243, "uuid": "544a6578-f1e0-49ff-858f-ca1c35d14b64", "value": "1536:5qsIOqJGlbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2FteulgS6p8l:XTuOYj+zi0ZbYe1g0ujyzdx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648909243, "uuid": "96f34a56-b70b-4734-a12b-dc58774d99b0", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648909243, "uuid": "f980f84a-9afb-4f54-becc-d88e86e89d2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648909243, "uuid": "cc61bf2e-ff57-4caf-83bc-eedc08400203", "value": "19eab19c0d0a0b062c8eb85a94a79cc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcafe6a7-b264-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648890734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890734, "uuid": "27a15dee-96ed-48f4-905b-5e0e420ebdfc", "comment": "Malware payload (Mirai)", "value": "754c5e4f464a7195c0b71a09fa2c0c55", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890734, "uuid": "bf6ae17d-7d5c-4d06-8268-28edf0b27937", "comment": "Malware payload (Mirai)", "value": "04c552d48c984020b109da1d90fa700079e5ff62e635d3df9903bbdf4defff0c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890734, "uuid": "f1484062-8fb7-42ea-8a7d-bbd90feb4baa", "comment": "Malware payload (Mirai)", "value": "b6f4e3cfe1f392bdb7c2060ef1ea0067c0ff96bf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890734, "uuid": "f13ad8cd-e080-4817-8781-1a523803453f", "comment": "Malware payload (Mirai)", "value": "9d425049d70305c15aca28c7f94cd0f111d1be612e67764ab06cac6799c7a780e05af586e79922b4188724b218bfac16", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648890734, "uuid": "1766cefa-47d1-4103-8ead-972ff418706b", "value": "T17583950D3E319F7DFBAD82384BB74A21A74833E666E1C584D15CED011E74389781BBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648890734, "uuid": "89dfae88-2725-4ce6-b8dd-44cf2dd65db0", "value": "1536:5Uqr/rgolxci5U3k1CjLSjLzZjLkxQZ3Tznl48rqBPm/imbITYL7Yf:ee/rvxcn3uZ1znlUPm/imbITYfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648890734, "uuid": "ba1aaded-fd82-49aa-9225-2b3309db1b42", "value": 84356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648890734, "uuid": "a76d290e-e8b1-41ea-98f3-7b4751e040c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648890734, "uuid": "427a9f2f-1be5-43a4-b230-5a8871d0ca0a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e677812-b2df-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648943404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943404, "uuid": "b0c84304-71bd-4018-8f23-53e7987f7478", "comment": "Malware payload (Mirai)", "value": "af60ffebb62f4b88ddd7bbf7a6a1b2c0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943404, "uuid": "163c1f71-056e-4031-9baa-828ffbe007cd", "comment": "Malware payload (Mirai)", "value": "062f554ac3127bcaa918d3e55a3bd0d4a666f6aa17df5581d99d2467c8067c0f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943404, "uuid": "efa246fd-fd01-4660-904b-92c506c2db05", "comment": "Malware payload (Mirai)", "value": "59b362d57c422c0ba46ceda20cc07a9ea48fca01", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943404, "uuid": "a6c39e42-ff16-4a58-9e42-b75ac792b2d2", "comment": "Malware payload (Mirai)", "value": "52587ddf9526a56e3ef885c3092a8495307581d25a27b41275010dfe643aaabc341af1f88b6445e4e9a7a7d6fa1ffb05", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943404, "uuid": "69d6854e-46f2-48af-a3c0-7675b580f1f7", "value": "T1E5E32A46FA408B13C5D52B76FA9F414A3322DB54E3DB330689189FF43F86A9E4E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943404, "uuid": "2b05bf7a-c48d-48ed-8a9c-66c95e88157a", "value": "3072:tmwkaDfiDPSYGI11nxCQ73yfrG8ASyEuOfVM/9iXSb8:tmKfi+YGi6Q73yfrzAcuO9M/9iCb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648943404, "uuid": "2c927606-3e27-4933-bf77-c6459e5b0067", "value": 148333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648943404, "uuid": "4034b259-fb92-4e5f-90c4-692d25f3cf17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943404, "uuid": "c81d4b48-70c9-48c8-8ba8-0d2bd682def8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f318de7-b2a4-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648917931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648917931, "uuid": "320ac4fa-5b45-4179-b1f8-02b7d7a57bc8", "comment": "Malware payload (RedLineStealer)", "value": "5d0442f119f95a907dcb9b1441d3b4f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648917931, "uuid": "59d7e8e4-50f0-4a51-9a9b-76be725342d3", "comment": "Malware payload (RedLineStealer)", "value": "072682eba004ca577cfffc1af5651f9d15108bcf9fd896546c6096e37353e597", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648917931, "uuid": "4a3ede60-a23b-460d-aca7-d411606ca048", "comment": "Malware payload (RedLineStealer)", "value": "42ccc8151c8c5d1692b34e3b8b7cad4a42e4e336", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648917931, "uuid": "ac2f8a87-435f-425e-a558-72df5e9a98b2", "comment": "Malware payload (RedLineStealer)", "value": "a2bb27f45b4e9495365454dcae786faa76fceab789310a9518a4f397da7785fcde69b3807579be875ebaedee49235224", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648917931, "uuid": "02da1f78-8b7e-4695-ac7a-d5f3ba75765f", "value": "T11BA35D20679C9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC164E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648917931, "uuid": "201cfb0c-689e-4538-a93b-91457b683d6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648917931, "uuid": "bc7e2cbc-3b13-40fa-a39c-211648823e2e", "value": "1536:xqsIjlqzWlbG6jejoigIr43Ywzi0Zb78ivombfexv0ujXyyed2iteulgS6pk:f0UeYr+zi0ZbYe1g0ujyzdSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648917931, "uuid": "a92d7314-df92-4ffa-bb12-8fcb4aee8a12", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648917931, "uuid": "34bd08a7-3eec-446a-bbf2-2a15bc6615ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648917931, "uuid": "e2024919-65e4-422e-bf40-4a78120383a0", "value": "5D0442F119F95A907DCB9B1441D3B4F0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd47ee55-b264-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648890735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890735, "uuid": "0ec3d742-09ca-4d3c-8845-504fc0f4da6e", "comment": "Malware payload (Mirai)", "value": "fbbec49033f337f223fbc89e8ee5fe37", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890735, "uuid": "c10fef39-69ee-4ddd-bed5-bf46e054771a", "comment": "Malware payload (Mirai)", "value": "0769b21f704be80f4710b9ff60f2da4c452481ac189bee656b83363eba556884", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890735, "uuid": "d898dc99-5d66-417b-81c7-223391edbeda", "comment": "Malware payload (Mirai)", "value": "33e6b8e108e8f5f014289b83d1369a8f5c7e35cb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890735, "uuid": "a7bafd20-80b4-49b1-88ef-b23be706cd62", "comment": "Malware payload (Mirai)", "value": "c418ed198777c309e3d92944b060b5ee2db63de5d163a31ac777bb5f8e2500568a72304ffcd12eb83006611229662ea6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648890735, "uuid": "9775b4c1-030e-4b81-a182-d589f2c252ca", "value": "T107535BC8A183E9F6D802163D30BBAB725E73E53F2064EDE7E7D95D379902A02911325D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648890735, "uuid": "24a24465-6fca-4266-ba1c-e9a39e0fb8d6", "value": "1536:3pmy7q3vHtq4GplnCHCbJfjEOWG2efCzl:p7qPt8plnCHCbBjEO12iA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648890735, "uuid": "6d3c613e-a445-4e57-ad38-1e9d0ab4b388", "value": 62224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648890735, "uuid": "0b5474f0-d366-4c0a-ade8-06ccd3650e0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648890735, "uuid": "5b5a2ff2-40a9-43cc-a017-1b2a76b52f80", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20124a4a-b2c5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648932025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648932025, "uuid": "2fd29657-4d54-4d28-b83b-c319aa77282c", "comment": "Malware payload", "value": "f2e04a82585a48fe5484691e012771d9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648932025, "uuid": "69b9f494-cc20-49c3-a9e3-47ac4871b101", "comment": "Malware payload", "value": "09d312438990ab9dc24cf20c2b59b3d415855170c8f5204ebb3c0f00918316cc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648932025, "uuid": "66048aad-9c28-40d9-b56b-7e8684969b01", "comment": "Malware payload", "value": "badbd2eaa3c43d8edd14886903b5aa211071a1de", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648932025, "uuid": "bb1e5171-c6c5-44d6-a91a-6dc16577a859", "comment": "Malware payload", "value": "b3e005924e98ff682952789e09c7c7ffcd2c15a6fbf329e95d8c5dc6a28da73ee8f2667c6df17c10d6ca3b2ba7f221ff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648932025, "uuid": "2b4855f7-6637-4f13-9861-35e36921ea15", "value": "T146C12406B721D53BE03717320DD3A7252B26E870B9A04F073A44238F1C323001E32E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648932025, "uuid": "9969c63e-b13e-409d-830e-b8a4696dd6b6", "value": "12:Q2w4Ugmzy4liF7SISShthLy4b8kdE9KsmM9EEX/HnXw6XUEK/XDXw6X:3k7zy4UY4QvHfnV2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648932025, "uuid": "0d7fd8a4-821c-4467-b36c-b86b7af5b34d", "value": 6148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648932025, "uuid": "92f71347-9b02-4c94-a045-0708660511f6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648932025, "uuid": "dda64830-34d5-49be-8439-77776ff5957f", "value": ".DS_Store", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808f9800-b285-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648904699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648904699, "uuid": "c79c21c0-6a84-4d89-a9c3-461ee13076d2", "comment": "Malware payload (Formbook)", "value": "ee44813e283e7835ec67fe8556afc730", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648904699, "uuid": "421b32d4-1c8e-470e-86d9-484cab41e61c", "comment": "Malware payload (Formbook)", "value": "0c5aa62c1183c41e931fdfb59467d50e7efb33c51bcd5e1388f0a1c9554b71c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648904699, "uuid": "6eae103c-5461-4248-9f04-e389496371e9", "comment": "Malware payload (Formbook)", "value": "a0ab6025e6f5c4e27cd806d0cfdf39e805e91fe5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648904699, "uuid": "97198f69-c313-4556-8112-8cd3dd204f1f", "comment": "Malware payload (Formbook)", "value": "b5090cc87aaa0176f49f33247bdbad4b20d916da052e6b6a2dc5c31460648ceb2b33a2afacf57d435c99deef1608dda4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648904699, "uuid": "8a45a2a0-ce17-4703-845e-7c53222f7849", "value": "T1FDA4D0B7C3FAAF1FE1DE12391410842A7FF0E883BA60D519FF8A11AA897B7954054747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648904699, "uuid": "00c7f610-492b-47d8-95a5-cbb25d6a5748", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648904699, "uuid": "33007505-1f05-4482-9356-2005333dfd4b", "value": "12288:kwG+SsLEgGbkPLbjMWhs7iB8Vsurlh1T8u:KqhGbcnjJJwsQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648904699, "uuid": "d73f8a0d-16f4-4811-bba3-82fe37a73571", "value": 472576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648904699, "uuid": "2346218a-0299-433d-95ff-c6c30dab414a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648904699, "uuid": "7b8112b2-68de-40be-990d-8ea858dadd30", "value": "Bank Details 0001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4ecb33-b2b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648925904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925904, "uuid": "0ccee6c2-2975-496a-96f3-0055f60c2a9f", "comment": "Malware payload (Mirai)", "value": "e0ea721bb13bc862cc636f5b7712e2ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925904, "uuid": "1ce73052-a955-4cd0-9e4a-54b9b99bc11f", "comment": "Malware payload (Mirai)", "value": "0d5633fd6a6d744f2034269d8fd70e0ff578b036924f9eb9f39756e06b95cd13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925904, "uuid": "8c83fe7b-16e5-462e-adf4-70f4215d6ae7", "comment": "Malware payload (Mirai)", "value": "3f765a96b6314cf168937a44b2e99f8e7467b588", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925904, "uuid": "2e282e78-2053-4911-bf6a-530986f66a69", "comment": "Malware payload (Mirai)", "value": "495eb829b9957aa4a6dcb20aabce9644e3456e774a97d045488dd43bcf950c33fce5aed918a9fc2287edf6abac40f5d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925904, "uuid": "e5a1535e-ca33-4d45-a508-97c8e9574b8c", "value": "T124931A86BC419A11C6C51677FE2F118E331257D8E2EE72138D241BB47BCB85F0E2B95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925904, "uuid": "982ad77f-2ad0-4033-a408-9809ba0b08a7", "value": "1536:eqnETwQo8Uo6nblZL5or1j4KvDCKzVMIV0mDm5/UindM+is3aBqAl1:LQZIbl8r1NLhMuZCj3aBqAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648925904, "uuid": "dd858fc8-6fa6-400a-bc1a-24e263735ce7", "value": 91860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648925904, "uuid": "714efb22-c120-4c23-ada6-7f81aa04c912", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925904, "uuid": "4ab15a4f-a2fa-45aa-9b79-a478def40e0b", "value": "e0ea721bb13bc862cc636f5b7712e2ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac385d37-b288-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648906061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906061, "uuid": "37f92393-7e19-4ddd-bab5-f6cb7516d110", "comment": "Malware payload (Formbook)", "value": "04f3699b99b27e770a0d554239a9a78b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906061, "uuid": "e88c49fb-e153-448c-aaf0-58ede3836f52", "comment": "Malware payload (Formbook)", "value": "0d9a5e5493d6860cad307ec9de37ef1af8fe1e7b6855cd3ab7f854df26c8e00c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906061, "uuid": "421b4a83-f465-4072-b96a-545a8bc43fd9", "comment": "Malware payload (Formbook)", "value": "a3727a4706c6839b922f84bcff97d00d1b8e619f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906061, "uuid": "d8b78d6d-7319-4dfc-8dce-9e8b87d6de83", "comment": "Malware payload (Formbook)", "value": "2e0390e0826b184238d6a4583ef885f9fd9c09f4cd7ed75dc91051458bc7717aedaabb74c8d144202aa9f0f33dfbd451", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906061, "uuid": "c7e73040-242e-4e18-b272-c619a0e740be", "value": "T169E4120435F89B5BC67C83F6A5E6A11893BEA706B641C3CD1DC260ED6AD778107C23A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906061, "uuid": "da847072-41b1-4516-b346-5dba746a156b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906061, "uuid": "d357d911-4844-4815-aa14-5676145efadb", "value": "12288:UEccPbc33vwbe1mgAmUzQIRQlZbeIUKsO8RJc:tcPORgFUzm3btdsO8RJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648906061, "uuid": "5f273c4b-d641-44ac-93c0-5eae66c30cf4", "value": 664576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648906061, "uuid": "80ac1b9b-196e-4c93-87d3-a77e1c74a5e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906061, "uuid": "3fd2213c-bd8c-4ebb-baba-885f61929b9b", "value": "QUOTE 115345 115346.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60984b27-b239-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648872004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872004, "uuid": "5dc2c762-a336-4dcd-8b0c-7a972be9ae1a", "comment": "Malware payload", "value": "567e71c57d8bcc8eb9b4f202383fec2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872004, "uuid": "2652c4b8-0c61-4440-a5fe-96bd88e694a0", "comment": "Malware payload", "value": "0f793455e93a639a4298735b9b10a9c07df927f08c8c2dbde932ac42e07f5fc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872004, "uuid": "f4f026f3-4a86-4a12-bc01-663390a00670", "comment": "Malware payload", "value": "b7794d7ed814ddd0c125c018038901e68876d64c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872004, "uuid": "60011feb-7622-479a-9b63-51c31128a206", "comment": "Malware payload", "value": "edb25a0bee6b6f24eb3f3c6d9de4ce4608f9fd21645797894c6ee60c502b7c022a3d54f65939b1f0395e5a8173ed6c7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872004, "uuid": "2593471c-d201-4012-b5b7-3778d4ff907e", "value": "T17304173EB6859E41C58414B1C1E7C67403E2BDC7EB32D65A3F447AEA3D633648D8AB84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872004, "uuid": "eb4d2e6f-e26f-47cf-b4d8-6ce6cc4562d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872004, "uuid": "518a9afd-57a7-4f0b-8a40-cf839f9d220c", "value": "3072:QFlyTqVDOfbpPFf8FfHbqKex74NPYVoTDfB7fcmq5AYEVLgBICgWR:fGVmf8dHbqKmgnDZsSVMBIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648872004, "uuid": "8cfdeb17-402c-4660-a203-04b42f25ee96", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648872004, "uuid": "9af9402f-d680-49ab-9c34-c6bb1725f16c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872004, "uuid": "c4394580-94d2-4a43-8076-072b11fcf5b3", "value": "TGX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6600df-b287-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648905503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905503, "uuid": "0ad68889-8129-4a40-be45-69f7dff9956f", "comment": "Malware payload (AgentTesla)", "value": "f09f783d8b771e4242f10bdd65fd4599", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905503, "uuid": "c58fa96a-a743-4f4a-9f15-7ee5e2d322cd", "comment": "Malware payload (AgentTesla)", "value": "0fc73042d1d73c538d8088f9e117ec7ba99d950863dc215c7d1b1bd9a7472c72", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905503, "uuid": "a1376b45-9514-44d1-a9d7-123e70ea7ef4", "comment": "Malware payload (AgentTesla)", "value": "09dff76dbe5d8b18e76df7fa2c37c6c63fda5cbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905503, "uuid": "d7096d57-bd6a-413e-8761-ee372a2c1547", "comment": "Malware payload (AgentTesla)", "value": "cd2403a1153b015ccbbd0f97361c201a8fa1f24ef261de06f8905a30da711282c6c637faa25f80c165fe3b1c051ccf5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905503, "uuid": "d75ee2b6-fb68-474d-a964-384c77bc2158", "value": "T1F5C4BE76E3F86F67E2BD93F9A021110637F4D413F319EACABD9A50EA0851B8402527D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905503, "uuid": "cf2c08ed-031e-4197-87b2-e4f0a1ee0df0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905503, "uuid": "852145a6-355b-445e-b889-d040f52e4f96", "value": "12288:zXriFezyC2USU+70NX2lQKEUQtEufB5dyLTZlvNgsN5s7APpQvjNA/0U6GBpbdcX:zXriFezyC6SU2ZfdQllFRN5s7SYN+0U2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648905503, "uuid": "1b4ebee5-45ad-4c2a-8a4b-3a55272da890", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648905503, "uuid": "c969bcf8-e2de-45ea-b291-9d7fb2eb0ea7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905503, "uuid": "d76498a0-a192-4afc-9614-985bab459241", "value": "TRANSACTION ADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af41b707-b2df-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648943432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943432, "uuid": "f7d786ed-63a5-4d26-bdde-663bc9cf65fe", "comment": "Malware payload (Mirai)", "value": "8fa71dc16d7836a115809f2f1f809ba3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943432, "uuid": "ffa034f1-5d1c-418e-b584-e9149715ea41", "comment": "Malware payload (Mirai)", "value": "10d146a8ec9329fba8d476ebb6f12248042586ca600594f7e7c12f0dcaf8701a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943432, "uuid": "a5069425-8641-4307-8788-3c7f56a4d8e1", "comment": "Malware payload (Mirai)", "value": "d4413c9e478da694adaf7546785412559fcbe501", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943432, "uuid": "6f73f42a-77ff-4262-ac84-27dacd4f517e", "comment": "Malware payload (Mirai)", "value": "1c3cc02b44faf9283ab4577f7da318849b1f0da0a0cce4a1c1b07de7d7f8ba7db99a1f15ae6e6ee8887f19681cc19661", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943432, "uuid": "20b96214-0139-4658-a90a-aaa8e7e775ec", "value": "T17B333A41BC92996ACAC42376BB2F519E331163E8C2CF3217DD185F2036D9A1F4EB7952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943432, "uuid": "3e6d70c2-5793-42c1-9afe-fd6831fa7447", "value": "768:XE0TwSpf+/C/gB36tjFJHlHin2ez8cYty5ASJxYaEz6rGR2o/U76udBN3a:eSp4PB36tjFJQnMcNeSTHEfYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648943432, "uuid": "ad5c6e2a-e3f3-4f7c-8358-b8479dda0d32", "value": 50584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648943432, "uuid": "d0e4418e-28d5-41c9-8c66-08fd2e2d8068", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943432, "uuid": "84fdd747-e0ea-469e-96ff-9f6f296ceaf8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6363c24f-b283-11ec-8e58-42010a9c0032", "comment": "Malware payload (Joker)", "timestamp": 1648903791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648903791, "uuid": "0e1bd5ac-278a-44ce-82c1-a8227a1104e8", "comment": "Malware payload (Joker)", "value": "057c93e5ed9a86d7b9fdbbee8e928ce9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648903791, "uuid": "f406445e-726d-4704-8082-16f6eb406c55", "comment": "Malware payload (Joker)", "value": "12a373bb0dd993c9cb63b8f6e0537610f098e9268104a644794f27238efa7794", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648903791, "uuid": "74c85b4f-bb00-4f9b-a936-ff0f77fb5f9d", "comment": "Malware payload (Joker)", "value": "03586ebeec55928ba5f01dce4d39dd5d09d2b1c9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648903791, "uuid": "ac3d19a5-fcbf-4d8a-9498-58d87c76f430", "comment": "Malware payload (Joker)", "value": "bbc17da775cc076ef015e35aa88968ee88f6b15c9d3d3c027da9b184cefccb77db590fb020e3f083ac53e29761061ea5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648903791, "uuid": "7750c317-0686-4f57-9ec8-caae62df3bc9", "value": "T1F8073347F3A9981EC8F7D3361A3A1135521B4D96DB03D797E818737938B7AE04A42BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648903791, "uuid": "831ad064-5f1b-4240-8484-ab94ca9dab96", "value": "393216:/4rZWZLEoVBKvai0KQ/wJiR5FrzC3Cit2GRHE3C5frmKRttHj3:/4rZWZLEozKyIJMzk1HEy1mKXxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648903791, "uuid": "e668e786-6f38-44fb-8f34-6e8d291aaaf4", "value": 17660557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648903791, "uuid": "66f2aa12-28b3-42e7-a694-4970ac879c30", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648903791, "uuid": "c728d1fe-51bb-4aed-bb17-88e4654b009b", "value": "Blood Pressure Tracker.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2757d1c-b238-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648871685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871685, "uuid": "9d98219c-d999-40b6-b18d-8e7471fdbc29", "comment": "Malware payload (Mirai)", "value": "25661977fc361da7c7d0ebf10668e1c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871685, "uuid": "f1051a8e-9169-43ee-90a1-78e08f463e1a", "comment": "Malware payload (Mirai)", "value": "14704c35a69a42a309eee456785e0762d32cfd63df7ed9e7e2b52c5749b66b6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871685, "uuid": "67fa0cec-3f40-4ee8-9885-ba4cff0d61f1", "comment": "Malware payload (Mirai)", "value": "438140f5a4f49e33ffa49f482a8b6cf4988de634", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871685, "uuid": "58b5e362-4796-427e-87ab-058c914cf32f", "comment": "Malware payload (Mirai)", "value": "3cb34214158c0ad5ffa9b437f54830ed7d1e420f2f8be757e4a6355ab9891671264c69f6ebab86bda50ea1d81a07f118", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871685, "uuid": "e231f060-32f8-4cf5-9ead-6b397b9303c2", "value": "T1E1635BE5F4019E6CFD4FEABA80110A0DF96233109A530F2BA2BBFC937C620649D56D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871685, "uuid": "6f3d0e99-9047-4007-86ab-9d215da9d4b0", "value": "1536:1W7ynCTQFTniC+enz0HjzcAnjNQnFh4cO6nY6BcG80dUq8+:OQFTniCVz0DzPZ6F9FYn0Sy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648871685, "uuid": "f7cb83e0-f71c-4bd9-953b-68bb1b9348f8", "value": 73104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648871685, "uuid": "19634c43-98d6-4b3e-a9f1-bab6d4da1ab6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871685, "uuid": "0b2539b1-6ee4-4a0b-a3f1-79bfc0270eb9", "value": "25661977fc361da7c7d0ebf10668e1c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d068515d-b2b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648925879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925879, "uuid": "847805eb-b25b-4ecd-add2-f983285f4c95", "comment": "Malware payload (Mirai)", "value": "9808b8f093d940cb3fdbaca3db3ca9ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925879, "uuid": "9fae7449-72a7-4907-a30c-fe56f0f19788", "comment": "Malware payload (Mirai)", "value": "14a6614bf76bc0e5b06318b820f78e451af40c3336de0cd6091c5b319c66b3ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925879, "uuid": "109025df-8db4-4d06-8dcd-b6504da17e0b", "comment": "Malware payload (Mirai)", "value": "92b32e94416af51e346f6b5edffd3aa6b3a3b0f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925879, "uuid": "bc167d33-64d4-4fea-817d-5194048a2054", "comment": "Malware payload (Mirai)", "value": "f218a020253987fa204d8ac8d32e0a3ac1714427cc84b4697790a8d1a38844dcb8e10ec9ee9f91eee5ef485d9ed21484", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925879, "uuid": "87b8b8c3-deb5-4476-9cfd-65d91ded196f", "value": "T1EC734AC4A9C3E9F9DC10063D307AAB729E77E53E6039EDDBE3A965336946601C10225F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925879, "uuid": "7fce0d48-d86a-4ad0-a860-f4824b5c1a68", "value": "1536:zqvtw4K6SopNfoPVPEwMq/eOlxCOHItIGeI3vSo5fSqH:zKwHZ6uPVPE9Ukk4IGeI3Vl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648925879, "uuid": "3ee71554-0f9e-46ea-9396-1e06339c261a", "value": 74832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648925879, "uuid": "46f9f954-7774-4091-9494-d1c48c730e5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925879, "uuid": "ecfc6331-1d76-49f4-be0c-ed089774eb90", "value": "9808b8f093d940cb3fdbaca3db3ca9ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f3cfa76-b28c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648907677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648907677, "uuid": "68076d63-1353-4db5-9410-c5eb68853f0b", "comment": "Malware payload (AgentTesla)", "value": "596055e4564552e0db3055aa36f3c6cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648907677, "uuid": "a3655c83-eb1a-418e-b153-6976603be820", "comment": "Malware payload (AgentTesla)", "value": "16175c2b7d290ae642c80d73cc48f5b3f5d9d642a5159ee515ccb7f28ae97ea0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648907677, "uuid": "be1f9762-b42e-4f55-b5aa-21eafe7a0930", "comment": "Malware payload (AgentTesla)", "value": "3d24e5353d51610c889711af34d19846ae7b2a93", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648907677, "uuid": "8ac74f23-1982-44f7-b56f-4c7e1ccbeca3", "comment": "Malware payload (AgentTesla)", "value": "84152410773087d94251efcb970c3c2aec15dbc9179dc8e718247bf9f95aca86544a781d99864662c45a970e85a48717", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648907677, "uuid": "150f6af6-422a-4ff1-a91a-2a5ea0caf18d", "value": "T191B46BAEF2F076DFC85BC07689580C69BE9078A7630B8503E51715AADA0D9D7CF143A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648907677, "uuid": "b6a92c61-8b6f-48c2-977c-cedb990fab14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648907677, "uuid": "90424922-4f60-4197-8c2d-61713a287378", "value": "12288:nIT/gkNjB+bRKWXIH3lqHWnPfaPZ6Uh5cH9AF9PjsfJxVwY72OS:o/7LWKW4H3lNnyRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648907677, "uuid": "4cd7c74d-6b95-48cb-8d92-176d9dee799b", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648907677, "uuid": "28ef8b25-0a89-40af-b644-1124afa8944c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648907677, "uuid": "38245777-6b14-4758-bba4-0f964b0bff8a", "value": "TT copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187e58a0-b2be-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648929006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648929006, "uuid": "5517ae4f-dac8-4bbb-9f4a-104ce4c8c328", "comment": "Malware payload (Mirai)", "value": "ccf7b3a36738e300942ad7fded335fe2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648929006, "uuid": "6b348c72-f1bc-4e9f-8ffa-b69abde9cef0", "comment": "Malware payload (Mirai)", "value": "16b77cd351ee4c809052d96989ae33ddd23821bb89b6507e7a5f4e18a6fc6aa4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648929006, "uuid": "9d60d66f-5d82-44d9-a550-92de153083d7", "comment": "Malware payload (Mirai)", "value": "7c66312cb3cbaf48b7790906eaf264c9397ef09f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648929006, "uuid": "e0addb95-3f12-4518-89a8-dffba32b798d", "comment": "Malware payload (Mirai)", "value": "b482000915006f0dad8f203af97782e80abaeb6fd079f51bcbd37a5b28f570948d1f3f117d526aef433006f8592524ef", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648929006, "uuid": "a6512539-e53d-470f-ad9e-174299fa1e7d", "value": "T1706319827C80AA26C7D0177BFA5F108E3315A7D8E1DA73478C142F9576CA81F0D6B79A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648929006, "uuid": "a5964080-804b-4e5d-b8a6-149b2f19f788", "value": "1536:at/LYbUxYVUUO03k704oVLMNKHwbKnJeZWovjHJkKCM:at/LY0bKJwpvj3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648929006, "uuid": "ee2854c0-8110-4860-bd59-fa459c79f843", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648929006, "uuid": "25e03626-6a6b-4f65-8f31-6c55ef8e84e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648929006, "uuid": "00b10063-014d-476a-9621-a0ceed7bfe0a", "value": "pandora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99101dc6-b282-11ec-8e58-42010a9c0032", "comment": "Malware payload (Joker)", "timestamp": 1648903452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648903452, "uuid": "97dbaefd-705d-4116-b108-32bc2d02fbda", "comment": "Malware payload (Joker)", "value": "baca543afb538a75f509256c01334cb8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648903452, "uuid": "2b419117-9d71-4a95-8d47-9a078bb58f2b", "comment": "Malware payload (Joker)", "value": "186488a8beaca76c5a8514c704275e77ae2dbd84b32767586420de2878671810", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648903452, "uuid": "07ce24a4-8dbd-4d7a-8300-5316212924af", "comment": "Malware payload (Joker)", "value": "51c844d97d83409f97e4fe13f4c6e938bde34a04", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648903452, "uuid": "90a02946-6e0c-488e-9dbd-ff7ee7a9c3cd", "comment": "Malware payload (Joker)", "value": "80000fa1cff9a79bd0945432ef2b8c8f0a3c3869411927d222109761c09a425afbc3ec844182b0cabaa036d1abb2654e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648903452, "uuid": "eefcc38c-41bd-4742-92c4-902e49432413", "value": "T1B1072251E7154D73D4E5243608BD921202125F838A453E05778FB31C6FBFAAE22BEB9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648903452, "uuid": "bf20e9b4-db28-435c-9696-411f142f744f", "value": "393216:zukpA99EiIdV6rBFg1OpWEu6lxwYwUkSBoD1M5K5QXWl6Yef4sErX7SnXY7HCQgQ:zty99sUzg1z56lo4w1M5K5QTjf4sErXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648903452, "uuid": "ebd2cbd9-dd55-4524-b074-604002807778", "value": 17186874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648903452, "uuid": "2408686a-e122-469b-881e-29646f18a711", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648903452, "uuid": "95575090-134b-4019-8d25-fdcbcdcdc52d", "value": "Art Collage Maker.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f85aea4-b28a-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648906845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906845, "uuid": "cb22a5ab-444b-4612-8c2d-aa7550149d15", "comment": "Malware payload (NanoCore)", "value": "9063163465856f7244f99e636bfd2b74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906845, "uuid": "4c92f45e-6a65-4d83-b304-dd104517c5cd", "comment": "Malware payload (NanoCore)", "value": "1bc8d97f5be4fd72080fbec129ecb6ab776fd894993a7ffb7ab84ceaf26e2099", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906845, "uuid": "31b9b5ac-49d4-453a-9bfe-88481c6289ce", "comment": "Malware payload (NanoCore)", "value": "632f43f06cd2c9783cfa4f5b21b6766f05d04c6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906845, "uuid": "d27b922c-c4e0-45cc-8740-ac69b7759428", "comment": "Malware payload (NanoCore)", "value": "02b8a4277109bc3be6d868888ae045f72a9da7bdf5ff082dc3a672667559a38d5187cba2bc4524525e5879ae8ebd63de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906845, "uuid": "cc8c279f-b8cc-424d-b5fd-8839c243a743", "value": "T1B9F4E0983260B6DFC867C8B28EA81C64AA117D7B531BD103A45335AC9A3DAD7CF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906845, "uuid": "f4c889b4-0aea-451a-976f-d0f5dc660283", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906845, "uuid": "a7d63707-1ab5-4cb4-8def-f66226e3f3ca", "value": "12288:U+0jO/P3F7bvTBtPKp8R8IR5vnBb7X1zwBut2AkNYI1o6LR8DzveM8r9w/6FhFMo:X0jO17JtPKp8R8w5vBPlzwBsCo6LuPW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648906845, "uuid": "02464265-23e5-4ae2-9ab1-0e8ae5c512bb", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648906845, "uuid": "5112fdb3-324b-441b-9ff0-3834c9754307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906845, "uuid": "c6d5ce54-c3d2-40d7-9e7d-210daad68b91", "value": "Rpt47488747 & Invoice shipping doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c67349f-b278-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648899028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648899028, "uuid": "a29aa014-2e0b-45db-938b-21afeefa66dd", "comment": "Malware payload (AgentTesla)", "value": "81aeadd83b19b9925711d36d9f7fd7e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648899028, "uuid": "95a5f4a6-0e30-404c-a773-3f27a82ee8a4", "comment": "Malware payload (AgentTesla)", "value": "1c48e3d776a68f1e14066b903e150e9dcb7ac4cd782dc9fe0aba267dc94ba5fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648899028, "uuid": "6b049f63-b42b-4df7-96c7-2617dba2a5f2", "comment": "Malware payload (AgentTesla)", "value": "99b55377c68ba329d5ccfa33be387b10798de1e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648899028, "uuid": "b764eb2a-ac95-4aba-9b1d-32150c4ebf22", "comment": "Malware payload (AgentTesla)", "value": "1224183b5ae800677e282a73165244040251f5b26ceae94323d8b9ce5f8c6725c29fd7803dafbdcaa0104657c6f93aef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648899028, "uuid": "6566ea2a-5568-43dd-b2b8-28c081444b70", "value": "T1FEA4D1BAD3F9EF2FE5DE42790420912A3FF0E493BA24D548FF4A01B69A67B950050753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648899028, "uuid": "a0089cd6-6fa3-4835-956e-08e43caa428d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648899028, "uuid": "116a3173-487a-43f6-94c0-594208bad4c9", "value": "6144:HwvvqsNoIQYVOgs1aW9L/qJlXEOERh1/Zzb2WwnreX0MT2RkvAVK9vPgmmuOMWjc:HwvSSCbTElB6/Zf2Ww2T2RDK9vPgX5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648899028, "uuid": "1aa1931f-fff8-4a09-87ad-2c8a586d9053", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648899028, "uuid": "c394bed5-3a76-4289-b92f-ed12bbdab628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648899028, "uuid": "fe85ea3a-2480-40fe-9f38-e4b1b1a916c4", "value": "SecuriteInfo.com.Trojan.MulDrop19.65072.7052.21033", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70239d24-b23b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648872889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872889, "uuid": "1684bc8e-01f5-45fd-ace8-26d4cbf26c2e", "comment": "Malware payload (Mirai)", "value": "2fe33f2c946cc966c0ac17844d508005", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872889, "uuid": "961347ff-2083-40a5-bdbd-d37becb9f560", "comment": "Malware payload (Mirai)", "value": "1c71cdd2ea0cc47d048b378870b926bdbbe543826d540e054c9948be87ceedf0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872889, "uuid": "b4f66b2d-08ea-4468-bc67-f91c0e372756", "comment": "Malware payload (Mirai)", "value": "112f6ff020253eca2332ced3e15ec27556a8a5f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872889, "uuid": "5e07da0e-3a14-41da-b19a-7abb919d09db", "comment": "Malware payload (Mirai)", "value": "56173ab359e7afb6ea609990a47ac79a8aad22609d92effdff9cb549933959100ec3a9fa00c08cc9d8c07ea128dd133e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872889, "uuid": "576cd547-dee7-49a0-b48e-48d21540dcf7", "value": "T121530856BCD14A2AC5D4237AFA6E519D335173E8C2EF3217CC200B157BCA91E0E77A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872889, "uuid": "0684e8db-fb74-4890-bb7a-140168e13067", "value": "1536:3xhCeKEOH4c66wZdpp+UcT4eFmWXkDUC8cvNAJJeA/m:3xhCeDOW5+7UegzQCpFWJF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648872889, "uuid": "c61ec432-e91a-45af-b668-402bdf8ceaa6", "value": 63096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648872889, "uuid": "581c5da1-0cba-4a27-a914-a8300b25a76f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872889, "uuid": "961b23e4-7a98-4b46-9eef-a708dd5b0b13", "value": "2fe33f2c946cc966c0ac17844d508005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1292f9-b26d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648894411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648894411, "uuid": "f2366978-d804-4655-b730-9561d04f360a", "comment": "Malware payload (Mirai)", "value": "8e5aeb18bd2d4dde07c71fe1d07378fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648894411, "uuid": "51603bc6-9e20-4c84-8e5c-73a4eea1d03d", "comment": "Malware payload (Mirai)", "value": "1d31177d3ac24cb162bd67d5a57c94e812b4a417be742d5df896c0f6bc4fc1ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648894411, "uuid": "d7136763-3917-4a2c-94ca-9f922490f66d", "comment": "Malware payload (Mirai)", "value": "084dad2fc31a8b4723dbf42cedba541828e8463e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648894411, "uuid": "6c2a8f65-4d87-41f0-a6fa-d643770df88e", "comment": "Malware payload (Mirai)", "value": "18512a38df2d226f1c4e783b882904d170d4c8eac2d1641c8a492f4b35cc71dbdce874ca1278580d9bae3f47cd881cb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648894411, "uuid": "c215737a-cbd3-4a8c-a450-929d269a4bcd", "value": "T14C538DA5C0789D84D61442787E248D3CA323E90596673DF6D34A877AD00B9ECF99E7F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648894411, "uuid": "8593d175-abb8-4ade-85d9-392e26bf3ffd", "value": "1536:Eavu/aZFq6YLVB5ZqVbVcy4vFLyzh1lK2CQr:EkuSODB5Ry4vFG1lK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648894411, "uuid": "c5da1377-01c1-4906-a892-bd9ffeeb9c0c", "value": 62456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648894411, "uuid": "d4c3bf35-addd-40fe-bc45-5781f71de5a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648894411, "uuid": "62d2432e-1a90-41df-a052-e0c7c0f6c4ce", "value": "8e5aeb18bd2d4dde07c71fe1d07378fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc38d590-b2b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648925872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925872, "uuid": "4cfb7636-3b09-493e-96dd-df7a91a0bab3", "comment": "Malware payload (Mirai)", "value": "ec12c61943634b2e4bc7f73a2e2226eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925872, "uuid": "c259a94b-6307-457d-a489-d9b832e5fcf8", "comment": "Malware payload (Mirai)", "value": "1ead68da67643744afa45d276b29ff8b77e12f463646176ceb8d0f4f57c83977", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925872, "uuid": "391a5270-5af6-4214-ad8c-ad9af0798983", "comment": "Malware payload (Mirai)", "value": "950f31eb5faf1222b5191510aeb5556ac0fde84e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925872, "uuid": "648c8ccc-f7d9-4de9-9c58-4037aad7933b", "comment": "Malware payload (Mirai)", "value": "ed092fe493ce6116b9e449f2cccbe41a95e98cb2de168deab6bc8eb70f77b39a38392ef2abcb650ed0843cb4694c95da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925872, "uuid": "1a49fb91-717f-4861-90a6-33162381330c", "value": "T1A1F34C46FA408A13C4D61776BBAF414A33229795D3EB73068D286FF43F87A9E0E17905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925872, "uuid": "1ecdaa81-f4f1-4120-a72b-d8cc91332932", "value": "3072:yx7njSZ4rSGjqhMSk/yE/iVUkFTswvtqw/0M/9xFsgsG2:yxKZ4Vphh/iVUk5sgqwsM/9xFRsG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648925872, "uuid": "2ca8c7a1-5cd4-4e1e-8976-ab0bd4417d1e", "value": 160723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648925872, "uuid": "ac96a8c5-c8e1-4ecb-b37b-57b54288af17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925872, "uuid": "e921daeb-b6a2-4dfd-8a1d-8889b2f6add1", "value": "ec12c61943634b2e4bc7f73a2e2226eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6011aaa8-b2b9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648926979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648926979, "uuid": "cbb2b2b1-d884-4d92-b5af-d4f45f0987b9", "comment": "Malware payload", "value": "dde77778849d50301cc8cbcb77f05ddc", "object_relation": "md5", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648926979, "uuid": "61405847-fa8e-4a0c-89b0-263c67806046", "comment": "Malware payload", "value": "21c96fa65e11bdc1823f189c0a9a3901cc232f2a53f1b5cff3fe9d9efa94788f", "object_relation": "sha256", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648926979, "uuid": "a6a78445-2707-45ec-a05f-229433070a8d", "comment": "Malware payload", "value": "3130248defc032a4ab3b294cde0b87bdb1400ba4", "object_relation": "sha1", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648926979, "uuid": "dce74aba-e9a1-4301-a883-e5ac5273959e", "comment": "Malware payload", "value": "7fedf935e681345a8dc07f245e4549f8b225752abe1d09414f5f2ac4334d25dee03b9125cb306b02b877103669953f6a", "object_relation": "sha3-384", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648926979, "uuid": "4e3a9ce4-df35-4743-9dfc-374dcb1f3738", "value": "T1815633A9CBE0644CAFACD6F54C66FC8DD87BAFC87C4A74B8D740C54A9E2483E548C161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648926979, "uuid": "0b314c3d-1852-4105-a908-c1118b9aa1b8", "value": "98304:mOvTnhwJ3727ds4rw2Ca4aX4+Hm2khkhR6uHgZAnrG59vB58pS0WI6X8wPW2Kei9:m0SJqa4rb4aI+GxkhR+eMvYpS0v6X3Wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648926979, "uuid": "a1b9b656-c262-40e3-86f5-be715eaf269b", "value": 6166191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648926979, "uuid": "5f1d28fd-a981-49bc-8b99-2b577da05a3d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648926979, "uuid": "684c7e76-5ab8-4310-94de-833dd36dffbe", "value": "Printable-Lease-Purchase-Agreement.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b4b38a-b288-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648905773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905773, "uuid": "181c8a35-1c61-438d-aa8b-cbacbed16488", "comment": "Malware payload (RedLineStealer)", "value": "47e91b099bafebb6f2c1c7fcc1f2654c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905773, "uuid": "902671a3-097f-499f-9d26-d715190f406e", "comment": "Malware payload (RedLineStealer)", "value": "221670aba5f859e26d7f10114ae63c7a109a13ddc261ef7e791940964396b7c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905773, "uuid": "26635ae3-ee7c-4a69-840b-5e81445ea0c3", "comment": "Malware payload (RedLineStealer)", "value": "528dcdaa81530db07c32b16e55c55217e9179815", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905773, "uuid": "13b213cb-66b8-44cb-adab-462e20a749cf", "comment": "Malware payload (RedLineStealer)", "value": "6de18a5708a0c223b0c3f8b422815fd7c609ca5c605375086d7b3f5c2cbfc8d2583b3606808c0819d4f287056c163dee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905773, "uuid": "b24b2c33-96db-4838-bd52-0e1e802488eb", "value": "T15494E0F1779C8875F043393094628AA45B29AC22E4B4450737742A1E2E77FDCAAFD39D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905773, "uuid": "8d341b5d-2626-4559-9458-52b4c9c13774", "value": "1fb27c5c1f0c51182d431447d260c7bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905773, "uuid": "14d1ce74-7623-405c-b325-a658c6c142f2", "value": "12288:L/wc04VqLPoVJCl9o7gb4a9cdunnwQ7Hf:TW4ELAin9Bwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648905773, "uuid": "6f04cf00-9c31-4524-bef5-0dd26257485c", "value": 445440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648905773, "uuid": "82179279-f091-48cb-b5b9-0b698db35975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905773, "uuid": "24b576f5-d66c-4042-b436-4b228d60eeaf", "value": "47e91b099bafebb6f2c1c7fcc1f2654c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c72287-b2be-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648929003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648929003, "uuid": "c42a0853-ab7f-495b-9211-c190f75be8d3", "comment": "Malware payload (Mirai)", "value": "3c86d28fabf0ab8d7b7395bf9d34a132", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648929003, "uuid": "22283dc5-dada-410b-94d9-870bc8516b85", "comment": "Malware payload (Mirai)", "value": "247f99aafc854b7082b54b13aee91e0ebedbb1c46c1252ec5f4f400789d3046e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648929003, "uuid": "759e9d12-0117-482b-a409-fbc412380aa8", "comment": "Malware payload (Mirai)", "value": "efa9e0ad1995583bdcd1e7fe4c321cb7987f2c4e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648929003, "uuid": "fb4ecafd-4c55-4155-959c-7171449ba1b1", "comment": "Malware payload (Mirai)", "value": "dbc3988f9736cfde1bb4bf27522085e888ab064a9c0dd12b7bddbe01e3053cacad9ed2de80952deecf000e8690aaf394", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648929003, "uuid": "8959af4d-4675-4515-916b-ccf79b4a82e0", "value": "T1EB532AC8A0D3E8F5EC14097D307AAB629E73F13FB176E99BC7E85573A901202D10666D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648929003, "uuid": "c9547faf-33cc-4df1-ba65-b31169b7027a", "value": "1536:i5BpWlXJcf4slZQLkAl+tJSWE/4FZh+70EngkMge:iAXJcf4slZQLkAl+tJSWE/4FX00OdMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648929003, "uuid": "8248f734-98c5-4d39-bf32-285a026fd044", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648929003, "uuid": "4164baf4-7ee6-4813-9c8e-2bf9eb6ea001", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648929003, "uuid": "001fd6e7-6923-4442-849e-2c6a74abf15a", "value": "pandora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2f0306-b292-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648910145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648910145, "uuid": "63c0ef5c-d0c1-4eb8-88fe-9dddf740bc8f", "comment": "Malware payload (AgentTesla)", "value": "fa6004d07dd627dcb095f1a3a999f2ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648910145, "uuid": "0cf47df2-fd75-4717-92f5-9f95b3f694cc", "comment": "Malware payload (AgentTesla)", "value": "26c449f9f52c8a1d03afa1adfd8a9ca79d4199a5f31afc55207e3f631f198339", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648910145, "uuid": "fadb51f5-bb4e-474e-9d57-fddc1a24acba", "comment": "Malware payload (AgentTesla)", "value": "bb240f5400d4c707c618e4f2f45fb3b15f4781b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648910145, "uuid": "c333dd84-6da5-4537-97a1-c77603b9a41b", "comment": "Malware payload (AgentTesla)", "value": "92840621edbba4f83e32fcd11e1c620b6372b3d12f5eb6c2c185bb9105c83122de2a47f7c747248c77bfa234e17d5725", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648910145, "uuid": "0c70d24c-cf25-41e0-9c11-6fdf593e19a3", "value": "T143E4234A2BF8417FF9FA1DB5483A98540773BC9B687C64AE0F41A19680B9723D067733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648910145, "uuid": "b7e5d038-d1c0-4958-a3fb-d935d74de57d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648910145, "uuid": "5ac337d5-77d7-492c-ba61-74b7f1b3aac8", "value": "12288:11LniSuUTh238ZH64BzreMa+FrlF1lV1Sv/l+svPu0:rLtl2sZaYWMtZdK9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648910145, "uuid": "af1d0c4e-0e39-443a-b9b3-d3c38283eb6b", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648910145, "uuid": "cc5b39ac-06eb-4515-b2fa-0bd9809ecf49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648910145, "uuid": "c7153e7d-825f-406b-94f6-dc54815d19e9", "value": "Payment_Advice.HSBC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c67d95-b238-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648871741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871741, "uuid": "2249dcdb-4621-4378-94c8-141703f3ab4e", "comment": "Malware payload (Mirai)", "value": "fe66c0544799cb23f8531ab115f46e0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871741, "uuid": "4c6942d5-9ce0-4390-83df-470768cfd576", "comment": "Malware payload (Mirai)", "value": "27fbd353f1e255fed71b40dc3a40ebef82aa86bdd2ada39f5eb362770b2c33fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871741, "uuid": "d1f7f94e-59e7-4dde-b6af-b4d62baf0f7c", "comment": "Malware payload (Mirai)", "value": "567c16f97c6c3823bc076be6f32a6433932019e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871741, "uuid": "c7564cd6-501c-423f-942f-de710090ee07", "comment": "Malware payload (Mirai)", "value": "df8677f4a4294531d46607aa415b5023227ad637cb43600628071ea0543ec2cb8b1680a75c5fc3f7181a1da5b68e53e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871741, "uuid": "6c22b04a-c45c-4768-a565-9de6a14d9059", "value": "T14E831946BC818A11C5D523BAFA2E118D331367A8E2DFB2279D105F2077CB92F0E77596", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871741, "uuid": "bf624fb3-7327-4ecc-93bf-9f98435590ab", "value": "1536:8YnncoK7C5a7hg2Dg2vZwMH/gZLbbtLQRIo+0W+GghibeyjcEI/ii6RbVf8:3coKENkgYZffctLQCWCgAby6RbVf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648871741, "uuid": "4f0645ba-cdc4-4f45-a0e2-afa348a71d91", "value": 83376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648871741, "uuid": "45974a00-7d83-4377-b7a7-2470f0ab684f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871741, "uuid": "62ec0826-b729-4c78-8fce-c83d0b54a8af", "value": "fe66c0544799cb23f8531ab115f46e0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3060b8d8-b241-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648875359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648875359, "uuid": "dcd0b097-0260-4526-9819-dec2bf903c2c", "comment": "Malware payload (Mirai)", "value": "2527469c994605f8c35f78ed8e46401f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648875359, "uuid": "85c40125-1b5e-4efa-856d-a1648458689c", "comment": "Malware payload (Mirai)", "value": "2a15adee2d65af46855c395c3519c1ba0715d572b84eb402f9af1bccf8fc6d77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648875359, "uuid": "0b5f5044-9276-4f1b-9f52-62f572b26a25", "comment": "Malware payload (Mirai)", "value": "57146792ebc52bf20b27d9f8706850b8700e764a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648875359, "uuid": "9a9dd4d5-9652-41b4-bc64-e0a2c932afb1", "comment": "Malware payload (Mirai)", "value": "fa12f954e64a635dda2c50cc0e669a623108c5af901ee624669681a594addf1db77d3a9932ede63b4ab2743c56c4ebc3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648875359, "uuid": "036f512b-09ef-42da-9a8c-e4e0657f3b18", "value": "T148730996B8818B01C5D512FAFA1E118E331357E8E3DF72139D205F247BCA92B0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648875359, "uuid": "e874c1c3-062d-40d3-9123-dcdb2f7908f7", "value": "1536:CNnAeH1Y6ZBqmdFcsc5h1QRB5Dm1JSPxjIhJce7IMiknbJow+ba54ZaF:qVY6zq2FRcX1QzNmTSPWxnbJow+ba9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648875359, "uuid": "e9375acf-e102-470e-85b1-af12c5021150", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648875359, "uuid": "2eb1ed63-9469-4a44-a73f-9d66702e55d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648875359, "uuid": "47c63aae-fb0c-486b-9118-1e066d29c555", "value": "2527469c994605f8c35f78ed8e46401f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5284d2-b28c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Joker)", "timestamp": 1648907892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648907892, "uuid": "931da54c-c8d1-44f9-9650-c86879d38011", "comment": "Malware payload (Joker)", "value": "70b05a813932eb97a0e4f5ba25b5d534", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648907892, "uuid": "1a76c4ca-6eda-49b7-a082-ff52a0ed1d75", "comment": "Malware payload (Joker)", "value": "2c27689d61bdd7fd493165550e23075712406340f7c42b82769028a433a0910e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648907892, "uuid": "d4add5dc-fd70-400a-8e04-ba12da85a2ca", "comment": "Malware payload (Joker)", "value": "cbe66ce43a9aece0c3f398870f03ec23b3e827a2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648907892, "uuid": "cc26a05c-2b2f-404c-99d8-1171b85a3b17", "comment": "Malware payload (Joker)", "value": "b8358a984c5571ea8feab012f02119d8259d41fbdab78d90df51af5b1274a57e1d3205dffd0b135653cd0c5f7eb7952c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648907892, "uuid": "20bd998c-150d-4b4b-9c72-0cd4c79494f2", "value": "T12E06F102FF98D41BC8F743378A7A663602469D6C5B47979329DCB23C18B7AD05AC6BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648907892, "uuid": "6f99d92d-4a37-4c0d-8dce-a9c0afe405a6", "value": "49152:UzX/4VkkrHWuPzmIuc+HrkOglNXnyJHWankqVhZl9W019ZuXLfKgFedKScRIBZhQ:lBLWo7Ark1X3y4qPXZu2gFeBZIjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648907892, "uuid": "ce8ad2e5-b03c-4e96-b427-b4ac8606e02c", "value": 3954398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648907892, "uuid": "a26b83ce-f98e-4977-9ac7-a3282e22d92c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648907892, "uuid": "8a4c853a-1e96-4d86-ab82-b0981aefba99", "value": "My HeartRate Pulse Monitor.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73b5db0-b287-11ec-8e58-42010a9c0032", "comment": "Malware payload (Socelars)", "timestamp": 1648905731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905731, "uuid": "accf7e89-2a43-4e66-9305-c3ce088b3ef6", "comment": "Malware payload (Socelars)", "value": "b8ca6060a187461bd3313cea23645c75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905731, "uuid": "1f163349-b718-471f-a1fc-f80658cfe2bc", "comment": "Malware payload (Socelars)", "value": "2c533a1fdc664305c2940a114358e587e721317ea092d3103e5df77b4239c67b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905731, "uuid": "301009a3-539e-4a2c-b98c-fd7863bfb40f", "comment": "Malware payload (Socelars)", "value": "688a375686d8e548c54c7ef2b36230190366b6d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905731, "uuid": "5debb754-acc6-4c11-9ac5-71a6294589b7", "comment": "Malware payload (Socelars)", "value": "4df464bec9afb2b8027587bc2b8dd3d7b5beea0315b61bfc7ac9addd465df14935a9a8cf41f8f20131afcf1df85b778f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905731, "uuid": "66477941-7bd7-494b-9aff-2f944a40f4e9", "value": "T118857C11E6429033E8D7037E82BF4ABA89686D21034750D7A3847DFA5A705E2F63E75F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905731, "uuid": "eb004040-b1b0-485a-a5d9-f04da4201814", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905731, "uuid": "566383b6-80fd-44c0-a41c-359a0b91d45b", "value": "24576:+KAgpBGV2HpWHuREjDnI2AuADZ8KvqC75H2dtDPc/EsKFhug:ogpG57R8InDPcssKbug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648905731, "uuid": "03939235-1972-4f0f-af24-67d91f1844dc", "value": 1792512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648905731, "uuid": "98d118b4-e33d-48d2-81a6-91f6bdb4d67d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905731, "uuid": "089d0342-6a03-4631-bd12-cba7a8abf325", "value": "b8ca6060a187461bd3313cea23645c75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff97d346-b230-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648868405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648868405, "uuid": "bf10ea98-3dce-43d4-8206-a16f90f5fcb7", "comment": "Malware payload (Mirai)", "value": "e5f4982af6419956b33d9896bbefd290", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648868405, "uuid": "79b8b9bc-e0c5-4230-9c9b-c1932dae81a6", "comment": "Malware payload (Mirai)", "value": "2e3ec2ebc785734518180b1f1106719f02505d2b91fc05cd4b312bd47cc44659", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648868405, "uuid": "6199ac52-77b7-4337-8946-377d429c61fd", "comment": "Malware payload (Mirai)", "value": "ae4a61123e2ffa02f9f9e3786f61ea4fb06dadc9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648868405, "uuid": "708bc0a3-6eaf-4fc3-9cf6-0c7cc92d90eb", "comment": "Malware payload (Mirai)", "value": "a28884aa1e94708d8ac38f7dc044e0b86089655a78ef8cd4abadfcafdc1e9f098e7ccc03c5be075f8550245cf3aaecd0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648868405, "uuid": "814c1652-7857-4cfb-9deb-02074be8e8b8", "value": "T1DCE34B46EA818F13C4D5277ABAEF42493322A754D3DB73068D189FB43F86B5E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648868405, "uuid": "35bc541a-27c3-48fa-b9c6-b985f88aec6e", "value": "3072:PObx1NCIkAMnuPF33RE7373yvROHAqZCCSrwjsM/9JVo6gNOwI:mbxXCIkFuPNq7r3yvROHXZOrwgM/9467", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648868405, "uuid": "b130862d-177d-404f-a740-0685d3be5da1", "value": 147761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648868405, "uuid": "16f15dd7-cc66-4769-adb1-fa587df928f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648868405, "uuid": "970756a9-4d76-4551-a095-f2d25f644a61", "value": "Cronarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d32b94a-b278-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648899030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648899030, "uuid": "2538df8a-0d99-4d2e-bda1-9956ac2feccc", "comment": "Malware payload (AgentTesla)", "value": "8a1681a77b33427230b5b376f3554503", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648899030, "uuid": "4ed23d6c-5c57-41b8-bd43-4051ea4ed74c", "comment": "Malware payload (AgentTesla)", "value": "2ea3b8730f515a3ad7432588784ce3b92b8012792fe121e52ee28ec32c64b0d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648899030, "uuid": "39dedfdd-415a-48f0-a058-c992f15deaf6", "comment": "Malware payload (AgentTesla)", "value": "c2ce376dc8e43f95a62ca23e8b51e5d4b5d50477", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648899030, "uuid": "6123a005-b15a-4cc8-aba7-cf9d8a26a5ab", "comment": "Malware payload (AgentTesla)", "value": "85a17bc44879c1aab3a8737ee840905c7130e99f0c9a0bd65c0586f4a3c31a7eb7bed1fe0be0fcd0cf272164a88cadaf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648899030, "uuid": "c2ff9b52-48ea-42d1-9d2b-168adcde11df", "value": "T132D4232575F653F8EBFB2F3A44F9651222A67C19BF32DB0D1F82A44648797E41820723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648899030, "uuid": "12b87c0b-d4ba-45e3-bc40-e64eb6674a9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648899030, "uuid": "0a10d8ef-78a6-4f1c-96d8-5c77300d47d7", "value": "12288:9SBmqqFVXW8dV7y2z9Qkkw7EgVqn64FanQJUM2TGYG+a3:Agqje7y49Qkkw7EN64FanQ2Gia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648899030, "uuid": "bb79eec0-613f-45f5-9209-d3b23e693687", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648899030, "uuid": "ce8767bb-1761-428c-aef8-fdbb880d9904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648899030, "uuid": "e4ab132e-373e-48fa-b057-0f9f06ade74b", "value": "SecuriteInfo.com.Variant.Barys.55758.2173.24117", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9507a33-b2b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648925867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925867, "uuid": "d199a9cc-364b-4192-a982-33f2b8eea79a", "comment": "Malware payload (Mirai)", "value": "3ced2f65ce204c8f578e3af802108e83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925867, "uuid": "9a7a8200-a813-4748-b3a2-bd7b411e3e23", "comment": "Malware payload (Mirai)", "value": "35658e576ce6436839e25a9c9312c50b673418c0337c1efc05f00363d7e0740b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925867, "uuid": "5fd8eb16-5356-45ef-910a-ee90fe3618e2", "comment": "Malware payload (Mirai)", "value": "60775920f96a7c0e723b5045732451d2ce51e174", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925867, "uuid": "2b75bce9-e7bd-4697-a49b-3e095c681952", "comment": "Malware payload (Mirai)", "value": "0dad485d17551032abf0de84f484ca24c8584f63b050873f5ca8323d573ba0f0e6ebbadbf018a8055782366956673372", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925867, "uuid": "5d530ef0-0377-45a2-a09d-11e46b7869dd", "value": "T1B0734C95F4019EBCF48F9AB983164E0AF821A3805B931F27B367FDA33D620959D47C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925867, "uuid": "f362e5b7-77e2-4cf1-8305-ddd1af5b1cf7", "value": "1536:l/orYZw57N1gKc+/yE8MKePE4gOXByZlD1+Lyd3P8mEMrx8yjfrIUkBNy:lDZwTc+JmUXeZ9J8mt7EUKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648925867, "uuid": "5af6a27c-7478-46aa-9f2b-49440fb81885", "value": 80092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648925867, "uuid": "e62d2b63-f236-4ead-95eb-b4b667c6f3ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925867, "uuid": "ea8c6011-4371-44a2-8b13-5c7d15cc9dcc", "value": "3ced2f65ce204c8f578e3af802108e83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5728bc4-b2b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648925941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925941, "uuid": "e646d9d3-eaa0-40e4-9a75-6ce2de02ff7e", "comment": "Malware payload (Mirai)", "value": "feb499f9d7a4df0f2db32260fa1cb537", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925941, "uuid": "41f87a7a-5b8c-4094-bbd3-60a19c846a43", "comment": "Malware payload (Mirai)", "value": "36240b323c9118da8153928dfe75ce47337a8bf427a29a2cbda17ae1a3627e0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925941, "uuid": "d5c28c39-6b06-4610-a427-d44a8687fe23", "comment": "Malware payload (Mirai)", "value": "1968d15ccd72726ecf64d2088b899a197bf90b25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925941, "uuid": "c9d78386-c131-41b5-b0fe-993577c36dd7", "comment": "Malware payload (Mirai)", "value": "8f549ef5d2ea4417a7e50f873ed22d349ed124dd25ace02c72824d55bfe40bc38734d705a6a4aa60ef3b0060d9988b2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925941, "uuid": "deb11750-984e-49a2-a917-cf6edbe9b9c6", "value": "T138735B01B7684A07F9A61AF9293F1FE497BEEDC021E4F185691ED71A4132E335806E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925941, "uuid": "de931cca-c3cf-4f1e-bc50-339021faba20", "value": "768:/U1kHLwV6pRyps+H1XEgeGvlh+RcLDjGPkbUqcHq+w7FbTCE32un0cL+Diu2Ryzh:ppz+H1XgieSjhpFbTTyOu2RyLKkP7As/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648925941, "uuid": "b47bb1c3-d75c-4973-a28e-707eb2af84c5", "value": 79268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648925941, "uuid": "85b8a0c7-0127-4292-9953-49ee3ed88f56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925941, "uuid": "213768e3-b9cf-4594-81af-97ed1e124bbf", "value": "feb499f9d7a4df0f2db32260fa1cb537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b6b166-b289-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648906444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906444, "uuid": "af58ee87-1900-468c-914f-93e237be0b64", "comment": "Malware payload", "value": "d3b98aefcce8f61489bc98cf84f5ebb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906444, "uuid": "1b036648-687c-4bcc-b49f-48640b7ad25b", "comment": "Malware payload", "value": "36ddba02c931e3dbf84ebad027e5f9c325ade8c23f05639e1d3bd99a2b29bbbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906444, "uuid": "c9dfa79c-6f56-4f66-9509-da3906bab421", "comment": "Malware payload", "value": "fa7a80ec6a3a816f236b33b3c3116a996760a80c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906444, "uuid": "7d31188e-8a48-4078-8ef3-c119e6bc530c", "comment": "Malware payload", "value": "b60045cc7f8353548f27c40eece916be32a57edf7abde696577605e316c4664f775bafeef205bd62fbed75f2c3d1d8a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906444, "uuid": "3875d210-30df-4d82-8960-ff00c0e6007c", "value": "T1F4C5121D232B8946F824EBF8DA7377510754EC729466A343A3992A2DD42F3FD2E81743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906444, "uuid": "ef3fa92e-04d6-4ef1-a8e9-8d246e861e25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906444, "uuid": "93c260ef-207d-41d0-b668-929a87614a7b", "value": "49152:MHEQRyINNiMzKMI7114yxHM7eNSMBvAWeLn/dc1tNBbU2O0A:MkQRLNkjxHMSNjvAW+/d+t8uA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648906444, "uuid": "084c79d6-ce5d-4c68-aff1-bbf0bbfe3322", "value": 2548104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648906444, "uuid": "dc268e75-c782-486a-8b75-68091a432658", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906444, "uuid": "328e5c83-1d59-4dea-8635-041a634b36e0", "value": "d3b98aefcce8f61489bc98cf84f5ebb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79635993-b28e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648908553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648908553, "uuid": "ee801381-3aad-46e1-9b08-341d5e336697", "comment": "Malware payload (AgentTesla)", "value": "d92712704f5f6ced52114c6ec81c8ae7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648908553, "uuid": "9abfd41a-22ca-4d18-8ea4-debe9f9efae3", "comment": "Malware payload (AgentTesla)", "value": "37a2642e9b9505b2d1193e0a19a677d8477131141516f9699163700be0b5dd97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648908553, "uuid": "defcdf74-0361-4e46-a228-c05b78bb2c7d", "comment": "Malware payload (AgentTesla)", "value": "18b27aeb6c2d337f610b10c4a9876c6418c14583", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648908553, "uuid": "3b6c1ea3-6010-479a-afb9-3bf4c0ecfb5e", "comment": "Malware payload (AgentTesla)", "value": "af63235cedda3fce0ce54e02139da78705c755ed343acef8a94b15918e29b7a28e46200fe5f088adeb5d2c1dcfc6970b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648908553, "uuid": "92355432-2b0d-4678-a447-2a977bf2b36d", "value": "T171C4BE77E3F8AF5BE1BD93F9A021100573F4D403F715EACABD9690EA0851B980262797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648908553, "uuid": "9758b641-1492-45ff-847e-6b02cda0a120", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648908553, "uuid": "468bbe45-844b-44b8-ae9e-d04766ebf49d", "value": "12288:pXapTzyCUjS++70NX2lQKEUhaXis8aeyfmYO97SBT8fTK4cuycY:pXapTzyChwUhjGe937ShYWuyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648908553, "uuid": "3074c87e-1e2d-4718-84da-8bca518114b7", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648908553, "uuid": "c1a83bd6-3ae4-400a-b329-08d2c6cb37ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648908553, "uuid": "7032a72e-d306-4026-a90f-60dd5b69b43b", "value": "UPDATED SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd1e573-b225-11ec-8e58-42010a9c0032", "comment": "Malware payload (ZeuS)", "timestamp": 1648863460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648863460, "uuid": "27f52206-5f17-4934-be97-f4971686999e", "comment": "Malware payload (ZeuS)", "value": "328f99aa9db2a9528ba5d78a68b03248", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648863460, "uuid": "c7aa2e35-3f03-4c6c-997c-0cdb6c7e9122", "comment": "Malware payload (ZeuS)", "value": "37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648863460, "uuid": "1288824a-1698-4055-be49-eb6f206bd5a4", "comment": "Malware payload (ZeuS)", "value": "2d1bfb930067fa3448c28ac5dc59dfd4e59914b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648863460, "uuid": "3a768341-c3fe-46d8-80e2-c6f7399c19e4", "comment": "Malware payload (ZeuS)", "value": "56187dc821ae95d33f4bc03570a82ee2c21ef5a3b4ec891b53484a443638ac87db0c7dd434bd2ec129650a643abbf13b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648863460, "uuid": "b7ce6fbc-44e7-4d3b-86d8-4936a095b138", "value": "T1B26533C4ADD34ED9F46A31BA8453A1243F881BAA591C8802DE3749F76C9D5E7D0B602F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648863460, "uuid": "f4a54f84-6ca1-43ee-92d0-a3ccec39de64", "value": "aa1ca832e28e2c6a63685365c58b52b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648863460, "uuid": "8afc0954-13be-4216-a8fb-138277543a29", "value": "24576:eXE3nnO6SSJn93S8l8sFR6443f1+9TvYBp94ttGXanc1zEkwtkNcc:euO893S8l8s6lNYTG94t8XacKxNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648863460, "uuid": "af657aae-0150-43e7-9555-e7f87c37fbda", "value": 1478544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648863460, "uuid": "612810ac-64cf-42da-839c-ab764608a48e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648863460, "uuid": "07da9103-4a01-4522-88d4-9ae4898dcb45", "value": "37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac40cd7-b2aa-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648920527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648920527, "uuid": "72761714-000e-452c-91f7-6ef90b72599c", "comment": "Malware payload", "value": "e1031b60660c6656c761329f69c8c99a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648920527, "uuid": "d41534fa-d761-4899-95bf-67062c9e69a6", "comment": "Malware payload", "value": "38ae6a798c263f80d2c6144e7b03c2c25865d03162f867eb7a5a3e88474a9145", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648920527, "uuid": "5bba374e-efe8-4876-ae9c-108f33eb9152", "comment": "Malware payload", "value": "bae0aa67995c653e58e345ed41378f9ee8cf7677", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648920527, "uuid": "1ff20730-e1b1-47f0-ae2d-fc9ca64be0a7", "comment": "Malware payload", "value": "f952af54514e4378c2974b9b522c161a602459ca31f0d4ca891232bf35c90845bb389c38d49995fab1aa3e8a3d9ee018", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648920527, "uuid": "cccdaf7f-e8df-4dd1-9b9b-ae36a64f4609", "value": "T172852322E14FED38D21861755D23F9F14204EC198A991B0EE8883DA6CE7E1687D947FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648920527, "uuid": "4688de0d-ad06-493a-83e6-6fd62632c219", "value": "c43c022463b8653fee820534333be723", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648920527, "uuid": "96aa589e-88cc-400a-9900-1483b9932531", "value": "49152:0g6veCzhSr6355LaSUEfy5CZ/B9Z+nvKlFm62Q:ktkYnLazEK0lB9Zl/2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648920527, "uuid": "f8bca318-56d6-4517-825c-d98e38153277", "value": 1764336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648920527, "uuid": "19cb0e0c-91c8-48b2-a5c4-09f622acf8f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648920527, "uuid": "5b45b4e3-3f89-498d-b2d6-538991f1c4d2", "value": "e1031b60660c6656c761329f69c8c99a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c540403e-b26f-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1648895366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648895366, "uuid": "dc358244-d3bb-49e1-bb52-2bf0c2a01ca9", "comment": "Malware payload (GuLoader)", "value": "1435368f709805f33eb95ecfd19b8c09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648895366, "uuid": "371f9f19-0f34-4d35-a899-7e3090262653", "comment": "Malware payload (GuLoader)", "value": "3b71cc76f43648f26823ecf65fc133a9da6f03fb55f6f9ca0627824ee8862c6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648895366, "uuid": "9ad1d6c0-a5bc-452a-a760-a234d9139679", "comment": "Malware payload (GuLoader)", "value": "b233b9dea1f38aef047c49647dffc3b2f4bd92fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648895366, "uuid": "bd9cd8dd-4f11-4242-9a82-6ac35c94b1a7", "comment": "Malware payload (GuLoader)", "value": "d998ff5e56670df85294925053398586d9f897f330f5a890fd30e807a45b02862d3a27826ad6b747a1e614867215cd1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648895366, "uuid": "96aedb02-3dd5-4556-8c7c-c3d6b8816d23", "value": "T118C492C3E28041D9EC692B77D077FC3B156BBEBD6AB0648D965DB1725FB3282001AD06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648895366, "uuid": "70a51657-a6bd-471c-817f-b793542bc96c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648895366, "uuid": "ad484147-2710-4968-aa8d-685c0393523f", "value": "6144:qYa64Bnu9T4kuBzmHnq8MyyqfMYY5zZo:qYWBkT4aHnq8MvVJ5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648895366, "uuid": "b03972a7-eb85-44bf-966f-29b3a772fcc5", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648895366, "uuid": "0ae26f53-9d67-4e84-b2a7-bb2f52351957", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648895366, "uuid": "d659b18b-06d5-4b1d-a1b3-dddcd7bb84bd", "value": "SecuriteInfo.com.Trojan.Siggen17.32175.20640.31133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a78a87c-b278-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648899025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648899025, "uuid": "6c8204f5-7f69-45ad-b421-c0af8d07cdbf", "comment": "Malware payload (AgentTesla)", "value": "02a3795a38d0281ff5cfa17bc3c9bc7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648899025, "uuid": "dd7f16ac-01d4-43f6-abe3-bcf126b615c4", "comment": "Malware payload (AgentTesla)", "value": "3d3812027a1dfbebfb22a52b0b671d4237f38c44c3a40936dc63d4b6896ec5e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648899025, "uuid": "451c7823-7fd7-4c39-8c17-50ead1304f72", "comment": "Malware payload (AgentTesla)", "value": "4d8fc6ac168c238bb518fc0a1329ef6a99ef3e41", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648899025, "uuid": "a6a55c19-56f5-4016-9b3b-645c9791b3de", "comment": "Malware payload (AgentTesla)", "value": "f2a736ceefa671b481c64dbacef14da72651e66c02016932967a709b0ad6eb1455d4dc0a4ab104afdd7e3f893bfbc453", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648899025, "uuid": "8ed977cb-7707-45ab-8060-748a1c0bd22f", "value": "T1EE23D3A20244EC8EEC1306338576921F52955D058B7F9ADF3C7FB6D6CA3C2B3271A619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648899025, "uuid": "97d53ecc-761e-4249-98ec-fe434d8e4d20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648899025, "uuid": "f179ef44-230c-45d5-a45f-847ea85d6fc4", "value": "768:4bG+faC7I0XwoVaO+BKyb90ZcPzmnqp8yj541Ni7mSpt0r4:4bXfauLXYOmahS8O5aNi7mSpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648899025, "uuid": "b3d1650c-7feb-46b0-a43c-73644b151f84", "value": 49664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648899025, "uuid": "23805efb-817d-4841-8738-466d5e2028ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648899025, "uuid": "a35b670f-2f79-40ad-9f12-f210b94f1978", "value": "SecuriteInfo.com.Trojan.GenericKD.48787284.27794.22404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73f41b3-b238-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648871774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871774, "uuid": "27313583-2de8-4038-bfb0-158bd7d0913b", "comment": "Malware payload (Mirai)", "value": "33f36bd3854fae1ff28d7645641b2eed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871774, "uuid": "364f3e73-42d3-4bb5-b524-24d7a7cca0ec", "comment": "Malware payload (Mirai)", "value": "3e01f14b6ca0bd684f27cfc8c3703d840cdf69bead1825cb6ffd12fb385a0954", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871774, "uuid": "aa560e65-c293-437b-8480-6c74dfbbaf18", "comment": "Malware payload (Mirai)", "value": "82dca280ca2fd4974edd0cd47668968a964783c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871774, "uuid": "61a36cdf-69ca-4c10-84a5-b9c65008babd", "comment": "Malware payload (Mirai)", "value": "244b271b37f21b8895ccdf466e72d4419438bdae208b062599bfeb84804be510cb2c39b3878cd1942c4924c3ea8e84b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871774, "uuid": "91212a5f-e8d0-4628-a3bf-f0f75015727a", "value": "T14493C61D6E319F7CFBAD823487B78E21964833DA26E1C584E15CEA011E7034E746FB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871774, "uuid": "7f26467c-4395-4872-82e8-fbdaa6fadb9d", "value": "1536:oWTMvzK1QN7o/OS0O1B7TiI8LqbYI5RBK7YU9tAayR9u4xMYdXLYRRrqdhdOi++w:7MG6N02zEHx8QgYdXLYRRrUhdOz+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648871774, "uuid": "13c8e5f0-5f8e-4ded-b94e-ec7878378477", "value": 93304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648871774, "uuid": "31849503-6abc-49b9-8205-8a4f57ef55e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871774, "uuid": "aa15989b-4f57-4bf4-a832-26ff6f3683f9", "value": "33f36bd3854fae1ff28d7645641b2eed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afcec36a-b2df-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648943433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943433, "uuid": "7f889d74-3c81-4dbf-96f0-8fec9225286f", "comment": "Malware payload (Mirai)", "value": "bb6d16d7776f3e35e5dd8d00d4b2ea44", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943433, "uuid": "6c914eea-df4c-4e80-9c65-c2536039257a", "comment": "Malware payload (Mirai)", "value": "43adbe79055bebba7a2abf398a51ececcad3a8de6ed6327433074b5e61b66957", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943433, "uuid": "3d18ffc5-57a5-4186-b377-9a6b82cd6cef", "comment": "Malware payload (Mirai)", "value": "56027f27d2b78489826675e47543fc1381ef0e3e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943433, "uuid": "01aa378a-4f56-4281-9a55-3c8fd9fed180", "comment": "Malware payload (Mirai)", "value": "a1feb4517bdc7017ec38b5b310df31d622584dd31fcbb445f69b04bbab0dafb04e93b61af23d6ca3a930b1b9e4474fd4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943433, "uuid": "3e91c549-8d8c-467e-b4ac-e1d1adaf5bc9", "value": "T152535BC1A193EAF5DC110638307BAF724E77E53F60A1DED7E3A969339A01602A21735D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943433, "uuid": "b1c67383-7d00-4f97-8b10-6d73c688dc69", "value": "1536:qPDnpPeNLRfW9NLZAoS1OCLk5qYT9HiV4:WVP4LR8pWoS1hL2H5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648943433, "uuid": "1b19e831-c5f9-4131-ac9f-c20f6de866fe", "value": 66544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648943433, "uuid": "dae11ad8-1744-407c-9c15-f05475f5d5f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943433, "uuid": "152498dd-aa72-47fa-992d-18c4914db0b4", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de7577f-b23f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648874469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874469, "uuid": "76c61d7a-5b98-4c80-99b4-c1c52be5a348", "comment": "Malware payload (Mirai)", "value": "306d9b5a58eb466096f661dce7d67539", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874469, "uuid": "39d0d0ce-dc23-4dd8-9178-9cd18bf1f2e1", "comment": "Malware payload (Mirai)", "value": "457f4a0545263ae7cd9a76bbd288020bc98ed36803a5448fb1ce40228aea5bdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874469, "uuid": "cb5122f6-0c10-4bad-a5d6-5b05f4ae245f", "comment": "Malware payload (Mirai)", "value": "06bfd442c24af3afbfb074e5f4f0168d22bb2406", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874469, "uuid": "406d5b73-1295-489b-b653-224a1857c99a", "comment": "Malware payload (Mirai)", "value": "508b46c8ffe6f97ab9c773c1cf4414b290ac4c024e4d6c5db0effd1cc94bd09fdf8795d92708ed00defc6b4b02039d67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648874469, "uuid": "e27b4d5a-bce1-47d3-a4d5-4ad1a56a2165", "value": "T17F434BC0B5A7D9F5DC1202B0347BEF335B37E5FA2159E687DB98A4326C425039A07A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648874469, "uuid": "57396888-f53c-4676-b2fd-9c21b5fe494d", "value": "1536:TjkZoZPif+ODr/5K9IMG/Z5ZRDSTaJ+KsliM4/UndhaSITaS+++++++++++++++:KoZ4+ODr/4IdZfsTaJ+Ks54/gzq++++y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648874469, "uuid": "26917f2a-0dcf-4377-a73b-4cfeb23a9cef", "value": 58448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648874469, "uuid": "7617f287-61f9-4e6a-9f8b-aa6995dfcde1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648874469, "uuid": "32863e01-d2d3-443f-ac9e-06b84e8233c5", "value": "306d9b5a58eb466096f661dce7d67539", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f709f50d-b21e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648860660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648860660, "uuid": "785119cf-4357-45c4-b92a-1d1a2d202469", "comment": "Malware payload (Loki)", "value": "4006d0a0667cd9f17d04919ce27777eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648860660, "uuid": "e28c3c53-49ba-4c58-a254-a1a3891f77aa", "comment": "Malware payload (Loki)", "value": "4b2021e57cb58574757a0a49b69523d717401d1c7583482f819120941feeb8d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648860660, "uuid": "d2a90957-96aa-4c7e-8c6e-e9ffa451c7af", "comment": "Malware payload (Loki)", "value": "ed8745aeae32ade51f83f985318ef0a7d1a27103", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648860660, "uuid": "cff30ba5-ad85-451d-87a9-370c93022806", "comment": "Malware payload (Loki)", "value": "7a4fb15367e1d9fe8f1fd18a2701e64c279a573fe0992df40027d3ebc3ade27d93e382e7eddf38923f843fbde8918ef5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648860660, "uuid": "ee858d3d-4e48-4274-9526-bb44afccefea", "value": "T16C8458756CB28962F6F8D2713CE237651956BC3F2CE88B0ED21671E876371D1A07A231", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648860660, "uuid": "374553a9-6cd3-460e-afdd-360099dc21e2", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648860660, "uuid": "3245753f-0632-4c43-b89c-7a058fc73bff", "value": "6144:sNeZ6A+f7onOTOwfFGoh3yd+Ro3l1K7gh1E7r13:sNdAFnOTOwfw03yURo3l1K7SEfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648860660, "uuid": "4f31db9d-27cb-4860-a3e7-9b8981031602", "value": 402988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648860660, "uuid": "9148835b-a3a9-44ee-9181-d392a4559299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648860660, "uuid": "3e82048e-e482-47ef-a971-76f94a7960b1", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d920b336-b2b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648925893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925893, "uuid": "bf150e4c-f5ce-440a-bc01-b0fb0118ec82", "comment": "Malware payload (Mirai)", "value": "daf82a6e2e689de802463305addab89f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925893, "uuid": "8b446fb9-9aba-481e-82c0-c1d019dfb7b2", "comment": "Malware payload (Mirai)", "value": "4ede7cecf6673d582f8318f141f31b8427f7908b815884ddeec7e08f59d990fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925893, "uuid": "958219a6-675e-43d5-8b06-464c208af70c", "comment": "Malware payload (Mirai)", "value": "a7d73f533c00c34ffbabff3b79b02f0a4359bd67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925893, "uuid": "f8211014-8ec3-46a5-aff6-adff1deb8663", "comment": "Malware payload (Mirai)", "value": "8a68d5a8e0b2e3890e423b4ce687608da1e25325995abe3e9d297205e6bb4343fc86ededd2c781b1cfcc773905308ca7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925893, "uuid": "4c6939ba-c0ee-4ec7-b37f-2aee61107c30", "value": "T173739E75F1B8ADA4C0614634BAE8DE748B22D58067E33DF6E7418A6540039DCF50AFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925893, "uuid": "8d635edd-64ed-4c14-94e6-1c3d8104bb8b", "value": "1536:IaH7/fhHZlwtoGuCyqIe40OJt0rrnJ8R/R9dLVLDIC6h:IQ7HdvNC4/0rjuRDZDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648925893, "uuid": "67c1dc20-1dfb-47ab-9056-06d941d689da", "value": 76348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648925893, "uuid": "ce7ffcdb-e205-4129-8d91-cbcf0daebac1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925893, "uuid": "f4e98293-35ad-47ba-a3c9-ba5a6d76a7c1", "value": "daf82a6e2e689de802463305addab89f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92baf150-b29a-11ec-8e58-42010a9c0032", "comment": "Malware payload (N-W0rm)", "timestamp": 1648913749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648913749, "uuid": "af1ed9cb-b8ff-49d0-a818-0a80aeee9150", "comment": "Malware payload (N-W0rm)", "value": "0de9a559c2124a49b1d7ad3ae038cd3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648913749, "uuid": "138ab766-83a4-4ce3-9ce5-2dc44faf7268", "comment": "Malware payload (N-W0rm)", "value": "52d7f88f2af1afe7ca436c7553bc9f46d0b61d43a49458b1de79e66640a8b957", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648913749, "uuid": "3e2d046e-0d7f-47e3-a8e4-11028e89ed1e", "comment": "Malware payload (N-W0rm)", "value": "740982407013acd0a2bdd64b9045064f8dc431d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648913749, "uuid": "5ef47aad-158e-41de-bac1-ba16e26e867e", "comment": "Malware payload (N-W0rm)", "value": "7f67d449349e77f1f4a1a1ebacbb9c08ff0bb082d9bec52bbfb0904c875af7629c1c22e4e184d3df261980d600b7a25f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648913749, "uuid": "3f4e7f2b-e63b-4471-bdfa-222b9652d75f", "value": "T16A85D44E964204ABE9503970845E6B6909606FBD2E73D763FE14F907FA327C3A43347A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648913749, "uuid": "c8a3bcd6-230f-4ff4-a1e0-a4dd255884dd", "value": "eeac73be37480fd144f387e3563a0f14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648913749, "uuid": "549fe7bf-15d0-4b1c-bd4c-fbe8d1eb8900", "value": "24576:pQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cVDE6:pQZAdVyVT9n/Gg0P+WhoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648913749, "uuid": "26cff8ee-4176-4099-bf34-02585fd3720f", "value": 1840518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648913749, "uuid": "6dbff963-8354-4116-bcff-7a10719fe32a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648913749, "uuid": "1664e09c-3de6-4b15-b379-4c8b4f177499", "value": "52D7F88F2AF1AFE7CA436C7553BC9F46D0B61D43A4945.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3fbe3ac-b2b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648925885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925885, "uuid": "3d8bdc71-c76b-4196-bb9e-520885dba84e", "comment": "Malware payload (Mirai)", "value": "68893fd6bab1214059932ab017d32c3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925885, "uuid": "92dbd210-6452-45d9-bd2c-752b61d2d96a", "comment": "Malware payload (Mirai)", "value": "56a3840d99a23d694734d3d664a5e6fba9ca46db54e1d57d652bd927f1dbc47c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925885, "uuid": "ec7de511-cfee-423a-8919-07cc295f68ee", "comment": "Malware payload (Mirai)", "value": "1577e78d7e9fe18954511916e95b47cbd392e242", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925885, "uuid": "0ab47160-2638-41ba-a63b-20f3d31e0479", "comment": "Malware payload (Mirai)", "value": "15033c5aa7ca5983774297b5b785ca3200e52924a4f56e4936bb79061fa8b44c576fc3c2ec6657f5b7fa236b7f96bc85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925885, "uuid": "29b2f4d1-133e-4c8d-9d74-03cc2944da55", "value": "T1C7B3D70ABFA14EF7ECABDC3746E92B05249C552A219C5F76B630D818F54B20F1AC3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925885, "uuid": "cde8943f-d555-46f6-be1c-bca9f4bb7696", "value": "1536:W+SclLKdffnewH+xNdhYo79FWCY1K5flKQ1JzbgaZsRNJU9:W+rlLKdffewuNdhN7XB9gaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648925885, "uuid": "8602da8e-e5fd-4834-ac11-1f69d0470f41", "value": 109744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648925885, "uuid": "1dfaf144-ebfe-4c2e-a489-2476a92d89da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925885, "uuid": "7ab7aa8f-1cda-4120-a891-334691ad8f6e", "value": "68893fd6bab1214059932ab017d32c3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "739fcc67-b29f-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648915845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648915845, "uuid": "1da45d11-af13-41b5-a260-6c4ceb8bc40a", "comment": "Malware payload (NanoCore)", "value": "46b282bdc8af51c89f4a76dbe59d2014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648915845, "uuid": "d414cb21-a78a-406c-9107-ca145bd7b347", "comment": "Malware payload (NanoCore)", "value": "573b1dd9da735c7ca71132db9e6e8cb9fb5c8293b2f185d10b877ed33a203e2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648915845, "uuid": "8a85ffca-6bbd-4763-838e-1f9c170bddde", "comment": "Malware payload (NanoCore)", "value": "149b1ee6d5bc3c91cbb758811f599eb3e6394b5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648915845, "uuid": "edfce0ce-d7de-41dc-81a3-deea496e78ef", "comment": "Malware payload (NanoCore)", "value": "2ba59d16054ce96c14ddda6c8cbb31a4983a1f7fc366b72c608fe077f16feb3e19d0fe88e24a4886a377997fc91b17cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648915845, "uuid": "5c45ff5e-2b02-4e07-93f9-cc5823ba5d22", "value": "T112C4F1493694B1DEC82BCF7A9AE42C24AA317A674317C20B144B029D9A1DBD7CF157F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648915845, "uuid": "e90bf413-ef7f-4038-9f83-7d3fd63781ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648915845, "uuid": "7eafa54a-cf1d-4010-95ed-74bae519848d", "value": "12288:COXHWEJmcOGTqVVmW2ktkANmYNOUEdto60xw5tvzMYCacpygoiUKla:nXxoGOVV5/NEUEtLCWzlX4Fa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648915845, "uuid": "7787238c-3ec7-40c1-8fc2-dc2126118735", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648915845, "uuid": "d9302247-b0ab-4fcf-a64f-3b8ff0086bf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648915845, "uuid": "9afc03e8-818b-4aa1-9887-59edc4d1a596", "value": "46b282bdc8af51c89f4a76dbe59d2014.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499ce34f-b2ca-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648934242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648934242, "uuid": "518c6477-97ee-4836-84de-0a4691cbeed3", "comment": "Malware payload", "value": "7e456a7ea1081ad7341dbddb759a7dde", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648934242, "uuid": "3a1705fe-3ed9-4f53-81b7-57dcf6f238ec", "comment": "Malware payload", "value": "576dae5782d7dd98fab606b11b7507be5e7f4b4abedfdc071f21d8d8a4efb789", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648934242, "uuid": "d3807531-5571-4756-9d38-fbca4957907c", "comment": "Malware payload", "value": "059aa1bb1da90298193c6b2f08d271d0e94b7c59", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648934242, "uuid": "39f21485-9b0e-4814-aaea-eb9179aae5e6", "comment": "Malware payload", "value": "1597874e6f8973d206a1a82a03f317e40a1f7c1ad0689de7d568f11a253390b50b91003a3e78ca5019431aa46b211885", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648934242, "uuid": "44da04bc-49b7-4881-9240-0e020637315c", "value": "T11AD45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648934242, "uuid": "eb173da6-ca12-4648-91e0-80730731ef90", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648934242, "uuid": "76a3c0a3-f26a-47e8-b172-da95172b11c6", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzGipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+wxooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648934242, "uuid": "76ccb737-d040-42de-8c0a-da786260aa9b", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648934242, "uuid": "03ca6b17-7ebc-4729-b7f2-7276201352f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648934242, "uuid": "51a2a21a-2ec8-4a6c-a130-c636a03a8b14", "value": "EMX.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d1955bd-b2c5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648932128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648932128, "uuid": "07e42664-1086-4823-91a7-a72c89df493b", "comment": "Malware payload", "value": "bd33f346188d22c3f10748274e27687e", "object_relation": "md5", "Tag": [ { "name": "PHPWebShellMARIJUANA", "colour": "#7AA7E1", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648932128, "uuid": "535e06ed-9225-4168-8fd3-7dc6a3fd85cb", "comment": "Malware payload", "value": "5ca9796721e63027cdb6969fbc8fe71dd55f3cd1996ee120e473a468cacad1ad", "object_relation": "sha256", "Tag": [ { "name": "PHPWebShellMARIJUANA", "colour": "#7AA7E1", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648932128, "uuid": "830e21d3-349a-4488-80a8-e33827a2f708", "comment": "Malware payload", "value": "d893f31227cf727b1267341280d7234a31c3ac00", "object_relation": "sha1", "Tag": [ { "name": "PHPWebShellMARIJUANA", "colour": "#7AA7E1", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648932128, "uuid": "e47646a4-a422-4ba6-b133-8611e7b1cd8c", "comment": "Malware payload", "value": "6807040fb8c21bfde3cdba3adbfaee21844b7a6142b4ed47ec1e562e36b6f0c3be125295ff9e7f967390dc069c85116b", "object_relation": "sha3-384", "Tag": [ { "name": "PHPWebShellMARIJUANA", "colour": "#7AA7E1", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648932128, "uuid": "73ac9aaa-97e5-496b-8413-6dde5cd9c606", "value": "T16843E4C53B8999BACB2FF454720A9C53CDCED259362D988377E31E047023CA8B5799D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648932128, "uuid": "47270710-12a4-4418-9841-b074a1cfb9d1", "value": "768:SLprVRAi7UY2cMWaGJT+5+X+NdTd1P0BpQB:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648932128, "uuid": "8081ed4b-f9f8-46ae-aeab-f41f5ad6b715", "value": 58190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648932128, "uuid": "ef52174a-501c-420c-a60c-c8f6ad625f25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648932128, "uuid": "5134a592-eecc-4acc-ac41-4a790ba9018d", "value": "FkejFV5k.dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f0ddd6-b2b3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1648924249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648924249, "uuid": "dcd24c3f-cabf-42c7-a5a5-b0ff772b7eb1", "comment": "Malware payload (AsyncRAT)", "value": "9f204c6d653d10a12deff518848fc38d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648924249, "uuid": "bd8e265c-7bb9-487d-8f9f-9eb7f00a65fb", "comment": "Malware payload (AsyncRAT)", "value": "5cfe7a77271ab8187988cdd1a9259c16cb636dcf6c63aceb977f62aa570ab419", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648924249, "uuid": "bfe06fa6-7457-4ae9-a6b5-4f01cf8afba2", "comment": "Malware payload (AsyncRAT)", "value": "0570ef6eafc47424ca29c766e97809d0aa713921", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648924249, "uuid": "a4ba9677-53f9-4971-93f8-df8fbfe4b6a3", "comment": "Malware payload (AsyncRAT)", "value": "0876d653b8aae9cad0e4266b2828aef8a0df470f13e70247fd8ccfe6b05fd6cb3797f8d55381ee6a3ed07878e0d36225", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648924249, "uuid": "00ace7f8-f8fc-4564-8ac4-050303338e0b", "value": "T1E345BF6E22574946E904EBB8DEB3BB410750F5B64D75A303F3982628E46FBF92B41313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648924249, "uuid": "c66b46dd-a4ea-4463-97c6-91c9544aef81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648924249, "uuid": "bae569e5-a747-4b3e-8466-5d2b6ab3f844", "value": "12288:r3qLEOZWzDN8z3RLKYP17UNP5uH9S8uv+Deq0QQcRR5sAd2KBbjAd+wiep7i2Re+:LqtW9SFKYP1Qw9SSTRRGAk+w82NiqoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648924249, "uuid": "62c6b336-d846-42ea-83ad-d9473f1957c5", "value": 1196544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648924249, "uuid": "277f0b65-6776-45f1-82f9-948b63dbf86c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648924249, "uuid": "9decb72b-b9e3-4574-8f78-58f0b564466e", "value": "9f204c6d653d10a12deff518848fc38d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb1db1e-b261-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648889100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889100, "uuid": "06ff65aa-71e6-462e-ab95-8e6706856b2f", "comment": "Malware payload (Mirai)", "value": "4dd487dd718e0a0997f83a7e378159b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889100, "uuid": "6e80844d-bca2-4ab3-ae42-432b4e14fa22", "comment": "Malware payload (Mirai)", "value": "5dda2068fa10e74d9283eff488c99630eaf0140a48bfb8d3dbbd8f7165ec1c11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889100, "uuid": "c63f512a-2e19-4acf-ab03-605329432844", "comment": "Malware payload (Mirai)", "value": "72aad7df97b9704a14b863be798f88ce96f54a37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889100, "uuid": "e8ad857a-881b-4e44-a209-01e74bc2195c", "comment": "Malware payload (Mirai)", "value": "3d6ba5364b2d9ba1610ec1906bc376905a894a8e200b3d21461f31de114124ea730e42f2bb2e4039880e74c1059c4123", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889100, "uuid": "195049ca-258f-4112-9821-48ff8eea4df3", "value": "T1BB436C02761C0E17D1A31AB4253F6BD18BBEEED021F0F685264F869745B5E33258AEDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889100, "uuid": "b9a8fce0-e7b5-40ad-aa90-0ac3d14df7c6", "value": "768:JaAKH9O75GXn7fHW/c6NdR9uj8Ma7d+1CCX+X+1mLh6MPw11yuN7H7m12XnPZs3K:17cn+dWj8ZM12zELRZm9IfYga10jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648889100, "uuid": "4280c2ed-6639-4183-8012-1a7afbe964e4", "value": 58532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648889100, "uuid": "2a8fbd91-67f2-4ff4-b00f-bb038da56b1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889100, "uuid": "8dbf8e9f-198c-4d0a-9896-c69e56801396", "value": "4dd487dd718e0a0997f83a7e378159b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbdda01e-b287-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1648905765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905765, "uuid": "b16486e1-ec22-40bf-ab8e-af6fce9b6abd", "comment": "Malware payload (ArkeiStealer)", "value": "6e925c67e39fbd4ef0f84ad165ce66ad", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905765, "uuid": "507555cf-6151-4f56-beb0-34ce61c78c07", "comment": "Malware payload (ArkeiStealer)", "value": "60e2041e9280879b054540d9d8cef49a738ceb9c5c8f73a0f47016a862645cf7", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905765, "uuid": "558290bf-42ac-410e-8cfa-747c9841c453", "comment": "Malware payload (ArkeiStealer)", "value": "e5a0c534ba13bca82c0452420e56ab8b41313b38", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905765, "uuid": "92eb46d7-565f-4aa5-b839-cd87cb5901d5", "comment": "Malware payload (ArkeiStealer)", "value": "6f1effd3a9bc424de802a3f3c9f70226eec6e7484eddc4add149d83a871342c61d52e1fe17041b43537a4faeba6c5a33", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905765, "uuid": "091ee75b-eeac-4f3b-bb3a-bbe6e7048d99", "value": "T14B6523156A1943B3D04328BD0609F3D6393EE80F7D159A97B28B7E276FDE0A8E445B4C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905765, "uuid": "887e1b57-04e3-4117-a89c-23aed7dcb479", "value": "fb17a7583a4496507865bec3020cc63b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905765, "uuid": "80fc8584-b263-4ce2-8545-8de42fe3e01e", "value": "24576:0h2Lgy1PQEShnTeuJVteXi+Rx68xSzwfgFl2Js9S8POcB9XSOQ0npgu9/Ed+:0ha0EGRVUXi+v7xSUfylp9t9XSOQ0npp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648905765, "uuid": "15bfe1aa-fcff-4f1e-abd3-f0799183c60e", "value": 1517448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648905765, "uuid": "d5fa1c70-aba9-4391-a3d8-cbe4f4667265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905765, "uuid": "b42533ee-fcdf-4142-a11c-7c57678d342d", "value": "6e925c67e39fbd4ef0f84ad165ce66ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06f734e-b239-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648872192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872192, "uuid": "df047611-cd79-4059-b7f2-848b5aa3fa92", "comment": "Malware payload", "value": "fa0b15330c8ea15cf0f2d70927bf9e9c", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872192, "uuid": "555be482-7ca6-4023-aae6-1ce29512192d", "comment": "Malware payload", "value": "63f044a0643cc8c69550bfe15954b38d66786e4b5be97d532a980aa5add58824", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872192, "uuid": "2dea6556-dbf2-42f1-a777-ad077295ed67", "comment": "Malware payload", "value": "ad9bbac1d9bbe7a953ffc70e5dbbaeca9004ba58", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872192, "uuid": "8b4c8467-1397-4f01-a5ca-9e5541a2c2d1", "comment": "Malware payload", "value": "4487c8173c67432b751fe79e854182857d64e8e89f0a2251aace036983c7650052a5e6a9c83585993d9f3e39d7cb1186", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872192, "uuid": "f9a7d24a-b7ab-4b17-9695-b231561f4fb6", "value": "T1E2534275E1BBDC45F226273129E2D2606B53FD066E32561BF2C67B4E9CB08803B11B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872192, "uuid": "2f62c966-d145-4701-b23a-401fe5d0fff4", "value": "768:o3cLn7MyEIWzCORdBJi4+zC1XgNWIoXPNWIyM+M05nqCqa5Uef+w5owtoqvtClwV:NLkL+GU1EpYO6PuvaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648872192, "uuid": "4ab4690a-5fb4-46dd-993a-3abc70af69c0", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648872192, "uuid": "5d8500b9-d40a-4a6d-a786-ff4c87280466", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872192, "uuid": "f50f4bd0-664e-4355-9d0f-fc1ca580ec83", "value": "ThoiKhoaBieu DH tr\u1ef1c tuy\u1ebfn s\u1ed1 1 (20.9.2021).xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe784f44-b264-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648890737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890737, "uuid": "1be442d3-8fb3-40ed-8127-c35e0f76d47e", "comment": "Malware payload (Mirai)", "value": "526b3f31d7bbbfd0d0b3a91b072ee44a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890737, "uuid": "958042f4-b712-4862-a86d-7588e39ab331", "comment": "Malware payload (Mirai)", "value": "65d1051387397823236bc66b70dbd4b5c94211bae44118019a9dcb58d78bb8e6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890737, "uuid": "2eca536a-ef72-4d3e-97a7-c7e7e5639b13", "comment": "Malware payload (Mirai)", "value": "eb9f3ce5c88ceb469a327eaa3c898721dd3abe88", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890737, "uuid": "e3ac90cc-4a57-47af-bb3b-2068fe2af931", "comment": "Malware payload (Mirai)", "value": "3c1f9a497b1d41318a77128f01fe88336b8430a9634d92f22a8a7735c9dfbf986c5638d4d3b95d1d97690066fbaf5acd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648890737, "uuid": "52292e3f-849c-49cb-87f9-5e55b725e312", "value": "T117633A43A68581FDC1A8C0B542BB6636C463B57C127AB6D673C4FF1B3D09E601F2E689", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648890737, "uuid": "12adc31d-a622-4567-a75c-32691bfed548", "value": "1536:5fefXa/W3jJ1f2Z5RzbhZaqT5+kK5ZW8ap0cjoibl:JefX4W3jJ9IDzbS6+kK52Djoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648890737, "uuid": "3c6788f6-294f-4c86-bab7-c3ccbb843242", "value": 66816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648890737, "uuid": "7557f8f9-e7f1-42a2-859d-931675ebe218", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648890737, "uuid": "0fe13131-a9af-4934-a699-d2ae78b3b57e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41eea3e8-b2aa-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648920486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648920486, "uuid": "62e301c4-dafc-4344-9030-9a09ade787bd", "comment": "Malware payload", "value": "d4c0a08fd757e20b43214f3a1dfbbe97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648920486, "uuid": "d2cfe39e-b1ec-4a09-8b17-abcdb74ac6a2", "comment": "Malware payload", "value": "6bc500fbd2ff2e7c0f48f1404f054baed99d26159ab5c260edb8303abb38ca5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648920486, "uuid": "3dc32449-aa66-48c9-bccc-e520014725de", "comment": "Malware payload", "value": "20186bcc1be52b29841b62c1656cc785a4e2196d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648920486, "uuid": "9994a7d2-216c-4610-b8ad-89512a1cb05a", "comment": "Malware payload", "value": "228b81bcafcc3c9fdb5a382abf43dd0a8d721e0659dae06df77fd76ac0f2a8ad3e677e980f3fb5f736c12d015e91df95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648920486, "uuid": "59cfa9cf-e7ba-4c5c-89e1-042e27350830", "value": "T1CC359E91E245ACE5E92332B9EC36CD90201BBE9D5579061E315ABE1FB0B374314E6E0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648920486, "uuid": "7a1dc250-0683-4413-bd1c-dad21fd23013", "value": "cd283dc46c2fe3510abf8ece19fcb3d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648920486, "uuid": "388fde70-0ea1-4832-a991-e3e06799ee37", "value": "12288:9hrfEc6J9n+TKQYhtheITf/wuNMTdc+za1HEh7uNTpCQ7CzUWnX17x5mmdYgbE3B:vrfEca+Q3R6Tdc+e1TNCz1XH5ddRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648920486, "uuid": "e16195f7-4537-4dd0-8a60-9c729ff8f973", "value": 1078768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648920486, "uuid": "58d35500-3a68-4eb6-b007-c4fc7b21b736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648920486, "uuid": "fca9a363-0cd1-43b0-8a20-ab7b856ab320", "value": "d4c0a08fd757e20b43214f3a1dfbbe97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f7bb45-b23a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648872528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872528, "uuid": "5c364dcc-bb19-4d3f-831e-9300931969ab", "comment": "Malware payload (Formbook)", "value": "9746147d84cb3d6b7a91ac76fc7b74b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872528, "uuid": "171209ad-e8d6-4349-951e-b921eef11514", "comment": "Malware payload (Formbook)", "value": "6d40fb5818ad031394cb4fa6e0007d69bcdf4396b7f6af749badc7a080c776ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872528, "uuid": "1f18a974-2e2c-4d14-a1a8-b3d848d9b487", "comment": "Malware payload (Formbook)", "value": "8c70e93e0c8c29b2be64703485c30be238dee7db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872528, "uuid": "92e3b2de-a85e-41b2-8be9-efadb44ec816", "comment": "Malware payload (Formbook)", "value": "99860669a15503ccf2b59bb2fdd19adc082a09520d4f70e23917e8fbdc4572da5fa83af294582733247a155d938e8880", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872528, "uuid": "3f5b5d2b-f44e-47f2-8660-ffb9065e7418", "value": "T108648D90EA4CFCDAE4DA0573763A942C09919AD996F4009F37673E3465B3BD3207BE06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872528, "uuid": "27a78cbf-cc2a-47b7-8c42-2aa6fdf08d4c", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872528, "uuid": "d2b84b1d-77d0-482a-975f-3c663a7c812a", "value": "6144:RNeZIh2Wccgp0wvA9A+R5Fm8Rdb8FxFQQ5sbF:RNj4Wqp0wvZ+X3bYFQnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648872528, "uuid": "2a2fa6ea-77af-4801-a3ef-be546a02a914", "value": 313282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648872528, "uuid": "81db8d8a-fc5c-4915-9fca-fc364846a3f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872528, "uuid": "acf13626-4dfd-4e7f-994e-c5a89b7d041d", "value": "4505682666.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5deb9e-b2a9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648919963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648919963, "uuid": "bb090806-7d28-4a76-ad63-d3935c14b118", "comment": "Malware payload", "value": "7faf6703edef8c4bb72b3ef9fc58015b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648919963, "uuid": "a48c3581-5fac-4c8b-8ebd-279e1ea7210f", "comment": "Malware payload", "value": "6f237ebed964fae61190eb8a03ed002208e0a26d5f59bc6befa11747a3f3d6c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648919963, "uuid": "cc7c8d24-cd52-424d-b49c-8dc02ca5d084", "comment": "Malware payload", "value": "de873bfb3b2e37ce12e27a3012ce64c470359206", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648919963, "uuid": "bbca4deb-62f9-4474-aee3-a6b7f299977c", "comment": "Malware payload", "value": "d83f2d364c94330b59f683f001982b190b1b2c1b782054b48c950f0ae5eaaf19c0d843676b00cf03336b31509f1a6511", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648919963, "uuid": "29e88241-c53b-49dc-9830-fad393e8c9cd", "value": "T1513501653281E81EC0160AB4ADE4D4BDC4B8BF525D9709A3B2C63F4F72B0715ABAD3D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648919963, "uuid": "51f38e27-a31c-4ed3-95b4-9e3b95fbc246", "value": "095b6e7bcbaeb712bd702ecf0a691f8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648919963, "uuid": "ff12ae30-3ddf-414f-9519-073e8ff0d12b", "value": "24576:Z2B+2Z///lpUQP8Yq02fhNlWbPgFNriRcDBnSP69yjO1XgL0sYnsg:UBbZ///DUgXKjwbPgdNu69fBgAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648919963, "uuid": "9515ac8b-f944-4d5c-9557-efbdb56029e8", "value": 1096128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648919963, "uuid": "4b07ba96-0de5-41f1-84c6-4d61d2695c1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648919963, "uuid": "35898a48-689e-49d7-b2dd-cf6bd597a25a", "value": "7faf6703edef8c4bb72b3ef9fc58015b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7991be-b239-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648872208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872208, "uuid": "4f8278f0-3860-462a-a2b0-534396c01d0a", "comment": "Malware payload (Heodo)", "value": "36828062e80b0a4e0bf5213485da40fc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872208, "uuid": "e854540e-d75d-4293-911a-b5ce26f8d9a1", "comment": "Malware payload (Heodo)", "value": "72567e4a0be4abdcdcd8dbc2c67d3f9c386d8e376ccd3c6ae4125a1098242853", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872208, "uuid": "14a391a3-a8eb-4876-8d6f-25af9cfdb9f9", "comment": "Malware payload (Heodo)", "value": "ed369c97729521c15b425eff2831b569271be88b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872208, "uuid": "f5ca3846-4ede-4d81-9739-682618bec868", "comment": "Malware payload (Heodo)", "value": "c9686f96b3fb1906c006530b2a59b9967ab010a9c72e624cb9b8ff1e6a92d32f0aa206bbb537338058e428d749d78915", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872208, "uuid": "ebc1d29d-ad26-4274-8dc9-64de0e38a326", "value": "T1B035BF1436C5C0B6C2AF11B64916E35E62F6AE614B37C6C76BC0EF5E2E345E38A35243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872208, "uuid": "799a9b91-befa-4b64-b87c-66b8dcef9c79", "value": "65cb2e07ebdd384311fe38fce542605e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872208, "uuid": "ab0afb9c-d527-468e-a35b-b6a1fd5f75fd", "value": "12288:s/9RP8f5TiefonhbF3wleXx7xXhP7/dTewZ0SwA58l01oDpI2+Mlgn:y9RP4onnYon7/dTeKLz58lcoDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648872208, "uuid": "64fe89cf-d271-4931-bcd5-a7b76180e25d", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648872208, "uuid": "a8ffc9c4-6d92-437d-a1a1-1c4246542443", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872208, "uuid": "f9429094-3ff2-453b-8117-44ef0fdb8fef", "value": "EmotionSelDemo.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f01cd6-b289-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648906482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906482, "uuid": "0bcdce90-ffbb-4a58-b36a-d2017a1cca3d", "comment": "Malware payload", "value": "5736e52ec391492805542f541f2b2af7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906482, "uuid": "4ead8877-cd85-44f1-b482-25aa97abb020", "comment": "Malware payload", "value": "74be404146fa09f5edd44a6d559188cd2f3221178388084c9637f8fa23a16ebf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906482, "uuid": "2a71bad1-95e3-4136-9603-bca14758639d", "comment": "Malware payload", "value": "533e273695b1935e1376a7b3340b8f471e61f436", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906482, "uuid": "1b6b1815-d46c-4bc3-8d7e-cbae54b5495f", "comment": "Malware payload", "value": "3807c85d192b9ac408c36ad1a8431c31ff6e8baee973a13792d49cdcdffbf6388be5e43e7602e0a9f8fe4ff02876e950", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906482, "uuid": "eb61265f-92fe-457b-b432-ba4f89290ab5", "value": "T1E6F5CF5D22864849FDC1D3B9D8BB5BA92761967148EE0343B3B5153CE86F3BE3E50B02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906482, "uuid": "4e7fed69-33cd-473a-a5e8-79ccc2381ae8", "value": "49152:pO97ROqKk/KZaOsEr8AbcbMiJhxFmtr6eMz7tkoRhDTA7u/ArJl29o69EieM8:s2bZrVgAX4sr6eWfAFvwIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648906482, "uuid": "6aacd56f-bc6b-4e4e-9f1c-64dd912ab906", "value": 3501168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648906482, "uuid": "d1593b16-c248-491e-9cda-48e544112fdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906482, "uuid": "a49b301e-c60d-4b34-b6e0-cdb0359803b7", "value": "5736e52ec391492805542f541f2b2af7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b4a3505-b28f-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1648908959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648908959, "uuid": "3651589a-3c9a-47cd-ab47-e3a8d1d2c5b9", "comment": "Malware payload (njrat)", "value": "1b819841f09e97d35d4001a4895f1d26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648908959, "uuid": "bf9c69ab-bdc4-49df-bf25-6cf42a8abf9e", "comment": "Malware payload (njrat)", "value": "7756404972759b86afb7c7924ba6a6db3916f8729ce779977735a258b8317f0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648908959, "uuid": "791139d0-b225-4e70-ac85-86a41775872e", "comment": "Malware payload (njrat)", "value": "3baf4f550ffe0fa279d7cf72e19cdaa16071bfc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648908959, "uuid": "321cf619-d6f3-45b1-800e-224a3acda274", "comment": "Malware payload (njrat)", "value": "8de7dc336ebd6cc034ea06d11865a5fb0673ed47b8f2da510cb85e44f5779f34ded59b39336a72a426541cd00b36bf07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648908959, "uuid": "89fc0926-6054-425c-81b2-fbab7274bddb", "value": "T1C5D3D78DB694E175D5FF8BF1B4A2B2890B71A017A802D30F99F114D94F73AC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648908959, "uuid": "4d1cce93-add7-4c78-b1af-1dc80a971fe7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648908959, "uuid": "9a8d6965-c5aa-469e-98e8-539788e17dea", "value": "1536:xFLxIay5EFiLCOvypuXQQvVMkFLxIay5EFiLCOvypuXQQvVMkFLxIay5EFiLCOvU:x25EFop3b25EFop3b25EFop3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648908959, "uuid": "29b24d35-4ad8-426c-b3e1-d0f80b242aaa", "value": 132096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648908959, "uuid": "54420d3f-ce5d-43af-b8ee-df4059c51619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648908959, "uuid": "8dffc9de-72c2-440c-8790-f4aa34a1bded", "value": "1b819841f09e97d35d4001a4895f1d26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e60a710-b231-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648868564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648868564, "uuid": "313de354-a379-4470-b311-67cb9d86748d", "comment": "Malware payload", "value": "e7a9ab497dbc219986d31a1ce891c8fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648868564, "uuid": "c876c979-4d02-447b-9d6b-38f0d04f4e4e", "comment": "Malware payload", "value": "77d8ce68a57975c3b6980b38fa810af41c8980e0f4ec36f75002b92159a84b00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648868564, "uuid": "c2d73b52-60b4-45f0-a250-d8b2b389893a", "comment": "Malware payload", "value": "87e8e316b67cc235d7f32d73fbada3e70506d453", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648868564, "uuid": "8b2dd7e2-09a3-4dc6-9176-10e8e994089a", "comment": "Malware payload", "value": "4d55040403e358fff3695e888e344345670be514b44907a6a02be98a776108b469e95311e63a02c49a35a6ad2d158d5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648868564, "uuid": "520c2ef3-97c6-4618-888b-7d9138eb0f4f", "value": "T186A55A27EB606409F4A60030A999937355382D74351AA90BF78CBF5D2FB16C7BCB5B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648868564, "uuid": "21e6361c-21e3-4ac8-aca3-6d1f9912de7f", "value": "a21d8afb063fb81df0571ec63d0db2d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648868564, "uuid": "915693b1-5a46-496b-adc4-12ff5be2a030", "value": "24576:T9HexAtnr0rjXvCvivvDvPv1vOvVvjpvCvivvDvPv1vOvVvjfCaYk3PuOOaFjBZK:pH5ngNCaYk3PuOOa5BtnoffNsjW7FaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648868564, "uuid": "ddedd689-7c91-4dd7-9e92-e79e06d7ce6e", "value": 2174976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648868564, "uuid": "a6611b02-1133-48bc-b041-3ccb304ddd55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648868564, "uuid": "b3f54241-7fc9-4d6c-9c00-c6228c150980", "value": "Kundli-pro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff761a5d-b264-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648890739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890739, "uuid": "1f83a5e1-3442-4857-940b-40d5fb49638b", "comment": "Malware payload (Mirai)", "value": "e6af07354e3ce2a8997f04d1b094afdf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890739, "uuid": "65743670-f0cd-426f-8411-fbadc03caa74", "comment": "Malware payload (Mirai)", "value": "79a099ba662c9a0def1ff8a812c0868027c430fc2960a092cd205b9b50fecf54", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890739, "uuid": "dcda604d-228c-464a-96d9-86f84c830c65", "comment": "Malware payload (Mirai)", "value": "3b853fb1d6303456f8d11d270afa845da55297f2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890739, "uuid": "23261103-b31d-4d53-a7c8-717ba53c621b", "comment": "Malware payload (Mirai)", "value": "1b23a5d8d7b146c7cece8d5d52ba4766f16cf82f3bd7361efec682eb06af9d08e0d7e532bbb8d62ef52a18070092488f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648890739, "uuid": "4139cc96-22b9-4c95-8a1a-28a1beaba6c2", "value": "T15FD33A46FA408B13C1D517B7FA9F414A3322D794D3EB730699285BF43F86A9E4E23906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648890739, "uuid": "e8919291-77c4-48b5-b558-7b69f83e16c6", "value": "3072:BlcCohtaSZUL4aemtwwN/i1PeWa2yMxVl/1jHa:Bl+hwS6emtwwNa19a2yMxV7Ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648890739, "uuid": "d415450f-7128-42f7-bd42-2bfb33f59387", "value": 142271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648890739, "uuid": "a87727f3-79c9-497c-8269-b834661d9c69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648890739, "uuid": "06bc9522-b153-465c-959e-cb3ad4a54092", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef7608d-b2df-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648943405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943405, "uuid": "d83be450-0458-434d-987b-7874141da354", "comment": "Malware payload (Mirai)", "value": "898ffaba617132ac3e10c10057804345", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943405, "uuid": "c7a19306-bb67-45ef-94a9-ebf305bb206a", "comment": "Malware payload (Mirai)", "value": "79e79bf6190aaee966822d5475c701cecd580084d897dc8e02a513f7afbb6410", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943405, "uuid": "4e90dcbc-68a3-48ab-ad25-301c0ebc0154", "comment": "Malware payload (Mirai)", "value": "2b04fd4a0e4348b98b6feaeeb5159e8f2d5995ee", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943405, "uuid": "277e242d-a469-467a-b1dd-1c4618d68b41", "comment": "Malware payload (Mirai)", "value": "45de4048e0213356a150345167b79742019e1a6f790ce73859b8eb6e540a2e792098d1d896a999d31f3af05dcf06970c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943405, "uuid": "8b0ac9ff-d25e-421e-a59b-96571e26c731", "value": "T10D732986BC91DA26CBC45377FB2F018D371493D8D2DF32029D295FA476CA81E0E27696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943405, "uuid": "77c56f70-0de5-44f0-96c7-ccc2165d4f15", "value": "1536:e1RZlne7U9NXUfglZuy4Sea3uXawR2JhKp8C:e1RZYyN74Segc2JhKp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648943405, "uuid": "3e9cb131-7fb3-4ad6-99f1-d7f6644830d5", "value": 74904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648943405, "uuid": "1ee7c9da-fe6e-437a-8ed8-64ab0691e83a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943405, "uuid": "a9c06b62-50f1-4d72-9a4b-8fb094d1bb11", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259e41ac-b23f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648874482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874482, "uuid": "6368f14d-cab6-4a7c-b699-5f6278635261", "comment": "Malware payload (Mirai)", "value": "f1057f98f50a96ef33b52d57c978f629", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874482, "uuid": "94d6353a-5826-497d-965f-4b0e687a7b26", "comment": "Malware payload (Mirai)", "value": "7e8dea4b7ee6efbfdfead8f87b79d952e43b108ff0c42b429ad6cbf5ec6b6c16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874482, "uuid": "0dec7ec5-0b4f-433d-8eea-f9db0f6bf943", "comment": "Malware payload (Mirai)", "value": "f2040f193b3127f45ff2dcdc7f63d2253978597a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874482, "uuid": "5cc18f1a-d943-4b77-8659-538d411be8b0", "comment": "Malware payload (Mirai)", "value": "5d251463304ca971732eb5354b8328d9ec47246189c50b595e9edd289fb8c7aaa2aaf8caf7cc3e197dfbd8bcf57309e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648874482, "uuid": "493e3ab4-0937-40cc-8a1a-4eafd8e530b6", "value": "T11D331A91BC929A26C5D013BBFA6E6A8D332163D8D2DF3113D8640B543AC611F5E67FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648874482, "uuid": "f6521a51-bd66-4b03-9d63-029dfcda504c", "value": "1536:GrnvZ38h3OV0Gezxj5mhB2r+kV3B5vy0P0kK5QKZa1q:enRWIv2rPVxFTckK5Q5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648874482, "uuid": "f27f126b-774a-4e93-93c6-d0ac4434c114", "value": 53192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648874482, "uuid": "e4f08291-1718-407e-a9f5-dca34b6e7174", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648874482, "uuid": "43c5ee47-98d2-4493-ab2c-1b3f16cb5005", "value": "f1057f98f50a96ef33b52d57c978f629", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af4d345f-b238-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648871707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871707, "uuid": "65f086df-65f0-406b-b5cc-21c9d3116a62", "comment": "Malware payload (Mirai)", "value": "d8f8a468917223245d1e0aaf2657a45b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871707, "uuid": "dd24ca18-0336-4407-99c2-23e836d72eb0", "comment": "Malware payload (Mirai)", "value": "7e9ee6a068c234af9e97aecb1eb1fd9b8b321b8bcadd7ca806cdcc0658f71896", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871707, "uuid": "3b5151ce-f4a5-464e-b73f-8a68ff91cc86", "comment": "Malware payload (Mirai)", "value": "f165dc1fc0a4ef0690f550b43206c777b3825c4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871707, "uuid": "51a549e1-34c8-4584-a6d8-be61b7511a7e", "comment": "Malware payload (Mirai)", "value": "dfb91fb8b64940a474ac3fbcc2ba46bcc4c84af3c890637e961e67522b271612f0720ce10a6106f6a5babcea72ad471b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871707, "uuid": "042abc8c-16d1-4086-a8cd-70e2733c3d7c", "value": "T1C253AD72C01CAC84C19D4274FD248E785B63E408B5AA1FB26E9A87569407FECF21D7F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871707, "uuid": "a1d9d5fd-14ac-4f5d-ad8f-0b1f5ff1891c", "value": "1536:a/yhkdA+sDaXAwtXi5sx0hHX5h/04NqLCZ:aahWfCbB520N04NqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648871707, "uuid": "286ee89c-1b04-47e8-915d-54a0bd87d9d8", "value": 66680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648871707, "uuid": "7bb9f306-589a-4428-a861-6fd839f2aece", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871707, "uuid": "3ea58179-91fd-47d8-8e30-e2cef26eee47", "value": "d8f8a468917223245d1e0aaf2657a45b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40fe3c3f-b2ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648934228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648934228, "uuid": "8cbb84ab-90cd-4a9a-a7ae-f4be3aba6755", "comment": "Malware payload (Mirai)", "value": "388bec3a6700cabeab54cc0eac4b114e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648934228, "uuid": "c6e59392-6444-4113-ad1e-8393eb5fa26d", "comment": "Malware payload (Mirai)", "value": "841a19d2df188cf50f2c96baa0327290c67fe8ce796a03a885c0cb24a2244510", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648934228, "uuid": "c2e760bf-ebe6-49c2-a69f-ff08c3897dcb", "comment": "Malware payload (Mirai)", "value": "210d809c8f9f8a917fd70d15f77b6fe802e2cdbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648934228, "uuid": "31adfc8a-f0f8-4008-9595-bb229c41e717", "comment": "Malware payload (Mirai)", "value": "0c700a10301816ebd8c8098715ff7a4ee5b1a3c9ceea083898877f3ecd7e62a8bfaec7743b3272caaf621cc2689bf6ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648934228, "uuid": "4a6fbf9a-c9fa-4f0e-a814-fad402d52e50", "value": "T17AA2C061478E68E2D5640F72E4E7C249210B83F8DC8921A93338676486ED2546FFE753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648934228, "uuid": "1a9b4408-b91a-4dc1-9e6c-da4be118db4f", "value": "384:fpi25/RfD9Qb5/p770lFHFHCCMCC2CcLX5PBR+CGEmdGU5ESjk:BrF1pQbRp70lFHtCCMCC2CcFHr3UNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648934228, "uuid": "7d6a0c81-77bd-452b-abdb-45078de29ebe", "value": 21860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648934228, "uuid": "5c132d65-bbf8-4c57-ba79-bb14e4569b4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648934228, "uuid": "7675f512-0500-4fb6-aabc-b141c3fe629e", "value": "MRIX.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ad6522-b2aa-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648920514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648920514, "uuid": "2da952ef-f5ec-4977-8215-9c6eadcc577b", "comment": "Malware payload", "value": "a330a87cc9a0f9f8891db9999c7e5076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648920514, "uuid": "d6cc1367-856e-42e3-88b1-47251d5b9a0e", "comment": "Malware payload", "value": "84858e95dcf7fe3cb43f819f8b496ecc1b44e6f4ea938fb00b0b5c117e9b4075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648920514, "uuid": "7e93a919-99c0-49a1-b5ff-ddae2640e5c5", "comment": "Malware payload", "value": "9dcb948649631e3d07ab971ef58c964dc5cb18c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648920514, "uuid": "7a7fcf92-43c4-4aad-9e4f-6b14202250ab", "comment": "Malware payload", "value": "072706996b953c0e149a6141b16592414ef6099d3322fbd1431029ec9de2e83ba378772fbef2a98dad68222d1dcf0467", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648920514, "uuid": "1fc13ab3-9240-4f4e-8e0b-0f40dd167b08", "value": "T1EF1633395DA01637C74B1B7201CAADA1A1B2F5AB77C36C2788A2DF6845ED0CB3714E5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648920514, "uuid": "e511b906-3afd-4998-9ceb-341a07266586", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648920514, "uuid": "ab47201d-7f8a-4dc8-a5dc-5458766ba17c", "value": "98304:zus1duSHZm0d4dwaFmo+WE8MI8J4jcoJKieI8629b:HfuM34wBfW/zu62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648920514, "uuid": "58e4c43e-de18-45fd-bfb9-cf2efb5bedba", "value": 4223488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648920514, "uuid": "88e5bd28-7492-4d33-8a3c-273beb55e33b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648920514, "uuid": "21410d9d-a36b-47fe-ac92-a2528d2c45b6", "value": "a330a87cc9a0f9f8891db9999c7e5076", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b8d11d-b2be-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648929005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648929005, "uuid": "96e7be2a-7399-4209-97ba-5b87eaf7cf40", "comment": "Malware payload (Mirai)", "value": "2c8d9c0259b5b919b7560279c6cb7b77", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648929005, "uuid": "ed5a2022-ba3a-4655-a139-1137dbe828df", "comment": "Malware payload (Mirai)", "value": "8549319a44a0da51853cf59e7879da86828c0328ef4a4af934eaf73d938f0378", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648929005, "uuid": "9ba971cf-3cec-4b02-bfcb-ace432501399", "comment": "Malware payload (Mirai)", "value": "612f177062ebae2ad1e208dc63f5d7d7e0e1bd7e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648929005, "uuid": "843ac2ff-0bc0-4f49-8570-1209c959bf52", "comment": "Malware payload (Mirai)", "value": "f5725387a2dbddc5f2132bf4cc98f94f2dd9d7506e9e81958e8cc44148ff96ec6e5011d6784dbc313f23a4b90c3480cb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648929005, "uuid": "e8b609c9-8625-4e3e-bb71-266507e347f7", "value": "T1A3D33B86EA408E13C0D51B77FAEF41493322D755E3DB73068D189BB43F86A9E4E23649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648929005, "uuid": "50f2c4cb-3de5-4c60-ac00-b286bad71cdc", "value": "3072:QybUEGniGQYtOR7aCgk9mrsplDKZUmQBKXAVanJX+F8Jyve4hL5AJI4+3jJNx13R:DbUEGniGQYtOR7aPk9mrsplDKZUmQBK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648929005, "uuid": "2f7a22a8-86bf-4839-911b-28c2acc582c4", "value": 142651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648929005, "uuid": "87abb63c-72e8-4803-a916-947964d64a1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648929005, "uuid": "a04f9c07-c87c-405e-8466-4418420137c4", "value": "pandora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ba25bf-b287-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1648905698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905698, "uuid": "461c222f-047c-45a1-b768-d415f4b457d2", "comment": "Malware payload (RemcosRAT)", "value": "7d800b2a825316b0b0457eb8e47142ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905698, "uuid": "bb5625c8-26bb-4715-a43f-f9f684a27e96", "comment": "Malware payload (RemcosRAT)", "value": "85a947e9a7f7cf4ce2aa8aed475691599bb9cbcd12b5b8141c153edcfcd7d6d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905698, "uuid": "e8448f9b-048e-4338-a077-e0c12566459b", "comment": "Malware payload (RemcosRAT)", "value": "941802401b4772b5c540ed2aeb6d17b151d3c6b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905698, "uuid": "2475bb85-1c3f-45c0-b68c-47a4db34c9b5", "comment": "Malware payload (RemcosRAT)", "value": "f54a818acab58cbfa6d6b3851f8e64d854cb9a6a4c4f044476d4e5728d13868fa780bdf73e48c8f05278bfa18e487437", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905698, "uuid": "0e180d83-e8c7-494f-8601-028f7eec155a", "value": "T135A4BF11BAD2C072D97251340D29FB35DEB8BD202935857BB3E61D5BFE30180A72A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905698, "uuid": "ff35c97e-6e9a-4a60-b24e-cb72a95d33e4", "value": "029a987f21e33b48f24d21b6f9ff1129", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905698, "uuid": "f622d9c2-1d40-4ba7-b93a-ceb49ce0b250", "value": "6144:3OFBH/FMNjt18F+9a/NgAeDB4CcOtKp03b13a4LJ+sAOZZPWXbTcUcyg:3OFtiNBuFgawDB4NOmuwsfZPTyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648905698, "uuid": "0f649331-c831-4117-83d2-ab49308c78df", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648905698, "uuid": "7cdbdacf-1edf-4798-824b-761718afddc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905698, "uuid": "5fc78b51-bea1-490d-9ee5-0bb7a2419688", "value": "7d800b2a825316b0b0457eb8e47142ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb09b301-b237-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648871404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871404, "uuid": "ed369a96-034c-4182-b7f5-cbd0ac3a3b0f", "comment": "Malware payload (Mirai)", "value": "db41710c63565f1b886183f160761d05", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871404, "uuid": "a7a4e905-c80f-4b34-93a5-7f65f755bfe1", "comment": "Malware payload (Mirai)", "value": "861c53d80e4270fa07f3ab2d21b250784e35e7b3de9b4427a7244d557bac07f6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871404, "uuid": "1bb01f3a-fa0f-462c-bc94-808b2b550ad6", "comment": "Malware payload (Mirai)", "value": "431529a57287b35c5f81ab53d9faf6616cbd36b5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871404, "uuid": "f94cda73-50e2-468b-a6b3-76585143b918", "comment": "Malware payload (Mirai)", "value": "c725d8060f5fca4d679b5d6b54b923b4bc83ce50aba00f1a025053224575d882bc3ecb9a4b27399b2038244843cfe77f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871404, "uuid": "40e15a53-bd0a-4674-a2c9-2a2c909908c1", "value": "T16ED33A46FA408B13C1D51B76FA9F414A3322D794D3DB730699286BF43F86A9E4E13A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871404, "uuid": "18ab3176-02cf-4bda-b1da-88120f4acd9b", "value": "3072:BlcCohtaSZUL4aemtwwN/i1PeWayHgM/9l/1jHa:Bl+hwS6emtwwNa19ayAM/97Ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648871404, "uuid": "82ab7169-e1a5-47a4-a3f8-88acbe70ff68", "value": 142271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648871404, "uuid": "30d1f6c0-016d-4e37-aeac-27d6fab40234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871404, "uuid": "20c51dbb-021c-451f-bb32-b5f46a22cb9c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01abf34f-b23f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648874422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874422, "uuid": "9f8745f7-0d39-44e0-93f6-a68e8c87da7c", "comment": "Malware payload (Mirai)", "value": "1423f50e18f808dc916e24b176c4800f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874422, "uuid": "acee8ae6-49e7-4f70-b62b-d4ad373dde30", "comment": "Malware payload (Mirai)", "value": "8a86f73e149b6ea71d744c7b877e82939805dc00e7ddd9a345d282cef7221d7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874422, "uuid": "5bb76f8e-1636-487e-90ac-7dff6b597ca0", "comment": "Malware payload (Mirai)", "value": "90538c3100373d965cde554ad780b85e5abd5745", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874422, "uuid": "32a6151c-3017-49ca-bdd2-4d3ad86e542c", "comment": "Malware payload (Mirai)", "value": "648c50fe32ee84120aaf43658299a6e75f4b1de0d175ed98e33c9d098d18b3c36c38d0630893ebb2dc2e9a23456afb1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648874422, "uuid": "a2e64e71-6ce2-43fa-9a23-20153aae9c1e", "value": "T1B283B81D7E218FBDFBAD823447B78E216A5837D622E1D185E19CD9011E7024E642FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648874422, "uuid": "00d54d8c-f7db-4817-b987-8506dc27c6ec", "value": "1536:Qat8EmQaBYT1MEVUBbsB1MvlqmW9iOMD6UNJAUfwa1a:Qat8Em1cMEKbsB1Mv75OMD6U77fa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648874422, "uuid": "1e37f84f-582d-4ce1-90e0-6e6d773aaac5", "value": 85612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648874422, "uuid": "d6b7cecd-bf57-458c-8a73-386cbf25e89d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648874422, "uuid": "3af1c7c6-9f07-4ba6-80cc-685dd62e7f87", "value": "1423f50e18f808dc916e24b176c4800f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd08f89f-b28b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648907405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648907405, "uuid": "452fcae3-87d4-4793-ae4a-326c0fdd7bf2", "comment": "Malware payload (Formbook)", "value": "1c50787a04ab8a7f9dc97b054e3db289", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648907405, "uuid": "6565fcec-6f4c-43ab-b293-f4033c84136c", "comment": "Malware payload (Formbook)", "value": "8c16682955d982e7d4c1ea39eb9c2e84dd655c6c022cf44074eecc54134c0677", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648907405, "uuid": "88f1c4de-a590-4066-a1b5-e1c9c25a0316", "comment": "Malware payload (Formbook)", "value": "848fc65f86312afe7db3f41ab8b3a91f8630489b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648907405, "uuid": "c9dd75a3-7ea5-4175-9022-04e693bbbe50", "comment": "Malware payload (Formbook)", "value": "fc2345bffdd0473032a8fac9cca7824c43a9ddd6d01102e7f3e18d74fd85e360f76b4517cb300b4aed58fcbedc6cd00d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648907405, "uuid": "439e8a4b-e596-41ab-abf4-6c123b57ecf7", "value": "T185B4C067D7F9DF1BD0BE43F91420C03A3AF1E892B610C604AEF619ABE9E67950C44752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648907405, "uuid": "5b9680db-caaa-42d3-af08-8f0f4f319de5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648907405, "uuid": "9b10e38d-70e5-4d94-9b3c-6d3274bb4f32", "value": "12288:dwi5SwR6A44KuWyFLrSVMSCA+0N+luGw3j7cjU8Tmb01F:kEDPFPWMSCq+UVfS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648907405, "uuid": "db43546d-480f-4ebe-9837-8b5c8da18b78", "value": 519680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648907405, "uuid": "8faa99f3-4449-4b22-b933-07ba2d8568c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648907405, "uuid": "edef1f77-0fd8-4dd7-b5b9-132b9e7a57bc", "value": "IN02672Q0583765NBOM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62874285-b288-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1648905937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905937, "uuid": "e716fdf5-777c-40eb-8fef-e00c2927371c", "comment": "Malware payload (AsyncRAT)", "value": "a2b06ffef153beb2c875df9275e00b38", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905937, "uuid": "50633a74-28ed-48c1-8d52-44769f845f0c", "comment": "Malware payload (AsyncRAT)", "value": "8c3410c96a1065404c257c0320a2a82051ee1b1a707981abdaef11f88f5d77a8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905937, "uuid": "5b9cf2d0-2f22-4c40-a307-c0c0e2576639", "comment": "Malware payload (AsyncRAT)", "value": "914b4a07defe886f85ff093eaaa3f863392f2233", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905937, "uuid": "0cb59fe6-f964-4e34-9f87-038d294956be", "comment": "Malware payload (AsyncRAT)", "value": "79b24788965e689532e8ac0259ca6943e6693e23641746dc19a8d1eede1d6248b8f03f55ba4f08bbcc31bfd8c5b21901", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905937, "uuid": "e0eab856-1f66-49e5-a2f8-115117d733d6", "value": "T118050285DE241236D57204B06467E5ECEA704EF52E6AC1BF03F53BC7B9712B9A136283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905937, "uuid": "f1b555b7-682b-4f7f-8a91-925d4f74c42e", "value": "32c5de998b5f069b26c94c8143b13c06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905937, "uuid": "84e9b83e-c52b-44af-896e-28dd4d19c534", "value": "24576:ED9sYnCGt/z25kZK9HZQEqFB2A5U7udmyWG7HC8BVLwE:ExFb/zkkZKlWDSASkmyR7i8BGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648905937, "uuid": "28d48efc-0a31-4751-8f57-2a26df860b63", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648905937, "uuid": "3b59cb8f-1e84-4cab-9ca4-6b638b349143", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905937, "uuid": "eab370f4-9d53-4166-bb8d-afe51b9d33f8", "value": "a2b06ffef153beb2c875df9275e00b38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "161be72a-b23f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648874456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874456, "uuid": "b4566793-a749-438a-9fec-98a8a461fa15", "comment": "Malware payload (Mirai)", "value": "7e995e59c660ddd0f35742f6a8ff8b78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874456, "uuid": "015d2ada-848f-46a5-94e8-3e3ce9e83c77", "comment": "Malware payload (Mirai)", "value": "8ed985990da073a2e6196a1a43feef422191d72649db7432391a7216a34e3835", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874456, "uuid": "6d37749c-bdd8-4c6e-a6dc-5df2750608e9", "comment": "Malware payload (Mirai)", "value": "2be21b7f9e9e63dee90fdfb1ba019f67185648f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874456, "uuid": "c577ee2c-dae0-4dcd-b010-0bc91205fe0c", "comment": "Malware payload (Mirai)", "value": "742111e8ff7a693fcb73babe830412f3eac42318a6cf474d3e70ae90e858111e577dd277474b74d04db018f64cb72ec2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648874456, "uuid": "1695339c-4cfa-4249-8bee-8eaabcc5e686", "value": "T15A83D70ABF610FB7D85FDD3749A91B0228CC554B22A93B767930C928B64B24F19E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648874456, "uuid": "7e8876bc-8218-47bc-bc7d-1aff484c7efa", "value": "1536:B5nFmqc0m7GZ2ifkwao58fzGlPmzZxa1g0Ca1G:B5n82m7PXv2mzAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648874456, "uuid": "5382ef78-8bb3-431f-ae9b-098ff604ad01", "value": 85612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648874456, "uuid": "dd029d1d-7acf-43c3-85fd-99e78ee91b50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648874456, "uuid": "1cd59956-53b6-48d4-8dd2-b8a4f7fe3bd5", "value": "7e995e59c660ddd0f35742f6a8ff8b78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85666ef8-b288-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648905996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905996, "uuid": "3a233ef3-1499-43df-a6d4-f3658cba6d08", "comment": "Malware payload (Mirai)", "value": "1bb32f5046cacce36be3cace15aff47a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905996, "uuid": "2495af53-7eaf-4c86-b78c-add7314d9cc1", "comment": "Malware payload (Mirai)", "value": "945114a163390cfde70afb42200cef9671807f6213789aba47e7d3f3a7636b7d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905996, "uuid": "d16d3cbb-1c28-4405-8b42-60c250d6064d", "comment": "Malware payload (Mirai)", "value": "73fe799f70f794f82df4dbc8194fd5233dc4e539", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905996, "uuid": "258ed74b-765c-42d7-a800-fca3fe8e9618", "comment": "Malware payload (Mirai)", "value": "f3a165c96a38f02cfac47c08e453d26b552a75d31582cfe9d6db6d9c13f828e5d5582c9ee7464ed0844377ff66a11148", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905996, "uuid": "d8c27ae1-f68a-4cb7-8d86-f634a20ba0aa", "value": "T1C8C2D09EE5267A89CFED4F3DA05D17911E06B5E273C66F0A07545908EB9CF1F3A0A024", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905996, "uuid": "c0781322-270d-44fe-a68d-35fcce0965c0", "value": "768:CpIR6RcMHX7pPL618+PlMK7gf+Sk4WMPH:C0MHX71e18qlHC+lGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648905996, "uuid": "64c784e7-b46a-45f6-8dff-9edf3946f4aa", "value": 28132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648905996, "uuid": "b21934f1-6178-443c-b824-cd8ee6283181", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905996, "uuid": "16e9ceee-dd54-4a81-bcf4-333ba33ddf07", "value": "1bb32f5046cacce36be3cace15aff47a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9911c022-b261-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648889279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889279, "uuid": "0c879ef9-4bf5-4233-8d88-f2ab0ffa8c93", "comment": "Malware payload (Mirai)", "value": "72b70fb5c87953d2101a70c8f37ca8b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889279, "uuid": "7bd8ce26-4a23-470b-b68e-a96e2cf20eea", "comment": "Malware payload (Mirai)", "value": "9462025b99f4f8f3ea767d181fcc33262a4a2abe0d136232d9ba85f9c0ca8dcb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889279, "uuid": "1d7fd1a2-08ee-4f45-9116-b9e7224bbf4b", "comment": "Malware payload (Mirai)", "value": "a3c13e56335692c4ffd38ed03c3decd94f30e5ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889279, "uuid": "77571e84-b68f-48a5-8feb-37089b0d3387", "comment": "Malware payload (Mirai)", "value": "64e152ff915813872379a2babd8a628c315f100cb8bf6b5bc8417ff194bfe0982533defe0d54a8f24fa9937dca76440b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889279, "uuid": "0c8f0e8d-a61a-42e2-ac59-b1e37974d6c7", "value": "T1E4D35C46FA408B13C4D5177ABA9F424A33229794D3DB73068D285FB43F86B9F0E67906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889279, "uuid": "81f5c8f6-93ba-49b7-a8b8-422296ef4569", "value": "3072:J6VhFG85GJg9MA18Ruqr0hKxqRngriYFM/9uDop2:J6nFh5Ig9Me8Ruqr00x1riGM/9uDop2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648889279, "uuid": "f8cbbe09-acbe-4e10-bd9f-bd05c6d34fcd", "value": 135676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648889279, "uuid": "f8d71773-80a9-4d18-bc0c-b4a89e1e0969", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889279, "uuid": "98fe1252-a4c0-4432-81dd-a35bdb980609", "value": "72b70fb5c87953d2101a70c8f37ca8b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a221514c-b28f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648909051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648909051, "uuid": "f8724680-107f-4220-a522-18ab5bf84b91", "comment": "Malware payload (AgentTesla)", "value": "9ebee4360ab2d20026f1239ef23cb242", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648909051, "uuid": "b8bcaf7d-ea4a-41ae-9ce1-b59a579c75e9", "comment": "Malware payload (AgentTesla)", "value": "997777103beb79d540fe2d758c2183107f3468889f9bc1d96bfd08db19dbb9c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648909051, "uuid": "6d7f706f-0b9c-41e4-b4f7-1bf33d88f8e5", "comment": "Malware payload (AgentTesla)", "value": "466939b2544a3cbb7803fe46632ca5adde77cd86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648909051, "uuid": "d2cff256-eef8-499d-980e-531d45b45e4e", "comment": "Malware payload (AgentTesla)", "value": "84b917ef8b8ad09ddda966dbcb2503ed3e3a881d8fd9227b7722964f46c1dd510d3f7834818a864323c03fd5f3c32a82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648909051, "uuid": "72230932-56b0-46f2-ae15-2b6ef40ccae8", "value": "T117C4F12E7B96C913CAB856F641D2411103B2A34EB773C79B2DC422CA0E623E76D457DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648909051, "uuid": "b76cd2a0-8135-49db-b698-82e082291e52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648909051, "uuid": "348ae91a-3a44-4ce2-a303-d259c6dd10d1", "value": "12288:x2iD3rUYVMfPa6M8APmfIt1uV22LLZwWXyqMUylRsJrvq0V:5D3aX7M+Ite24wqxylRUDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648909051, "uuid": "345ea79c-b6c4-4dc4-83c5-a806fca102e2", "value": 584192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648909051, "uuid": "e4b1b4b0-7ba3-456b-aee3-51d88b6acb58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648909051, "uuid": "ff11587e-61eb-4960-b66e-7672bb863f0b", "value": "documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45dd7cc0-b2b2-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1648923928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648923928, "uuid": "7ca971ac-8d8a-4273-b636-66a56101bab7", "comment": "Malware payload (njrat)", "value": "9c6a24646bbdd2467d790c9bcff8cbca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648923928, "uuid": "abb0b724-705c-45b1-b00d-b9c7ecc41b48", "comment": "Malware payload (njrat)", "value": "9c13a5754aab8c2d51f868d9f7b98b8c9aeab14596061e65f55d696cdc34ba9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648923928, "uuid": "e56c5f4b-3cbc-4f3b-96f6-472a9d947d68", "comment": "Malware payload (njrat)", "value": "a6458ee40c01ace26c3d18f797952073445a3dd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648923928, "uuid": "fa44bd16-d66d-47e8-8fdc-4bc2fef9f08c", "comment": "Malware payload (njrat)", "value": "e7970edd5925ca92d37068bfd4dce2f70eefe235e1264ad85acf08587c8d977b2803d6c3e502155f9393c83626c2695b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648923928, "uuid": "a6f147ba-8db1-41f1-8f57-f084165ced3b", "value": "T11244D78DB694E175D5FF8BF1B4A2B2890B71A017A802D30F99F114D94F73AC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648923928, "uuid": "712a2c52-3ffa-4f22-a710-aeb7a29ca93d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648923928, "uuid": "5548875e-fced-4749-9cf0-3d7b8cd9b691", "value": "3072:x25EFop3b25EFop3b25EFop3b25EFop3b25EFop3b25EFop3:xkXkXkXkXkXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648923928, "uuid": "269442f2-bb0f-46c0-b53d-5af8d7ed3b2a", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648923928, "uuid": "05fe0527-63a2-4fff-98fa-efe819422852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648923928, "uuid": "bbf0c45d-279d-4465-b96b-307936e9674a", "value": "9c6a24646bbdd2467d790c9bcff8cbca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de186ce9-b238-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648871785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871785, "uuid": "3d77712e-30e6-46ae-84d3-89d5ad780016", "comment": "Malware payload (Mirai)", "value": "9a505e16dca042bee563b3eac38da224", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871785, "uuid": "01b72130-8148-4f09-b184-319bc621ea54", "comment": "Malware payload (Mirai)", "value": "9e134e869ff7c90e898d3a65cb1192b5bf0303ab5ee004dd9c878804da7a5d5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871785, "uuid": "e92f5512-21f3-495b-a703-b4ffb16ef648", "comment": "Malware payload (Mirai)", "value": "8049a562c7634428a111664916ee9b7b614f134f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871785, "uuid": "bed9852a-2f8c-4b76-bb73-dbe3b2063d27", "comment": "Malware payload (Mirai)", "value": "44930099c286863741f7a09f6eac1c19be9caad80e1d7bf9029ec68111e703228dfd034181a912c51c06092663cfe2ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871785, "uuid": "78ed8a67-5dd9-4767-8ccc-4f9f8eca57f8", "value": "T10993B509BF610FF7ECAFCC3749A92B05258C641A21A87B76B934D818F64B24F15E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871785, "uuid": "e03d855b-7021-4b20-9140-1d841f44aae2", "value": "1536:qZhUDAVnFKZT5ux2Er28B1Ty2h/leWzxt6QGMdNbPKs5hKXIwspIREfnvZvciAp:4hUDAVnFKZT5ux2Er28B1Ty2JleWzx8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648871785, "uuid": "9407fa73-6a7d-4af3-a590-a44f3db0e4a9", "value": 96584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648871785, "uuid": "5d9ef1f1-8a1f-4346-96ef-ecda4259252b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871785, "uuid": "b55000a8-b070-4c4e-b5bf-05d72a57f8a3", "value": "9a505e16dca042bee563b3eac38da224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5e0235-b287-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648905577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905577, "uuid": "910bf513-ed42-4bb3-b461-f98e5b879bb7", "comment": "Malware payload (SnakeKeylogger)", "value": "6bf25554daa85583ccf282a9327d09ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905577, "uuid": "daf983ae-5d30-4578-a04f-f13880ea968a", "comment": "Malware payload (SnakeKeylogger)", "value": "9e80ec95e0c34ecbaa813cc8413274da22ca18eff3db9214a289cdace657557f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905577, "uuid": "74c60b2e-5c11-4e34-9925-7af3d85b3c1d", "comment": "Malware payload (SnakeKeylogger)", "value": "f1166c745b0c0891b978ff29c7cc9050944fd63b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905577, "uuid": "9ba67d0f-aca3-4bc2-8cad-fe7c3c0377bb", "comment": "Malware payload (SnakeKeylogger)", "value": "c3d366876f0a72c4f31efd0742a97a3c0b72697c71e4fa86ca09bd178264712522245d0577e72c943a49b022b89eb872", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905577, "uuid": "09688ef3-b217-42aa-bc92-331d3825c390", "value": "T1A4C4231D5BF84FA2FEF32B718992A2B153F339A86D91C05E1F90907E0AB73516442723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905577, "uuid": "abcf0c77-7510-4ca7-9f3a-8327c6202de8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905577, "uuid": "7b84c864-dbc6-477a-a984-716ce3ffaee4", "value": "12288:GfWD+0w2Sd9sLVcAbsckncLNF8BFUAPPmTpARl/fwJxb:ki+mSdCJckkncz80APPtRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648905577, "uuid": "d40ef291-f74f-4d0e-8c94-449c5ce6915f", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648905577, "uuid": "7e3dc26d-ee70-4981-91ee-06e6086827b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905577, "uuid": "ae686f7a-0371-4d49-a855-06aa67314de6", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16302d65-b28d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648907957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648907957, "uuid": "7c9587db-3d85-45ab-b596-05e4a0e8addb", "comment": "Malware payload (Formbook)", "value": "87b64434115f013c293c693e97adc3b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648907957, "uuid": "76beccc8-3f43-4f88-8f4c-12d6654091cf", "comment": "Malware payload (Formbook)", "value": "9fd0d61928b1ecb3a3c549211852f90d77c2385d61fefb41cfee90b3e02a9909", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648907957, "uuid": "8ca44e21-656d-4bec-a768-8bab0dcfee16", "comment": "Malware payload (Formbook)", "value": "dff7decaa8e58e013ed9d009a425a3e654077e12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648907957, "uuid": "c0c35041-a7df-44bd-8c88-7df86a99aa6e", "comment": "Malware payload (Formbook)", "value": "20844716b56ce650e33b2a4a477c70c2e097283156541105452cf75d2ef2120d20d23056292f28e73002487f64774d0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648907957, "uuid": "ac72ddbc-fc21-41ad-b536-4ba3fb6c7761", "value": "T1ACD42344BEF5FF71D7BF2D3618B51A009BF3BF994931C42C0BA2149541B92A14893BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648907957, "uuid": "d6f98575-945a-4aa7-a092-d3a8424a4477", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648907957, "uuid": "0c058e2f-4449-4a41-bddd-a3890be85032", "value": "12288:WFwa+AaF2bX3dOY3j+ZVu3rUePosdk8cJbMD5sV5xRC:cmAawbdt+ZVu7eAjSbMDqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648907957, "uuid": "6b242a17-0f52-41cb-9570-0443f64afb0f", "value": 601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648907957, "uuid": "edc6c3cb-108f-46b3-8e6d-9656ff1e35e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648907957, "uuid": "93640b46-8b12-4b3b-beb6-54fd1026dcde", "value": "Shipment Details - Couva 760P - SO 10169195.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05e3811-b287-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648905719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905719, "uuid": "57f5ae0a-8e51-411d-a3d6-b9b2f3adfee2", "comment": "Malware payload (RedLineStealer)", "value": "27cb278b3c6ba67beab82b33024ffc8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905719, "uuid": "0a10dac3-1e28-4015-a698-afd2cc6c9fcd", "comment": "Malware payload (RedLineStealer)", "value": "a3b1ba80a85e48b136560d2e7794b6d16d391944d7ef15c4acab9a8f324d5fc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905719, "uuid": "8cc8cb30-e947-4213-8f41-54ca0e91aca1", "comment": "Malware payload (RedLineStealer)", "value": "c83ba580c5d68b2e065e7d2fe5b8166e28ddd043", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905719, "uuid": "8d7c117f-34aa-4830-a016-708d0697aa7e", "comment": "Malware payload (RedLineStealer)", "value": "331dffdd46fc6ceb8f6b1928773f495141280b383086d70d33d704db01a8ec801ce85625ccd209fbf49bce165a6b369e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905719, "uuid": "ccd7f1bb-99a5-497c-8d18-aed658bf1fd5", "value": "T1748523A3B919CC48D99F18331D45F96006717F162934CA0E69E17F1ACCF1B8A6E89F1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905719, "uuid": "bd9c753d-8c8b-49e6-82ac-ae9d24f94d38", "value": "210a0a09c9e8748fa0653b54e3ff9b91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905719, "uuid": "7b69b0f5-49aa-4abf-90bf-49f8ac1c06e5", "value": "24576:/Son/hAzFbvT4vQvjvZv5IvaXvPvtvLeRmnaoW1OoeJXg3rOewNu+4Brfu+LyX1O:qS/+yWTg3rOed+4Br5ylBzRjpt1FWmJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648905719, "uuid": "e38ba39e-efa8-451d-b32f-bd1ffcdffc6f", "value": 1755472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648905719, "uuid": "a5fe568f-56a3-44dc-b470-4de2660f31d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905719, "uuid": "6dd2b8e7-1de6-41ad-8181-76611107b47a", "value": "27cb278b3c6ba67beab82b33024ffc8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ff933d-b23f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648874432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874432, "uuid": "25b5cb63-7268-4595-97e2-0b0403fc9619", "comment": "Malware payload (Mirai)", "value": "4282e9d4c1da3f323fe3c24788992948", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874432, "uuid": "b479c90d-b731-4d1c-9b49-6908bef6a33b", "comment": "Malware payload (Mirai)", "value": "a4e1df09ee6eb6895316541c4bc22ba0660e68e702e3cf9a425a6b04a5b18a51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874432, "uuid": "ffad32fc-6ee0-496f-930a-050fa0aa52fd", "comment": "Malware payload (Mirai)", "value": "992b67a3965bc13d146370a8ca2cb22b666a4581", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874432, "uuid": "6b9d9a8e-d674-41d9-ada1-1e7f7a2ed96d", "comment": "Malware payload (Mirai)", "value": "41b9d4d13911875b865fbd51892ee2d2ad4f162d872e76db26d6b7b4e14e6cbe76784f81437b4debe5c3aaf362780a54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648874432, "uuid": "7e981d2b-9fc1-4337-835d-1fa05b9b44e6", "value": "T16A633AD5F401AE7CF48FDA7A851B0D07B63063815A930F23B36AFDA76C731949922D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648874432, "uuid": "016ced98-4c9e-406c-9afd-cbd7c80eebd6", "value": "1536:DgZnFbd9fW5Ih2RbidfGfJ3118KOarAjJq6ehTOjKV:DgZF7fIIhybikp1Wa96IL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648874432, "uuid": "049ffc2a-55a3-4cb5-a452-4c887e66f6e0", "value": 67628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648874432, "uuid": "1ff536fe-a623-4121-bd21-09307a7da02b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648874432, "uuid": "78ba1a65-f62a-4c22-953d-95b31d10306e", "value": "4282e9d4c1da3f323fe3c24788992948", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a83d6e8-b288-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648905790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905790, "uuid": "6f083a6c-3405-46b3-82a7-b3a6a2f94da5", "comment": "Malware payload (SnakeKeylogger)", "value": "944a4746f7c742e91f39b146c7a152c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905790, "uuid": "ffcb5553-5497-43e1-91b6-19baafb2ba77", "comment": "Malware payload (SnakeKeylogger)", "value": "a51e862ad7950b242cce5ec0cc8734124186c16f506870ddd8ba41057ec36041", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905790, "uuid": "e221cd81-2e84-4a4b-b59b-52da93745880", "comment": "Malware payload (SnakeKeylogger)", "value": "a19e2c420faab044acf7c6faf2bfa6f105afdca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905790, "uuid": "0cc48d44-ebb6-494a-a947-2fe7cf6dc668", "comment": "Malware payload (SnakeKeylogger)", "value": "df4eff430f1b9aa06863cf4f32fd6176497a1b6cda22d6951d183d8c1faa6e4308fe56797776459702977499c0d31a62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905790, "uuid": "879d63ba-0fd8-4995-b857-da57d52db283", "value": "T12273DFC0ABC0D5A2E5690271D6A6DBF053328F28E02ACF1F10D17D2B7E617979E97620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905790, "uuid": "a4903095-7688-40a3-b7b9-f656aebe528b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905790, "uuid": "733f6c22-8029-4abe-8b30-a089b97fdb1d", "value": "1536:NwblaXlvAPBGLX6cMxkWFUzaR5IyS2eNXeLan:NwbgXy5GLX6cELQaIVv0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648905790, "uuid": "6210692a-e266-4220-aea9-b7c824b7a591", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648905790, "uuid": "a165881a-9d72-4db8-9d29-a23d692c8988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905790, "uuid": "fd4b077f-1810-438b-a0d9-9f1de35b24b3", "value": "PI- PI04522748-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9cf026d-b238-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648871724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871724, "uuid": "ad13a1f5-e7b2-4dd9-807c-5391c09bb214", "comment": "Malware payload (Mirai)", "value": "32b54f29b4a6989bb8a6cd08b388d30d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871724, "uuid": "e3b28f62-a6ed-4c7c-8b2f-8fbdaa7315a2", "comment": "Malware payload (Mirai)", "value": "a8a384da52aa4a350063dd9a0c1b1dc77e00b019222dc6acf4d194edc02f2164", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871724, "uuid": "f9928da6-c4bd-43b0-86cd-a185fa7c4fe0", "comment": "Malware payload (Mirai)", "value": "bf7273449b7dd7a56e9a76f27d39c47ccf2e0b34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871724, "uuid": "b1eaae38-7df2-468d-8ef8-9380cebb6810", "comment": "Malware payload (Mirai)", "value": "c3cc015a79f0e70e45a5d6359e7d89b666ec3a1ec840ca0f017a7dca6884ce5383c6e4ff7fad4f3af2d1ccecfa734ab7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871724, "uuid": "53e12c22-28b2-404b-80ec-43ff1936a8e2", "value": "T170634B42725C0E47D1A61EF4253F1BE083BEEE9021F4B685264FEF468635E735189E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871724, "uuid": "77ac2fec-cf32-4964-b03d-aa5aa0df4674", "value": "768:lt5Q1kKvYijidD+ECOgBomRPorMXycm6Kse15nryZorC5CpupVtKRMwWG0VlrJ6y:1Mvu/gjBlnePGkpylVvUIKzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648871724, "uuid": "31be455d-4263-429c-99bb-82cb0110effc", "value": 70876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648871724, "uuid": "389fc513-b254-41ab-ade8-7e1d5a9bf1c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871724, "uuid": "0b4332d9-8144-4b44-8683-270aee47e7b1", "value": "32b54f29b4a6989bb8a6cd08b388d30d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d931cb-b2a4-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648917945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648917945, "uuid": "795776aa-6772-495e-98bb-8bc57f0efd3f", "comment": "Malware payload (NanoCore)", "value": "59afd561965036dbe826b753a5c17e45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648917945, "uuid": "a2bcf7fe-524d-4565-aa63-66bf71a9e470", "comment": "Malware payload (NanoCore)", "value": "abb93b35593a9344114aa182139d53d18f667755bd2bcb052478d6f533cba4aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648917945, "uuid": "1295d4cd-8de9-4847-ba34-9cfbbdab3924", "comment": "Malware payload (NanoCore)", "value": "44112cd7a656549c75681b7beb5e86ec1df38d17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648917945, "uuid": "3abf8cf2-b3e0-47a6-969c-df436e779944", "comment": "Malware payload (NanoCore)", "value": "c5801f4a1d2ffa64ed3417678f9270e5b12e324bcb4a6cdccfdce487f1ecdafcb010324c784ac06eff3336e7e0be3014", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648917945, "uuid": "99b88382-52fb-4783-84f2-74405a48c066", "value": "T154C412056B9FDE2BC56D0AFE401467F343747A16A4CAD7863EC025FFE8223816E89355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648917945, "uuid": "d2db6175-516e-4b1d-bbe2-f928cd8d3238", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648917945, "uuid": "1ebf6de6-44a8-4380-9ac4-762569693817", "value": "12288:OVMvSBr6LbdlZqZsCcyWX5CdXrAtO9VxHfEHm6fwvP1Xe3x20jo2q9cQZEj:qdBWL5l2sl35CdzVCm6a1O3x22o2acQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648917945, "uuid": "06db25e1-71e6-4d0f-a37a-7a5e6a6c1d1c", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648917945, "uuid": "8aac041f-7250-4bba-8d31-dcff487fd089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648917945, "uuid": "c5ceb2e5-86b2-497a-9462-7c9668c6f413", "value": "ABB93B35593A9344114AA182139D53D18F667755BD2BC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4620b467-b290-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648909326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648909326, "uuid": "a0c392fb-c47f-4c4b-b628-88cf0607d40c", "comment": "Malware payload (AgentTesla)", "value": "fea1eea8bb4dd43a7a9cc4d0c41b4a93", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648909326, "uuid": "df719c7e-7df1-4ebf-b5ec-67895b17dce1", "comment": "Malware payload (AgentTesla)", "value": "b0230907befa6195dac6680f6803228e483b7e02648af83def42058080c69653", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648909326, "uuid": "13f208f6-970a-40e4-b04f-0ccd72ba1c9a", "comment": "Malware payload (AgentTesla)", "value": "7546a75b8f30690ad9cd2699e7085227b8213db9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648909326, "uuid": "d7e27bd3-fc5d-4c03-907c-0e02c5da6131", "comment": "Malware payload (AgentTesla)", "value": "28a6fd07ab41a8516a4620ef03fe654debf27b74d924d92f5193483a064f578e97da14e9f0937740abc482e515d1d84d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648909326, "uuid": "4cdc3bac-4904-49df-ad12-c07f892ed041", "value": "T1E3D423148EF6453EF8EB1FB12ABAD524233371952A32C45E2E9652CE86F1BB49403713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648909326, "uuid": "174d33e5-d308-44b3-aa9f-9c021bff0791", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648909326, "uuid": "20fc8ee0-8516-4043-bdcc-f43f6c13ea6b", "value": "12288:YM99P3Omk2TZ6y4vdgos75bMzbdEkwTiKz5Ldod1GUwmDocKll:J1TZf4vbslbMnObiKzo7GUFDbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648909326, "uuid": "c53955a0-87f4-45e1-9a99-8fbab75aa493", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648909326, "uuid": "913abe60-c905-4114-9f5d-f0d75c4a15d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648909326, "uuid": "3b61a367-2d8e-4d01-a4a8-e2b718bcb9c8", "value": "cvEdINc30mJxbsM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "befdf02b-b286-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648905234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905234, "uuid": "29f0d462-5514-417d-95ad-0e5eb5be1355", "comment": "Malware payload", "value": "3503aefbb9bd9c284d671a9124a4b8dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905234, "uuid": "6155b74c-d4b3-4174-931e-e21a59bec8b4", "comment": "Malware payload", "value": "b212f24dc2e4f17daaa2cbdf4cd6a66f878a6852d84be4c314bc2ea772460aed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905234, "uuid": "697a51d6-4e2a-4ab1-ad75-2cfd9c7dbfa5", "comment": "Malware payload", "value": "222a3d002ccd2191226dad5b4116e70d07972ecb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905234, "uuid": "48d14535-8022-45e1-a5a6-8f4b3080b9ff", "comment": "Malware payload", "value": "43ff50ab606d2410588f323279975579dde6af94202716f1343641dd358a9203b39efacbd13cb6dcedd846daf85c1509", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905234, "uuid": "3629a26c-7965-45b9-8e6d-22f4d52a036b", "value": "T181F3692FABC5CF75F26E773590A24824133DAC16159BE38B605C3DF4A8B13C4E46266B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905234, "uuid": "e0e93dab-d1c2-4418-93f0-d77d8062083f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905234, "uuid": "5c62f673-eb84-4b1f-a2e3-6928aad8a4dd", "value": "1536:Cw1xdyllqlo0zzpGWCVTFskHs3q8lE1Q6OAI55ROy9DXwCJsl1TqiFX/pn0jH0OI:C4rv/sTa0s3D5b9DXwAsHTq0xn0r2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648905234, "uuid": "991589ce-5bbe-4095-a79b-011bf26f9720", "value": 158208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648905234, "uuid": "8f7d728e-281d-40c0-aeb6-fd500282ce55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905234, "uuid": "1c4fc6cb-73b4-4db4-bd2d-2729ad092b61", "value": "shipping_documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eec1380-b2b5-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648925151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925151, "uuid": "65c400b1-d6dc-4f6a-b1e6-2b9ce5e61e12", "comment": "Malware payload (NanoCore)", "value": "a72435b5e303a3638fc01628fa8b320a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925151, "uuid": "c5125457-7369-447e-9af1-6ddcaff4b3dd", "comment": "Malware payload (NanoCore)", "value": "b2d2cd90962ed5916301604f6f423263c8f73a45dadaa4f7065feb662a9b6165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925151, "uuid": "7a0f0eb0-3fe1-494e-9310-4fb0a4ddbcb4", "comment": "Malware payload (NanoCore)", "value": "e2cf12e54aea75aaf3a84ca5b97a90f2da512df0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925151, "uuid": "33d2fa16-318c-4561-94c0-cdeba9bac5a0", "comment": "Malware payload (NanoCore)", "value": "c68e4ea85dba32676518de6233d401e3b8b2165853f2f415c520b923362edeb27305648b37b0237c44b0b8b042b4b60f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925151, "uuid": "1eb9889e-3c27-48f7-a040-5480801455c2", "value": "T164742342D3D2E5B3CD8707399A7B8BBAF3FD7080025658670F9CCE776EA25410D296A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925151, "uuid": "e6bc9389-1cbd-4ce4-ab18-662f8943ebc3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925151, "uuid": "c564f683-1bd5-490c-aec6-bfb28bfe9926", "value": "6144:rGiIKDmhrnuWVtVkNHG0DuQualEoAhe3SWYVgWv9zcF9DD563vaKa0j:47VtKPuQide3nYVnlsDVwLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648925151, "uuid": "60a16af2-9028-4ec5-b04d-efe641b5a6cc", "value": 366748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648925151, "uuid": "08d5baf9-9110-4cb9-b0c3-ca213ab5e4a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925151, "uuid": "7fe65a74-9933-4697-af23-b5cbee8a023a", "value": "B2D2CD90962ED5916301604F6F423263C8F73A45DADAA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84e7cfd-b23a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648872608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872608, "uuid": "1bec7889-8c82-4773-a051-a1564ba13bd5", "comment": "Malware payload (Mirai)", "value": "67e769b814bb4b68b3091df1906860f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872608, "uuid": "44dfa340-2ac2-4b7d-991b-60112666556b", "comment": "Malware payload (Mirai)", "value": "b4ae5540e2486e7eb3358d854067bb3cd478830f4802ac9a7124fba32748e59b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872608, "uuid": "e177d588-5483-4e81-935a-e7ca236aab36", "comment": "Malware payload (Mirai)", "value": "0ebeb84da1a123659ec1d028e169e8d6b1e23ae8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872608, "uuid": "9a8bc9eb-59a1-44bc-9230-73873c160e93", "comment": "Malware payload (Mirai)", "value": "3bcfdde6697424374174f559decf7d83aa0ca35acf34646c4f3611febe759bdbee657689c0002f24da0bb5f29adc421b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872608, "uuid": "1748f3e8-94f0-4983-b089-472e3283ffda", "value": "T17664F1CAFF11AD3AE9C006767AAF074DB3B59BA9C3C3F150F250C61A39991859F76084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872608, "uuid": "e0e11a6b-3c7c-47ec-8279-aa6ba5cf0cb0", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xiodsKqqwPa5POdOQ33Q:p3lOYoaja8xzx/0wsxzSiIsKqqfPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648872608, "uuid": "c9772808-4ae6-40cc-9b5f-1f7ff7a0fddf", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648872608, "uuid": "b59983de-777f-4fdd-9f3d-ee969f09fcb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872608, "uuid": "8672e956-97bb-4cce-9358-24dd805e220a", "value": "b4u.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8c3b83-b261-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648889227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889227, "uuid": "75c3b4de-1ad3-4dab-9b21-e1fde80f9b86", "comment": "Malware payload (Mirai)", "value": "79d7c3da55731cd3f3d3ea6b18f509f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889227, "uuid": "deb96856-b635-453f-a79d-628b9ddedffc", "comment": "Malware payload (Mirai)", "value": "b78587af8b5951629cf478e9af1d9abd7b6de6c9030c092afdda254606ce7930", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889227, "uuid": "eca9f89c-6de8-44e7-a7ee-1a94454d0d6c", "comment": "Malware payload (Mirai)", "value": "7ae73e1dc1e38dc14b2b1befd346e4eb39e2b55c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889227, "uuid": "07323a95-c7e5-47c7-ab8e-c29b56d3343b", "comment": "Malware payload (Mirai)", "value": "7de547cf1536f165690a5ad56b4300fbec2f636d147fe05c1522b5a6c3c17ad9f693325372f2dbac970cfc4f6182db30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889227, "uuid": "496ffd06-1edc-4a04-8ea8-c74aaa263618", "value": "T15B438E31D4296E94C05901B8B4388E395F93D6C1A7931EF25BD982B2604FDE8F909FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889227, "uuid": "54017e55-44ff-4978-b12d-485655ffca16", "value": "1536:Iav/teceWsZ/cQfD2IyYx18CrZ45Csqa10j:IyFerZ0UDUkTZ45x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648889227, "uuid": "bc7d98a9-1d3d-43b3-aa87-af32136735f2", "value": 55288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648889227, "uuid": "c9c0ddbc-6085-47d5-99c7-7ae720ebffc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889227, "uuid": "49167f86-e463-4d0f-87fd-077d3d0b0013", "value": "79d7c3da55731cd3f3d3ea6b18f509f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6f2ad5-b289-11ec-8e58-42010a9c0032", "comment": "Malware payload (CryptBot)", "timestamp": 1648906494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906494, "uuid": "7f620bca-4dc9-462f-8ef6-d2ba39e24dc1", "comment": "Malware payload (CryptBot)", "value": "3512d6283bf6758e944b61e4d6251ae5", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906494, "uuid": "d18521b3-2225-4e21-b40e-0d25be3330da", "comment": "Malware payload (CryptBot)", "value": "b7d2312b74f57db0109d3ec61192e406efed2b50d81413326251ca0bd22dbec8", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906494, "uuid": "025078d4-1bb9-40cf-813a-1f4129868169", "comment": "Malware payload (CryptBot)", "value": "62f3ec488abe0e679e8c2ab815153789945b49dd", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906494, "uuid": "2627e126-2ebb-407a-8504-fd4cd1f97c35", "comment": "Malware payload (CryptBot)", "value": "e2334508bfe744791925776bb222f477a031ea59d1bba63bc5b39544a41271c05481611fee7b6bdf9d1e92234aadb96e", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906494, "uuid": "e384d6eb-8ff4-4d2a-8df7-ed770dcda0b0", "value": "T1D0D533AE405B8171DF1A5F3BC37CBBC92A4036F30EE04950F2AE6590C1ADD5E5AD80AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906494, "uuid": "8cba10cf-2528-4862-91fd-4bf7af283a05", "value": "6985c05c81106254b2fb2149ec38edcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906494, "uuid": "86a06c10-cc96-4c6e-bd7a-ebe277b06d0c", "value": "49152:KE2Cbo7XZxgHxh421mol4LD8m4LOCkjF/e2YWOaLfrh1fP6tEgFZJyRUI/tXM:GCoMf/1molm43LOPEtWOaTrvCtPH4zX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648906494, "uuid": "5da13003-e430-4481-84f1-ebdbc144d137", "value": 2801664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648906494, "uuid": "d30ed6b3-f476-48d0-9210-e9906ebac73b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906494, "uuid": "bc9717e8-d7bd-4ace-92d0-bf4d4df6882d", "value": "3512d6283bf6758e944b61e4d6251ae5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7496ff6-b294-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648911341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648911341, "uuid": "54f3b6f1-110b-48bd-8c27-f80e33989455", "comment": "Malware payload (RedLineStealer)", "value": "2c43cb4d0c878ad5fad42406b985219d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648911341, "uuid": "7b5169de-575a-4498-82a7-32c4c1f3fbb2", "comment": "Malware payload (RedLineStealer)", "value": "bd0c638e802dbc4d67da606a05662838ee58153f317b869c8ada73eeb008e1e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648911341, "uuid": "1b86a08c-cc6d-4a4f-9a23-45d69a198356", "comment": "Malware payload (RedLineStealer)", "value": "48d7354bc25164d9d7bbcf53625ab99f9c986c78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648911341, "uuid": "d210e3de-6166-40f4-a275-7b7802b59920", "comment": "Malware payload (RedLineStealer)", "value": "2253a8e2ad1a8c1741b581e44f7f677e332202f0ae87c4b9529216086aeb34745954077226d60f37b8625c04bafff766", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648911341, "uuid": "3d8b7ef1-51e1-44bb-a4f2-3ca9699ee957", "value": "T1A7645A2439FA5019B1B3EF655BE4B9DADAAFB7233B03945E105203470B23A81DED153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648911341, "uuid": "b3910fab-f441-4f5e-bcd7-949523772ac8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648911341, "uuid": "fa286826-390b-4a08-994b-73bd95f7fb9f", "value": "6144:zO0T6paCUZcaLq7BdTd09mxi8WwRJ43mje0SZEcTdh+u+:h6OZcucBdTd8mxLWuJ436fSZEcTdh+u+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648911341, "uuid": "b907d37f-9d0d-4aa8-a30c-99b26d1cd9f1", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648911341, "uuid": "fc6c1d65-df0b-40fe-b912-dc8c2f18d576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648911341, "uuid": "eca4d53c-e2eb-4b7d-8413-bc3241abadb5", "value": "2c43cb4d0c878ad5fad42406b985219d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed904e7-b230-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648868404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648868404, "uuid": "26cce804-21c9-4030-9db8-02a239d39202", "comment": "Malware payload (Mirai)", "value": "b5585fb7cc6330441e213d82f7767eb0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648868404, "uuid": "cdd6ff24-6cd6-4599-ad81-1363592e478a", "comment": "Malware payload (Mirai)", "value": "befb8dc8054bf9d055cd408654819c1da4d78beaa1241e3cef8d6a19bcf9caa6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648868404, "uuid": "3d5461a1-ba0e-413a-a84d-c6e6c154edbe", "comment": "Malware payload (Mirai)", "value": "eada0a2c7223b25e2aa0e4f50afc6b2afe63f344", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648868404, "uuid": "4437cbbf-65ce-41dc-a0c8-5045e06ab9df", "comment": "Malware payload (Mirai)", "value": "623f3ae02036c2677235a4343027d6e36fda6915ad567b4caaa7fde6474f90cd8594afe628f435b2eb58f71a9ff0b07e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648868404, "uuid": "08b9ca47-67b9-4fe6-b3b3-d1e92ad7e11b", "value": "T1C3535CC1E543DDF9DD110A712077EF729A7AF53F2135DA87D7A8A923AE41682E00728C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648868404, "uuid": "875ca890-474f-4941-81ad-6c14623114ba", "value": "1536:u0vIrWd2je8w6QOFS3j8uwO7vWC1jtBnaxMatsTWK76eZ7Basush3P:5vIrWd2je8w6QOFSz8uwO7vWC1jjaaaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648868404, "uuid": "1ceb07c6-6bde-4b6e-bb63-8f1280bdae00", "value": 66492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648868404, "uuid": "35f1d506-f609-4f57-8f61-0d5f5708cffa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648868404, "uuid": "3c22e8b1-b729-42fd-a8f7-e4442a701b03", "value": "Cronx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f2a030-b2df-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648943435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943435, "uuid": "2cbdfe99-dffe-4f8a-8a08-92d5a0aa945e", "comment": "Malware payload (Mirai)", "value": "91dbe7e4d3d7ebd5331538c2d8f8ab98", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943435, "uuid": "5b1e4481-60b8-48db-aec1-37b5c9946c43", "comment": "Malware payload (Mirai)", "value": "c5b94d6ed9faeafa8fcf22db3e3909a500474f30acd81b8437d950e7449a1e6c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943435, "uuid": "3939079f-0560-4e44-8513-66b55afd109c", "comment": "Malware payload (Mirai)", "value": "a29e8aa2fa37222b56e091ce2a16b59ea1c4d422", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943435, "uuid": "3053c151-f983-44ee-bb45-7deac8b8bf16", "comment": "Malware payload (Mirai)", "value": "8d8527dba0b356f25c7588e408d5562483e2c00562f0e35066a0272a19e22e97fe0b1694833d3f09ef116811b7ed2e29", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943435, "uuid": "829946ec-9f3e-40dc-a697-918af64877eb", "value": "T14293B60A6FA14FF7E8AFDC3746E91706248C651A21A97F75BA30C418F64B24F09E3875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943435, "uuid": "dfddc481-02e8-48f8-a95c-a6f3ec75f6f0", "value": "1536:U6z/AouAjhpEV2CNERNZQj4eTqXl1CeZxsmHfyMSRH6dfV+qZTYuUvNiwsBwVXAu:Ue/AouAjhpEV2C+TQjJETtUdb3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648943435, "uuid": "52f9b6be-d474-4ec4-9eb8-122b7206b5cb", "value": 96604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648943435, "uuid": "dca63148-accc-44f7-a505-8bb2494c424b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943435, "uuid": "d3ae9342-1223-4e68-a990-ceba7b443b19", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1b6d2d-b278-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648899026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648899026, "uuid": "5a19e3aa-51bc-4bb3-a4fb-1d790fde346f", "comment": "Malware payload (AgentTesla)", "value": "ddb67bd4bed7029985e046702f627f55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648899026, "uuid": "01a055c2-313f-43cf-b6e9-e353533c212d", "comment": "Malware payload (AgentTesla)", "value": "c6bc37b9b93e93f39296d39637be34e5146114806c16636e084457b07cc8b826", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648899026, "uuid": "23c3cf08-4002-42e0-b00b-a177bfd9bc34", "comment": "Malware payload (AgentTesla)", "value": "ea61192392e48ddabc76ba3ab737f6bc7853b9f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648899026, "uuid": "5574af3f-15e2-4f52-92f6-a06c426146e0", "comment": "Malware payload (AgentTesla)", "value": "2f67b743f6103757548a525ea89818eed9866f85296ad9b65533de376bc7754ae7dfb4790bd5d007b82759e273d79758", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648899026, "uuid": "381e0fef-4c1c-471b-a886-c35be8f61ba4", "value": "T1F4E42249B4B84E22C3FF47B8A5E2E040A77A95026B41D78CADD531CE5DE73E09782397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648899026, "uuid": "5cc5106a-7a45-40a6-8c8c-9d0fb5c0a808", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648899026, "uuid": "eba2c2c7-4cf9-4f73-9877-a1347892041d", "value": "12288:odwDw/8wKsY3DrH8n7avgseyT8LJ5UgB6fEdmmcZJ/tgKcXGS4:50Ewi3Drcn7aose8M5VQEcTZJXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648899026, "uuid": "430dd793-ceb2-4f97-87e8-5d3842abaaca", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648899026, "uuid": "c5423880-3352-43ce-9a85-2de9b1a3e901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648899026, "uuid": "88f8385e-582d-4338-a666-4d80d8f4e618", "value": "SecuriteInfo.com.Trojan.GenericKD.39407580.7315.16035", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c4ceda-b261-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648889213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889213, "uuid": "302e6e20-61a4-4255-86a1-f36093b794e1", "comment": "Malware payload (Mirai)", "value": "4abdddabc8088841e9dffa3aebbf3aae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889213, "uuid": "fb6bed4c-0ab7-4e00-a8d8-577633a75e7a", "comment": "Malware payload (Mirai)", "value": "c928a90818ad3188c3d59e7dee45c1446064cb833ed77d98da75f46b7b28762a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889213, "uuid": "d242c060-2cd8-415a-873a-e62fd45e05fe", "comment": "Malware payload (Mirai)", "value": "676ad814e5d3a84f5efa5fb6fe641f659a496633", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889213, "uuid": "3fc79551-0257-44a5-a750-2bbdfe81468c", "comment": "Malware payload (Mirai)", "value": "c992dcb7e85131a4dd56450c0d84baa128547787fae5f98db1513a116fdf07c86430b41145ef1248c366bb155010afd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889213, "uuid": "d30597da-da09-4281-88aa-0c870fcf22da", "value": "T1B0530784F94745F6D90B483040ABFA3FCE31D5F91270876EDF9A9F36DA67902920268D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889213, "uuid": "fc8fe933-80ad-4f42-b97a-7cd9a4e4b1f2", "value": "1536:x85EC4qsIfHdCXo96OOCZOywUhkZqq2gKwZ1ZLUF:x8Iq3fHdCXo9cYOywUxpgKwnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648889213, "uuid": "7d8aba0d-6fcb-4088-bc6e-46e39c801f9e", "value": 62320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648889213, "uuid": "5a218b98-beac-414d-b0c7-725d933a79b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889213, "uuid": "2cc199ee-c515-4da0-ab3f-96ead989c5e0", "value": "4abdddabc8088841e9dffa3aebbf3aae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e878ea5a-b2c4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648931932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648931932, "uuid": "6a2f0756-1d4d-44d7-93e5-75c7eae1b610", "comment": "Malware payload", "value": "bd475b5976107d2f71f9c0bf4d055dd7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648931932, "uuid": "c6acc644-68d8-40f2-89ea-b5ed26f6da01", "comment": "Malware payload", "value": "c9c04d4e45eebb92a9ea502dcd47089561d4090ab5820a6b469db195bef709e5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648931932, "uuid": "073c3bd6-7afe-4650-b862-6b030244a7b2", "comment": "Malware payload", "value": "45aec15ffe4b457e815779d63a043bf61cbbb6f5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648931932, "uuid": "51f9ea6a-5770-4571-b54e-8f997f5cf1d8", "comment": "Malware payload", "value": "951cfcd8dd026daad0a2c87b675ebcf95659794aeb4516e4360aaced75733ac25657c28340eedc2d0047f823646d598f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648931932, "uuid": "73bb1c97-a597-433d-9f41-52392df03909", "value": "T118E1AF49D3D3D25CDE0157BA70998CEFF990A140C902D599E9104BE8520FDBA3CAD59E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648931932, "uuid": "0b7a2fd2-3632-425c-9619-6f658204b9ba", "value": "192:ogYjQS8H82ajOafeOLIeXe19OYrZDuKnt1/xKJ4s:ogYjscbjt3EeXGOYrZDuCvC4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648931932, "uuid": "ee141382-daf1-42b5-be8e-e3368acd27dc", "value": 7082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648931932, "uuid": "ee4db15f-53b6-4e59-9762-6771f2239755", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648931932, "uuid": "24250456-01f0-4094-88a8-58c7137ec146", "value": "exportedfrom wireshark", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05dcf08-b2df-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648943434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943434, "uuid": "4d626e20-8acf-469d-a9b4-74541ab1a188", "comment": "Malware payload (Mirai)", "value": "6dfea894247e845d526e610bb92e4e46", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943434, "uuid": "7dbfe9d8-e6c3-4bb3-9e91-1f02da801571", "comment": "Malware payload (Mirai)", "value": "cc26c2bb5a73cb6649256e45ac155478487682abea2b6e36af0e16cddc53bd1c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943434, "uuid": "8378df85-5114-4a73-8aa2-ac430bfe9dd3", "comment": "Malware payload (Mirai)", "value": "6e425419e18d6618b66b9365828b34811710381b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943434, "uuid": "e6be5600-78f0-4a90-a7b7-42d6d46bd4de", "comment": "Malware payload (Mirai)", "value": "e12d0fff29558cc596595215fe37d563f6c10a670dbb46673a45add5bdabed212ec9a8285d1ce3e590145b98c579f61f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943434, "uuid": "857f1a50-bd85-4051-a38a-0b3a1f418ea1", "value": "T1DF93A60D3E318F7DFB9C82394BB74A21A748379A27E1D584D15CEA016E7034E741BBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943434, "uuid": "c13fb125-7912-447a-849f-c0b113e3a871", "value": "1536:TNgoNsSEpOcvcQf4b9/jmgrpv3uv3fsv3kX8ofNBn+7Bp3ALT25VWCHQVS7vJqT/:TmusSEEcvcQf0jmgrRcN+Fp3/VWCHQVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648943434, "uuid": "7d114ce2-95e2-47ef-a0c4-42f1b2512e31", "value": 92508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648943434, "uuid": "65523d2a-c190-4e83-979b-33b04bd29a29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943434, "uuid": "a2def374-969e-4541-90b0-cb7d8a1e905b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9aeeedb-b287-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648905654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905654, "uuid": "179243d9-e6c8-4261-9ca1-53db1ea1744c", "comment": "Malware payload (SnakeKeylogger)", "value": "2f85e5eeb16a14f78d66536c6630393a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905654, "uuid": "17c17c8b-8038-4cce-9e1e-2cf41eea9645", "comment": "Malware payload (SnakeKeylogger)", "value": "cc59449d06914a46b22ccdc201288424dbb193a75b7b96560bd5275ed898cc6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905654, "uuid": "9491e760-1832-45d7-93a9-b18e725d29b7", "comment": "Malware payload (SnakeKeylogger)", "value": "92e52166b646766f0d1bb7603756847242fb5c1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905654, "uuid": "a7dc9a9e-31a4-46ca-beba-b0a16cf18e14", "comment": "Malware payload (SnakeKeylogger)", "value": "ac6747d0d52e4aece8ebdce0b2e0dfac6feddb6c2928ac7d35d77d519ecdaf3f837256e47a9610d86e03b24e43ba7b82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905654, "uuid": "a8b9a2eb-efaf-44c3-a3c1-d35b585a0657", "value": "T1C68523957AB0D519C52DCBBD0034E2710FBF6114A126C75A8EF4BECB3E2678055CAAE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905654, "uuid": "dd6d4207-e326-43dc-bd5d-fddf0c42392c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905654, "uuid": "cae46f3d-215e-4ab7-ad84-9fa7e1ce5147", "value": "49152:8QewXm8owEDt79iZvfIrmzj7Rdxqgk0iBrM://UsZHIyzj7RjqgviBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648905654, "uuid": "e8209bed-4be9-41ad-a5df-d7c915359f23", "value": 1706496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648905654, "uuid": "827c3475-82e0-4550-ac19-767b84de0966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905654, "uuid": "31814d1d-0f56-4704-98d0-b3102854ba6b", "value": "SNAKKNUNU09876546790.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf962cb-b288-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648905982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905982, "uuid": "b8e5283a-fb92-4149-a3a9-471d17e64f9e", "comment": "Malware payload (Mirai)", "value": "d6ae34a0d95b82e62e138a45c014922a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905982, "uuid": "92c33ef2-506a-4003-9387-8a85915ee094", "comment": "Malware payload (Mirai)", "value": "cd02800b747b27a65382132770c77823304404dc0611917a21b423727d058ae1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905982, "uuid": "5f5873dd-0965-43d0-8345-508559b0154a", "comment": "Malware payload (Mirai)", "value": "0fa530275619943014d231cdd560941462129eb8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905982, "uuid": "e4fdfb1a-ccd4-489f-b00a-2d298ade4c46", "comment": "Malware payload (Mirai)", "value": "39f04967b057714c9389453d6b832c3c49cda2190f6fbf6e391eab73d5cff6b1c37275adf39a3f6ddc2e0d2ccada2ecc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905982, "uuid": "76670975-eac2-4e08-8736-e0054f0bd72b", "value": "T154C2D11953291A7BE85E25F8A5A407D2ED370ECF53B6ED066555C1CACE010EC2833EF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905982, "uuid": "2bf1ea2d-78c6-4b15-9fc8-00aceec655c9", "value": "768:g8u9EBqyLsKSwjxmgdnmhnrJgGlzDpUYsl:g8AjyAXKMLNhVqYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648905982, "uuid": "b00b5a98-6c10-42af-b4fb-f1f32d2a066c", "value": 27404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648905982, "uuid": "c26f7ac7-c6e3-4d27-a4db-ca19d4138b1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905982, "uuid": "e6f7a9d3-9f5f-4fa3-a50f-e35f3b1b0178", "value": "d6ae34a0d95b82e62e138a45c014922a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b075ea1-b283-11ec-8e58-42010a9c0032", "comment": "Malware payload (Joker)", "timestamp": 1648903643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648903643, "uuid": "4ef412fc-b185-4003-8593-44b36d2ab4d7", "comment": "Malware payload (Joker)", "value": "c52ae416161303447fd70e7cd24e1367", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648903643, "uuid": "d24c4bda-8015-45c8-88b9-b1fc851063ec", "comment": "Malware payload (Joker)", "value": "ce397a51a7cf16d21ebbd82540ab2fd32b140bdf5e73960b189744ecd5f5a1a3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648903643, "uuid": "81c8100d-5919-49e7-b716-5315da6b33d5", "comment": "Malware payload (Joker)", "value": "427b79eeb13edb3215eff7d056a705acc485f560", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648903643, "uuid": "ca8ad3f1-7aa2-4efc-8b07-5ac452b7698e", "comment": "Malware payload (Joker)", "value": "03013e638a438ac96f8cb9115705854d2cd0499e5cba00eec6a57dde2f5305ced7bcf62e1166fec567e4d0ac53623574", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648903643, "uuid": "8e0888aa-8235-4ab5-b12f-db31f43c3865", "value": "T13E062247DB18A5AFC5B75A374A7A436113174E6506C3EFD32D48B228097B9C02FAAFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648903643, "uuid": "e5ef7432-9d22-4ad1-bda6-d5e1cd890af1", "value": "98304:4z3XYMDW5wUoY3J6iYqXbyHAdbi8af2yQjPH5nNL4uZxJ+:4zHY2WKYQiYubx82lLH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648903643, "uuid": "5b7ccdb1-a0b3-4ca1-af3d-ebc54e37595f", "value": 3968218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648903643, "uuid": "c1e09ac8-6784-41df-9b48-062fa812689c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648903643, "uuid": "5e1442fa-0813-49df-93b2-a8309a3aee44", "value": "Heart Health.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ee36f5-b288-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648905975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905975, "uuid": "7dcff33f-a28a-4d21-9139-0d275ab7d786", "comment": "Malware payload (Mirai)", "value": "f0cee7bfd2bd8c50b48c002e614a1b4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905975, "uuid": "9e9d6750-e24c-4d36-90ef-5807ab74976e", "comment": "Malware payload (Mirai)", "value": "ce9466edc97d33755c3aeda7a4047846ad1d9e9138fd0bbaaf0899caae285798", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905975, "uuid": "e41df723-acef-479b-9279-9843b01fe9ec", "comment": "Malware payload (Mirai)", "value": "29464c46193ab1b692554793fac1897f76a0f5cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905975, "uuid": "792e99e5-26ff-43c9-81be-00e8b495eb42", "comment": "Malware payload (Mirai)", "value": "5e9983954e195ccc7a786665d8f0d258e034d8a091c762e4d12109cbee11bcb0cc43253e73cfb402d35bf595b7b582ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905975, "uuid": "8dc858b5-1809-4c49-bb27-93782240ad10", "value": "T1A9B2D19323053391C8E168B2D4BA9A8D6774DDF4A9A730DB6602056CFEC71AB5F34187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905975, "uuid": "aec5568c-9072-4524-ae72-07ee4f58e5ad", "value": "384:Idq712KH/pX92fnSIHZIzs+W2jEtzs/+gYFZ/Y8JCorJ4e6lvxs6RGem+mdGU5Ei:sqR2KH/0Hi1W2+zol5wON4+3UZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648905975, "uuid": "21a80280-3881-46f0-a967-5c4e31b804c9", "value": 25316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648905975, "uuid": "bb67c9ed-44be-4b14-8408-280b21ecc410", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905975, "uuid": "515cb806-ccd5-46a5-85b7-431cc36621cc", "value": "f0cee7bfd2bd8c50b48c002e614a1b4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614a0b5b-b239-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648872005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872005, "uuid": "1ea138fa-4b85-419e-8b13-ec3287f7d392", "comment": "Malware payload (Mirai)", "value": "09f5f75cf8481b688bda13250e766173", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872005, "uuid": "78056098-7b13-46f6-b7f9-b12e15a8ca54", "comment": "Malware payload (Mirai)", "value": "cfe00a8198806fa52296fc839cf1a81c9b7ea9801c28ea7a39cb6758657a31ee", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872005, "uuid": "f5a3e8b4-f1dd-4b52-9930-b0cb43355927", "comment": "Malware payload (Mirai)", "value": "e4091de70da265b530c60f102df5b7c0c29ecbfb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648872005, "uuid": "73eb3325-363d-4ca4-9bf0-09082b20b661", "comment": "Malware payload (Mirai)", "value": "6f0c6d3a6ae55289d1afe01c25ff6fa1d5acb7b91c8fa3716f8788034d2bee13dfae6e235dcc2f159eec94b37cf54877", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872005, "uuid": "70f82f20-674b-4e4f-8ece-601142a8f02c", "value": "T1ED632A91B8D28A12C5C113B7FA2F568D3B2653D8E2DF3203AD251F643BC691F0D67982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872005, "uuid": "24a45337-a190-4dfa-8196-1263205c9bd3", "value": "1536:4u5J9TxrPqnHzTN5faYxTlAl3i5PM0P2wk558TW8VRTZa1:4uDUplxxT6lS1R+wk5ey8D4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648872005, "uuid": "eb6247a3-5b04-4722-bf14-2bac9e86c7b5", "value": 66868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648872005, "uuid": "317f3fdd-a068-4af5-8bf6-df42a5bb71e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648872005, "uuid": "1bc8e40e-73ba-4b2f-81f9-f4e93d0c7640", "value": "Antisocial.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c18d7d-b261-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648889135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889135, "uuid": "6eb28460-86e1-413e-be8e-5ce5ab559fde", "comment": "Malware payload (Mirai)", "value": "57e223e535f1f7e34572feed712c85c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889135, "uuid": "1e68656d-99fc-4093-b06e-687591e8fcfd", "comment": "Malware payload (Mirai)", "value": "d04ff4f9c12a89b0bd04451baa0d82eb3738188c3b65fe9c51b24c122ae88cdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889135, "uuid": "8dd37fc1-0819-44fc-8fbe-7d04b9dd8fe6", "comment": "Malware payload (Mirai)", "value": "684761f55fa5ccb3a7baa2682b55c0793aca291f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889135, "uuid": "9abf334a-1e1a-4919-9b15-ca39b66e9f4f", "comment": "Malware payload (Mirai)", "value": "e5ef8b046ba89bf2d138648fb59086c25c187ad497c4693965f3c7e7dc647e0687b540db778712f77e78c7a34e50c3ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889135, "uuid": "3be6a77a-a465-463f-b73e-94b3286e649d", "value": "T13B63C518BF614FB7EC9BDC330AE91B0128CD555A21A83B36B974D818F64B25B19E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889135, "uuid": "71794f22-99dc-448c-8271-a735760846a3", "value": "1536:VL0xKG1cuqLkhv/FeKxHaTBuLLZBi/y6Ya10Te:VAxKG1cnLkhXFVLLY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648889135, "uuid": "b813f891-b340-4119-9b95-085a03d5f6c6", "value": 71808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648889135, "uuid": "b2d77042-cf79-423f-8e65-3239c158a21c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889135, "uuid": "ff295625-c3fc-46d2-876c-49246ba84b35", "value": "57e223e535f1f7e34572feed712c85c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb8185b-b261-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648889203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889203, "uuid": "c2c525d3-67cc-457f-888c-1eb592dca0e1", "comment": "Malware payload (Mirai)", "value": "f3bdd5f0dd631a76cf1d5b2761c4449b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889203, "uuid": "f4d81e21-1b4d-4a11-9526-233f9fa3dd88", "comment": "Malware payload (Mirai)", "value": "d055ef63ae11a8f4ec781bd7085d3db9ba76cb619d3ca2a410a1bd1423617e22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889203, "uuid": "1084050f-8359-4911-b07e-d94ccc066b35", "comment": "Malware payload (Mirai)", "value": "4d55047a9705d02059b6669e984d9448c3e41239", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889203, "uuid": "9bd919d9-1892-4834-ad46-129d4fd380fd", "comment": "Malware payload (Mirai)", "value": "93be8576cf9613b73470206e76b746be4bae39d55ba6ca800efa764cd9fabec050c2ca2a07669cfeaf61cb734eee577d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889203, "uuid": "1310267d-3127-423d-8fb7-1f0a9540d7cd", "value": "T10C334BC4F547E9F6E8060574207BEF329D76E6BA2114E943C3E89533EC52503E806E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889203, "uuid": "6ef827e8-390a-4876-baf1-ab3fcabad2a2", "value": "768:KCP19aWu3XJIl3TXBYu6J8T1XPRISotIiHzpmS4/dNwYQX4AoQLDY:3P183ZIlDXBYujT9PSTd4/dNJQX42LU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648889203, "uuid": "1a10fac1-05f1-4e1d-b275-723e6b2d5c52", "value": 54992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648889203, "uuid": "af98cf73-6f99-4190-b5f7-b9691a9a7fed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889203, "uuid": "469733dc-6051-4f8c-9c5b-0b8a6d0964d5", "value": "f3bdd5f0dd631a76cf1d5b2761c4449b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e9b14f-b261-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648889293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889293, "uuid": "59380c71-4f4c-47b1-819a-cd0f0370e93e", "comment": "Malware payload (Mirai)", "value": "adb5a96eed9dc0b25c1386ae2313f7f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889293, "uuid": "c9f0bc7f-14b3-43a2-aa8b-b69d55cab475", "comment": "Malware payload (Mirai)", "value": "d099733fe42c2fd0307d166229a48fcb3671c70113d1bb86e91bc1a0485bedaa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889293, "uuid": "ff8069c3-e9c9-4e42-8e23-97084532d799", "comment": "Malware payload (Mirai)", "value": "988aec8e4d32e41b0a108c203d73a5d8f3db21a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889293, "uuid": "2250590f-9c6d-4adb-8ca0-e2dba6506ffb", "comment": "Malware payload (Mirai)", "value": "412507a6af9c36dfeab4994a4889e7334164a845e0817fd6fc0378cd87fa34fd9dfafa64c3d079e3c3a2b4fda7cc4cc4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889293, "uuid": "2bb4fa3b-7326-4e72-9a61-7fe8d9b63488", "value": "T163333B85BC829627C6D01375F96F568E3721A3E4D3DE3227CE241B2036C951F1DA7E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889293, "uuid": "46b8192a-0453-4abb-a653-65bf4c9bd88e", "value": "768:iAkg0DWM3xSDjd1OV11kTcGVPXcdUmqgqVnJyQNUO8HUZODJoAaXBNbZY10UK:igjM3cv7k1kTlbVJyPNUZOGAaTa10j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648889293, "uuid": "9fbce9b8-92ed-470a-9e39-546cdf1d29c8", "value": 52228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648889293, "uuid": "58ba9ea8-946f-48ed-a0dc-b7145a601535", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889293, "uuid": "45d96f2a-51e7-4e94-bf88-ef0b868f6c3e", "value": "adb5a96eed9dc0b25c1386ae2313f7f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63670e1-b2cb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648934962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648934962, "uuid": "b84147fc-00d8-4a01-a41d-1a36be745a78", "comment": "Malware payload", "value": "e0818f4c5333866bc3c186ea7f9a2bae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648934962, "uuid": "6da020b5-7653-48b1-90db-afc25e7141fa", "comment": "Malware payload", "value": "d17133253e57854119a62729965ace0d1e4201561b6f313d5e72a14186e445e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648934962, "uuid": "de6c6860-79a6-4341-b4ea-d772a91a2892", "comment": "Malware payload", "value": "94f4a586e2999e1692540a213bf96130db1b03f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648934962, "uuid": "98f6ff03-68e4-4128-8aa5-f150c755d713", "comment": "Malware payload", "value": "b6769cdddeaebf6422e7134b1508062b6330f3624681ebb044ba3b5b28af0fcf4b5091af14f9daa582845ccb00077440", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648934962, "uuid": "5421cf2e-4f8d-4655-b42e-e46a1270ec5f", "value": "T118B5234B320C67E6C977D77B0DE5C2901A72ACB91771FBEBA9B007B81D94B90061139B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648934962, "uuid": "05dbe979-a73b-4fcb-99df-00ac949c6b82", "value": "9222d372923baed7aa9dfa28449a94ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648934962, "uuid": "72e4eaa9-995e-45c9-93f0-a23f13d797c3", "value": "49152:f3l9tY6nc2dQJQxqiqNxNyeZ6IdeW5EP3V9DHdwKRDc6OH1h8s:fVLnfQ6qiqNx3Q9DCcc6OH1h8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648934962, "uuid": "5b082902-c306-4048-85fb-edf6d16646f9", "value": 2482688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648934962, "uuid": "f288a12a-b9ad-42d7-9dea-bee0e156a9aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648934962, "uuid": "096865dc-a733-4642-b1d6-a64a70d3fe61", "value": "Spoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d041214-b241-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648875353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648875353, "uuid": "2903b57b-c536-44b2-ae2f-915964063184", "comment": "Malware payload (Mirai)", "value": "071630331bab82c8bb90a37a0876c5dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648875353, "uuid": "92f86701-9e34-4e16-9c96-4dcd30a123b8", "comment": "Malware payload (Mirai)", "value": "d1c7ca4532de5e4eb5c31f79b631a449f23bb3e1b2d458173aef3c3832f1c908", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648875353, "uuid": "88c4ecb3-c6fa-460a-831d-79e159a2c469", "comment": "Malware payload (Mirai)", "value": "c9d2776df226410b66e573776aee7da9d228bf2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648875353, "uuid": "9b9d3c8a-4995-4e40-96ff-0d7aff9bdb97", "comment": "Malware payload (Mirai)", "value": "1c0c3b73c3a63395edab9cbb1e3c5c01f348a3b7cec43c68f4d1f8aef4a4d9621e51de674398f991079d57e29f9b7b2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648875353, "uuid": "70c35b32-c249-4a7f-b3ee-b4613846d38c", "value": "T13F634932B9722A27C0C4A57A12F78725B6F143CA26E8C61E7DB20E8DFF505406657EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648875353, "uuid": "43fefd97-82a6-4ef1-a0d5-ad45950aceab", "value": "1536:b+lBwhYS5m7b4udDtuSJnJKIGnDQkoev3thcapP:b2+oYmRmDxoCTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648875353, "uuid": "20c54a5f-e402-482a-b8a1-06fc4845a31a", "value": 69104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648875353, "uuid": "b1d0a111-2d61-448d-ad56-89a28831b5e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648875353, "uuid": "49d5436e-f261-4300-9e14-1175b1f2c232", "value": "071630331bab82c8bb90a37a0876c5dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f930fd-b261-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648889169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889169, "uuid": "1ce886bb-a5c9-4af2-9913-115704186c06", "comment": "Malware payload (Mirai)", "value": "ddd716fde4e1fbbed0309e8c10820409", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889169, "uuid": "d709f90f-c3bb-45da-8526-76ba965c9776", "comment": "Malware payload (Mirai)", "value": "d2ec0da03737ddb48a5a8267fd6ea735b27b0943819a17b2b70ac081e831cbad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889169, "uuid": "47ce5a4c-7369-404a-823d-27c73dc6d179", "comment": "Malware payload (Mirai)", "value": "1a163dca3d224257f4e7f72035fee9e5a81828d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889169, "uuid": "0bc9645b-d85f-4bcd-bcf4-5334e0f2d041", "comment": "Malware payload (Mirai)", "value": "b552292d6211ee9a79dff7c22bed166c18f763c9a4464c28133a62ca2f385edc3a95c790d9f30742dfe1c4a7ace3b16f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889169, "uuid": "35e091c8-bd83-4704-bf32-985f5619e1af", "value": "T101535C31BD3A2E23C0D1A07A11F78B59B8F517CE26A8865E3DB10F9EFF1855025079B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889169, "uuid": "58522bfb-6847-418e-83e0-8e871df9740d", "value": "1536:d/+UJu0B4yomQOm9VsU8uVfofqjEkfiV0T:9bB/QOjUGQEh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648889169, "uuid": "136a42c5-c8e6-493a-8ea8-c6b557f2f9be", "value": 64120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648889169, "uuid": "567533fa-be15-494e-990f-cd2d72a6a52b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889169, "uuid": "a1c7a69e-544e-4392-8b5a-310527903653", "value": "ddd716fde4e1fbbed0309e8c10820409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6c42e3-b23e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648874413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874413, "uuid": "cde939e5-0e4a-460e-9e01-690cd62fa119", "comment": "Malware payload (Mirai)", "value": "23b1e1362a570ec0c679308d5169b06a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874413, "uuid": "2dfd20b3-8d85-4584-8eda-7716a6e5e7b6", "comment": "Malware payload (Mirai)", "value": "d4636646aa7e8a33be1b8f667409fac04915aa69756a0f1e33a73717a8622da8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874413, "uuid": "a852bc71-f62b-4052-a4a8-ae3bb73b6965", "comment": "Malware payload (Mirai)", "value": "1c5e2107c0b3d980b6b2fbe8bc150a15852d59f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874413, "uuid": "c2f3974b-8b3d-47a1-aa2c-06222a0b8bb4", "comment": "Malware payload (Mirai)", "value": "52665672e01dbf8011135bb7949265067235cfa97785155a196fe27ddae14d57351df68f827ad7afcba02e3a3a2a7f94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648874413, "uuid": "a677c087-2f8f-4edb-9fed-55f45eec663a", "value": "T179533A02B2280A57D1931EB0393F1BD193BFEAC121E0F585769EDB5A8131E376546ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648874413, "uuid": "dd286a28-7ce7-4ca1-9802-929060c884d3", "value": "1536:m+i81fKkTsKgIBcdajCAkbA/IrFL5jZa10:8k4M8ajC0/IhL5o0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648874413, "uuid": "0f4aafbf-ac6e-4719-949a-cd80493fd861", "value": 63644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648874413, "uuid": "c0e337ea-d23a-44c0-bcad-3b54785e3f5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648874413, "uuid": "ee2d432c-abe2-4594-819a-736c661d5b95", "value": "23b1e1362a570ec0c679308d5169b06a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba02cfcd-b2b3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648924553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648924553, "uuid": "d2f16dc7-5c48-42b6-a030-908f6174f9c1", "comment": "Malware payload (Loki)", "value": "a012863f3070d6649d702f052f8d0db4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648924553, "uuid": "1351292c-0e34-4cba-8172-85699782b836", "comment": "Malware payload (Loki)", "value": "d5283af257162375e7b8d7de4cc7974a96fbd0550ebf0c5b8f997b8a62dfc297", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648924553, "uuid": "0493ba94-3d36-4560-87bf-0752fbd65796", "comment": "Malware payload (Loki)", "value": "a441afd18bec6cfaf44e4a8f01909aa451acdeec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648924553, "uuid": "e69186eb-6232-4d53-bd9b-b22f4277fa46", "comment": "Malware payload (Loki)", "value": "182bf6401af771a6f9ca1d8fb500ce8a4d273ef66d71029e84b56bab00a2e4b88f4c4508248107f381691d1b896d5caa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648924553, "uuid": "ad18529b-1857-4d0c-a2e1-104988e0a7fc", "value": "T18F94020332E54B6AF1FA073FA072115013FC67376E51E60A9EA170DC54F6789A9B0E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648924553, "uuid": "844d39ec-7e32-4735-9b02-6908b317ec46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648924553, "uuid": "becfd540-2946-421c-b29e-2f393444d6aa", "value": "6144:pt/ZmMD9oQTix1n62miszvi3tTwxGOKZV+ojuei0FI99kUgZKGYbZBPUnsUMIe99:bZnZoYUn6XiHcg5FSk7ZKmv09GhbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648924553, "uuid": "b58f4107-bd00-4a46-a080-9c0cb2d6b871", "value": 418816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648924553, "uuid": "c1315a93-6a5e-4a46-a7c5-e6ea7fa1359d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648924553, "uuid": "667222a0-20a9-4df0-a6a2-0edb4eb3db6a", "value": "a012863f3070d6649d702f052f8d0db4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0025dc7d-b231-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648868406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648868406, "uuid": "f99b9c2b-c1aa-41ee-9b04-b4a39b2d1147", "comment": "Malware payload (Mirai)", "value": "de055934a66601ef30e799ea0be43972", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648868406, "uuid": "aeab424f-d9a1-4fc6-a46c-7e58da2e1f45", "comment": "Malware payload (Mirai)", "value": "d53b0696c28397598f5d67b373172b8cdb2a3ab500e3e544951949f0c76044af", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648868406, "uuid": "e0734eef-171a-45a8-bde6-30c7a5d3a8ef", "comment": "Malware payload (Mirai)", "value": "faa3220e2a1eacb11411e1975ffb2e608527b4b2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648868406, "uuid": "72f9d73a-45d9-4759-acce-3e8f0970a895", "comment": "Malware payload (Mirai)", "value": "872bd5cceb4a58170a307afbc5e46aae2c9a38ce4b1c50810155561f0be22808f4581adc32cec0e838643e0ef5860fd0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648868406, "uuid": "5e16592d-a1d7-4763-b0a1-b45e7b6f0400", "value": "T1D2732846BC818A16C5D8237BFA2E41CD332563E8E2DF32179D216F1177CA92F0977296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648868406, "uuid": "e0eb8bc1-035a-4e22-b19a-9e2d14f3051f", "value": "1536:QkrUWoVcpmhVnxliBlJc8uobyhQbbiAKcveFJ6anXd:QkrUWoV1Slilo2nArGDPnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648868406, "uuid": "2a6e5b87-30c1-430b-9240-cc1bac9608d0", "value": 74876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648868406, "uuid": "b8a7d226-a6d1-4808-8221-4f960e53b924", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648868406, "uuid": "8b0bf22d-095b-4231-8440-b900191c5d87", "value": "Cronarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b588ae52-b287-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648905647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905647, "uuid": "fef5070a-fe53-48ab-a97f-4811de994167", "comment": "Malware payload (SnakeKeylogger)", "value": "1d7b3c307de368e09614e12461f7d7b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905647, "uuid": "7c19a637-2c19-4967-bff8-015c32416361", "comment": "Malware payload (SnakeKeylogger)", "value": "d5de4ca7241e482ed0a791977ccd6ad884d1d6004b77dfa75a77c463a4ea3b58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905647, "uuid": "e289d0d3-131c-4d08-95e5-940b6ec0cc78", "comment": "Malware payload (SnakeKeylogger)", "value": "aab767fc8ba5202ae572bb246d3c7ad7621fdc15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905647, "uuid": "52e8343b-b3c1-493b-a7ef-91dae0965d6b", "comment": "Malware payload (SnakeKeylogger)", "value": "a26032a2a45ec198d077392f0801b4509b24fbb317b5c4b25df304f5d6d7a94fc88817b6f52bcc81f6e83df3cc2546f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905647, "uuid": "bce615c4-1734-4e95-987b-d7e30f224665", "value": "T12405ADE0EE08C77EEC14727AC1A848701EB51E9D7461BF5A918E31DD0677ACF08E652E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905647, "uuid": "7e938449-9562-412d-b6d7-cb32fa8960f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905647, "uuid": "7f01c974-2f97-4921-ba71-0f5b17733387", "value": "12288:mlx+daP11SVxhvTfMSdZcOfRkrf/E5me2Pd7bFMaSHTIEQK0HsLXZ:exUhvQS3c5fomzdC1aK2sb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648905647, "uuid": "5f5245ec-b465-4804-985a-7bf8c1ff15cb", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648905647, "uuid": "2e5f5a74-59d7-450d-b66b-8f1bc1609e5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905647, "uuid": "1e037d19-f7a9-4684-b4ed-4cc425b5aa0a", "value": "1d7b3c307de368e09614e12461f7d7b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5f2d46-b23f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648874443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874443, "uuid": "5654458b-4404-4ef1-9f7a-fa01b1c64026", "comment": "Malware payload (Mirai)", "value": "6eaa50b37c26df6bdc9d8786cce6a01d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874443, "uuid": "e32db187-f9e8-4388-a453-c181f5253599", "comment": "Malware payload (Mirai)", "value": "d6ebbc3dfeb08cb91a6ffa9392c68072a4a82db677bde0877d22c2f442f3f6b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874443, "uuid": "4f42ce6d-4615-4e3c-84bb-6d6f409f9bdf", "comment": "Malware payload (Mirai)", "value": "fbc100ed68ecc6a3b8a12aedcb7b4792fa22e090", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648874443, "uuid": "67bf301c-9cb9-4224-8210-a9cea09ec0b2", "comment": "Malware payload (Mirai)", "value": "381a98822a595f965bd199303e805987d906a19ccd9706fce8ed0e2ab561e9848a188710e46b1c993b49993206b9c1f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648874443, "uuid": "80cdd286-7343-499d-882e-2a26813afec3", "value": "T1E0439E76E42E5EA0C04582F07468DEBD0F23D8C093777EB15A9582B95043EADF658BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648874443, "uuid": "c5030d29-2873-4af5-abbb-4e6f99d1edaa", "value": "1536:VaV4wtt1xvdD0nkpZfcYcEzZA9MwCc2c+LZa1:Vg4Cvx0D8A9Mw7+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648874443, "uuid": "99f4efb0-dc03-40aa-a75a-0458375de097", "value": 59336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648874443, "uuid": "e2157ab8-ee0a-414b-b517-878c8f97ceb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648874443, "uuid": "ed9efe25-dab4-4a10-aeb3-906c9ae79e9f", "value": "6eaa50b37c26df6bdc9d8786cce6a01d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7e58ab-b2b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648925931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925931, "uuid": "d0d41f41-dc93-4395-876b-810d491abbb3", "comment": "Malware payload (Mirai)", "value": "b02b7892e1f979ecafb7bb0d3f478c55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925931, "uuid": "2cac8ed3-b88d-4ac5-957d-3b94dea6cb85", "comment": "Malware payload (Mirai)", "value": "d8a2f47bc3b9a6eeb35f7cec308c48df1bf6a17bba67fe4aa028e20c620dcf36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925931, "uuid": "2573d098-a8d8-4d7a-882e-e0a812467c4d", "comment": "Malware payload (Mirai)", "value": "3b30b16772621690e55faa3cf3d4135b2c47b1c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925931, "uuid": "29284888-2d4e-46ab-a524-705f4a3c1085", "comment": "Malware payload (Mirai)", "value": "23ccb80aa33832e218f8b8c5f1200e07a90325c08b2d67ff1cabe69a8ce8de7179adc6cf6000ca8a557f4261f560a1c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925931, "uuid": "46b82ea8-cb28-43de-a16e-0235a67ae249", "value": "T13873F886BC419A2AC7D11377FE6F159E3310A3C9D2DA32579C2407A47A8F80B0D27F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925931, "uuid": "8768722a-2100-4219-ac38-46cbf9cecae9", "value": "1536:Yjmi0YxbEbFt4lNp3AQ5SNBsueZt9egSVTgla5T:YjmiVxbrpUquws0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648925931, "uuid": "fe7a2ab7-badd-4441-af23-c14369c8d323", "value": 75060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648925931, "uuid": "696a88a4-43f7-4c28-a58b-23d7728537ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925931, "uuid": "4a22bd7a-fac3-4283-9e2d-028f7afb9493", "value": "b02b7892e1f979ecafb7bb0d3f478c55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6388a569-b261-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648889189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889189, "uuid": "53ecf003-1cf6-4dba-9f99-419476cbf59c", "comment": "Malware payload (Mirai)", "value": "305d45d695af18cf35f873ae6da8b989", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889189, "uuid": "ede86f84-c80f-48ba-a77d-3f935e81adff", "comment": "Malware payload (Mirai)", "value": "dc749858ff7b971edaadfb71626db5db96da24cbb2df3ba1e11ca743856937c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889189, "uuid": "e812a3a1-eda2-49c7-bb8c-2f86ffaad094", "comment": "Malware payload (Mirai)", "value": "3c4eda0707dc60f2e914f3af64e32ab636032857", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889189, "uuid": "b3896843-79ac-4b49-92bd-db8f9fd505d9", "comment": "Malware payload (Mirai)", "value": "ef661a8948ebf35af4092df97ee987efd569234ad5707c4215e7961d87482ef8ce2efcbae02ddcacb46f0f5ffba0e933", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889189, "uuid": "8d8e56ae-d609-41e2-aab3-0a13084413f6", "value": "T1B5534B91BC819A13CAD42376F96E42CD3B2563D8D2DF32179E212F503BCA81F0E67956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889189, "uuid": "0e43c69f-2434-4dc9-aefe-10c125a3cb68", "value": "768:P/gDkLFLy07lYHEVor87KtWMKU+PQimib68o8VadIxD/x6H9BNO4HxdEjUSlZY1q:gDQmUYHBi0WNmMRxDsHbKja10j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648889189, "uuid": "c5276ca9-926e-4a16-8e2d-3c73d56d268d", "value": 62528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648889189, "uuid": "213b836e-73ea-452c-b247-58b0a9163363", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889189, "uuid": "dd88ccfd-08eb-4892-aa70-a77e811b17d1", "value": "305d45d695af18cf35f873ae6da8b989", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a3b55b-b2ba-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648927315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648927315, "uuid": "04fb42ff-f442-4821-91cd-a5929acfeca3", "comment": "Malware payload", "value": "b08a3d501208b115eab86e2ead5fa65b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648927315, "uuid": "dc7c44fb-eb4a-46df-b45b-5c697ea54904", "comment": "Malware payload", "value": "e2ee962de73184eb406a9b403a87b4a8b2d8dc2a2b048977748a0273d1f90ab6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648927315, "uuid": "93b0484d-17ed-4888-9324-8bcbd7053b24", "comment": "Malware payload", "value": "d452934f1964f7a9eff729720a6f25dac50c1280", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648927315, "uuid": "ff18d9f8-99ec-4010-aca2-da1e620ae17a", "comment": "Malware payload", "value": "77922f1ef3200bfc724463e3915c66e4d45f488fc3dc3b1f4a02d3219da58e79935c345f44e6bcded12f5c96dfd3aadc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648927315, "uuid": "7718dc36-11e4-4ad8-a16d-3027cedba2f4", "value": "T1FFA4E081338ADAE1EF6C8AB8F8131334D73451ABD5226357A8707BFD9E5A16C4A141CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648927315, "uuid": "30709f93-4872-49cd-aaa3-2e89417992e8", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648927315, "uuid": "fad8b5ca-d06d-4948-9690-301061cdbcdd", "value": "6144:Q18xk0lzkdfNG04HdwfjubzKvJOaYKKgreOgYrHgiAprQpp3jTssxeykmTEeh33v:DmqX9CubQOa91ggg/oTTsarPh33kLan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648927315, "uuid": "d91b517e-bd40-494f-9df7-4387a65a03c3", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648927315, "uuid": "384cefbe-bfbb-416c-a150-201b7f727432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648927315, "uuid": "85cfa6a4-2980-46da-9521-19aaabf82051", "value": "3c6354a49bcd4331a7a5ce6105944c1a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f69725b-b261-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648889262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889262, "uuid": "10fdfd2b-352c-4797-b449-d85443be3805", "comment": "Malware payload (Mirai)", "value": "8d3583f861ac5a14188495a3470f7064", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889262, "uuid": "0bbcffcb-9dc9-4d29-865d-bc6c3ade2515", "comment": "Malware payload (Mirai)", "value": "eada884884ea3d02b2bfa88c45b41a5e00e2da86141cbba2dc7edad42a7961ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889262, "uuid": "14c48b07-0073-4118-94c0-a8c80b8d8999", "comment": "Malware payload (Mirai)", "value": "35b0e45d23a154e6135e69815a797d9819f28dc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889262, "uuid": "79241624-438d-4ef2-92ae-1a3cb3e7f56e", "comment": "Malware payload (Mirai)", "value": "3a11b98713ef7fe2d5051a32494fec4ca7d1d87ae208fdd32b867e6c49424f9314297047dfdb5d5f023a5f2afef99659", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889262, "uuid": "f84262fb-cf7d-42a9-8828-0162d776917c", "value": "T124631A96BC818A11C4D5137AFA2D158E331327E8E3DE72139E205F6037CA96B0E7BD56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889262, "uuid": "f4a5b4a5-6854-4a8e-abe7-838afb93367c", "value": "1536:6unLI9YSwCx1Qy7TS5KE/QQJRb4oGqKcgI0icgm4O9xWa10j:09zx1fbbQJeo0gm4O9xD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648889262, "uuid": "b7d1f371-7244-47d0-bbf2-dbd2ec0a29e0", "value": 71416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648889262, "uuid": "02e63274-eff6-49a8-b767-cf6dc967b67b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889262, "uuid": "36a304dc-de25-41f5-9321-9ea6aee53448", "value": "8d3583f861ac5a14188495a3470f7064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24754826-b261-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648889083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889083, "uuid": "8b7d8891-c55b-4ae0-a65e-ebad7b2db071", "comment": "Malware payload (Mirai)", "value": "ec05b6f23f0b46497f6e3663e247c155", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889083, "uuid": "6167549f-f9f3-470f-a894-f8465d3d2a50", "comment": "Malware payload (Mirai)", "value": "eae2daeb6eaa3f75292d9a047c749a8cf61c817156cfd035d24056fd9a188e69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889083, "uuid": "9338aaba-37fa-40b6-a485-c4f6b63d9496", "comment": "Malware payload (Mirai)", "value": "19ffea25ab80f9fcf0f611bce4ec296b98a87356", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889083, "uuid": "8cf1503e-8aca-41a2-9f98-a7eb84480c24", "comment": "Malware payload (Mirai)", "value": "2a19f5380f9a75a3bf0e9132ef086644e28d66f8b2a5a0c7f371a8f867d3be8dcf0963dcaaefaea16f58cdc3ca4f43ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889083, "uuid": "edd9443c-bd2c-4c0d-845e-dccc7872fc58", "value": "T14263A4596E229F7CFB9C423447B38E21AA5833E637D1D685D19CEA011E7024E341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889083, "uuid": "966f2436-9870-4c87-91df-daca95402c2b", "value": "1536:6kknlzPqrE7o2oXvouLWF4xyRAL3FHHgHk7Pp09HRa10T7:x6lzPqOKvb3L3FHHgHk7Pp01gI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648889083, "uuid": "78e18945-0251-4748-ae60-9373f9f26c1b", "value": 71808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648889083, "uuid": "a5498f3f-418d-4510-b3a2-a2b8f394376d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889083, "uuid": "3dabe2db-2234-4bba-8f26-71d1068785e5", "value": "ec05b6f23f0b46497f6e3663e247c155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85352bd0-b261-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648889245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889245, "uuid": "a72985db-38af-4400-b7e7-6b6173da5c46", "comment": "Malware payload (Mirai)", "value": "b1065059620ca1ed218ef15d3d134e5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889245, "uuid": "7782c31c-151d-4583-b7a9-d401a6e055c7", "comment": "Malware payload (Mirai)", "value": "eb81284225633b748fd582534e36212d01e71888faaa3220023ab48487915431", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889245, "uuid": "8f398ebb-6fe1-4dff-be67-f5d48edca1fe", "comment": "Malware payload (Mirai)", "value": "f402e0ec8c3b2a2a24cb55786c5a5f2750c5c231", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648889245, "uuid": "a18016d5-6529-4857-aae9-6a1b7e4af7aa", "comment": "Malware payload (Mirai)", "value": "516849820ee8b949019fc0d4de676c89d95c8a9b4c0938b37828681eae24f1cef215c633f555ed3142cdc50a346c626b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889245, "uuid": "76cb3f5b-c697-47eb-80e2-4c39925335bc", "value": "T1E7534BD9F8019E3CF45B96BA44264E0AB9326BC116830F2767B7FDD3AC721A65C13C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889245, "uuid": "977bedfd-07b9-4f6b-b1ae-3bd713bd1bb1", "value": "1536:/fc4MhIq5Dvf7YrPUIzv1SHd8+LEY2J9ggnk3e8F28sL60:ML1YjtzNSHO+A/rceaqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648889245, "uuid": "97ddd089-58ac-468f-818e-c5be836d2c48", "value": 61556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648889245, "uuid": "b7c882d5-3af8-4c75-9bf5-9ad07b65d5ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648889245, "uuid": "021629cd-6eb8-482c-aa62-8eb566c3aa04", "value": "b1065059620ca1ed218ef15d3d134e5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4f03a3-b2df-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648943429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943429, "uuid": "4b5a5ebc-c7b4-44c1-8e40-aadb5f610343", "comment": "Malware payload (Mirai)", "value": "9fcffcb1f7c0d326e8fc524ea54887a1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943429, "uuid": "daf47d3d-55cb-45f4-8df1-5e6123948523", "comment": "Malware payload (Mirai)", "value": "ec559d31b6fef1bdf4381458155d51a586da96ed587646c685ceafe28fdd8f94", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943429, "uuid": "a43bbc5e-fe13-4e89-a5dd-2a6ec97cec7b", "comment": "Malware payload (Mirai)", "value": "c260ded930c21abd295da76961c4c0757014ff1f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943429, "uuid": "152a8a3a-2dc1-433c-bdbd-a686bf162758", "comment": "Malware payload (Mirai)", "value": "2bd05df3085887f3f48e92f1c9050b8d539ede9bbcb929912de7935b4a705b44273b9f2b69ea0772cb57f83a3b3f8da3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943429, "uuid": "08603fb7-35c4-473d-a5f0-4f46ad65d7d1", "value": "T140731A81F58745F1C9074A3460ABF23FCE32D57E41709BADEF6A6E31DA2B601620729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943429, "uuid": "3a914dc8-acd2-4585-88ef-72ee080b04a2", "value": "1536:6x2mIqbAUMljMMGfTmUsjy8MTdGKLH1YxE0B4YVGdg/yI:W2mxAUqgfCrNkx6ETSGOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648943429, "uuid": "4ba60d94-7eb4-4817-a12e-60ba4894f93a", "value": 74736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648943429, "uuid": "a5169e9d-54f2-47ba-bc7d-d825421ffa8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943429, "uuid": "f1ae7920-0e3a-4481-a875-70395b345029", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f460178-b2c4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648931621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648931621, "uuid": "1b2f2130-2976-4cb1-bc46-5c5f99413468", "comment": "Malware payload", "value": "ae5e9b68767a28db06dcbb0b3e964b7e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648931621, "uuid": "90e14a95-4d00-4014-871c-4d8cb659f8a6", "comment": "Malware payload", "value": "ef45f5459b705c8a970cc7e33af6df3d8e9ce6be0fad2d276472784db78935b8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648931621, "uuid": "71a297ef-8aba-44db-a463-9b54224f35be", "comment": "Malware payload", "value": "cc288daffa265a8cf12c5dddf7385a228d012144", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648931621, "uuid": "c0835351-0d37-472d-a522-bd1a5d21a7da", "comment": "Malware payload", "value": "46705d0f22b0aecdecb5c677dbb8be07ef29011cd6f7d483acd2155d1d4434a7cbe0f9267b752c19643ede211729ef99", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648931621, "uuid": "a5df5eea-8ce2-461d-853b-c3e98620e442", "value": "T1C90702CE9DC6EC13C76A617860652C9B7AC0CD4F54320CA9179EF1637C612B462D8FAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648931621, "uuid": "49796db0-679e-4b33-8850-8907a0bae11b", "value": "393216:cKtHGt4ZRpyetQCviS/fyBV4I2uJSNLD7JStkbzANZ:cK98MvxWCviyfCVBDYh3UtkbcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648931621, "uuid": "c7b52ada-165b-4b8a-b0cf-f5ea84c9ca04", "value": 17329384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648931621, "uuid": "baf02623-9e40-4699-9814-fe57102d171b", "value": "application/vnd.tcpdump.pcap", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648931621, "uuid": "d7ffd7d2-c6f0-42da-af75-273a6065c247", "value": "2018-04-23-DHL-themed-malspam-infection-traffic.pcap", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bceeb20-b278-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1648899027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648899027, "uuid": "a9e29a73-682f-4799-b158-4f5319d16b80", "comment": "Malware payload (GuLoader)", "value": "bf96d95a92ceb01f770363a4e7586ff5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648899027, "uuid": "43018206-62b7-412b-85c9-b88c58f7e64f", "comment": "Malware payload (GuLoader)", "value": "f1bd6adeeb4de478e5697432f1cd289a435e6102702e84f40a0cdf9c638e5184", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648899027, "uuid": "9d34007e-a970-4c21-a83d-5c165774ee3e", "comment": "Malware payload (GuLoader)", "value": "33e51a2bd5f54c0e4abbe073db6c818acbb63093", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648899027, "uuid": "e87cd3e2-5277-480b-b5b4-9245df95a307", "comment": "Malware payload (GuLoader)", "value": "19f62a4ef2fe99694f2f703f6830bf2c0dee57897f66347d53d7c2c841a3d457044d51109338219c8d27561097caaeb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648899027, "uuid": "0c5137b4-1d2f-4188-8cb4-f1fd48c9379a", "value": "T134742B92B011419AEDB735F26C2F883025C36EAE91B5D70D56EB772A5BF3352005BF0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648899027, "uuid": "d85bfdfc-706b-4486-af1d-efc26924e008", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648899027, "uuid": "a579152a-d62b-4a15-9a16-d9eef2116c67", "value": "6144:xYa6Z5tDJg6Jflrzd+SMMwhryKFPQCivRWePDG:xY/hLMMwpyKF4RPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648899027, "uuid": "9b015278-8492-4532-b411-80028b771a26", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648899027, "uuid": "f3347e71-0ff9-40ac-817b-d8bbd3b49b06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648899027, "uuid": "00b73d09-0f62-4546-af9a-7b5d2a011b5b", "value": "SecuriteInfo.com.Trojan.Siggen17.32175.3080.22840", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1a3971-b264-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648890733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890733, "uuid": "b10a87a6-353f-44bc-a562-b285cd591d09", "comment": "Malware payload (Mirai)", "value": "41befac36afe9f1f31f3cadf6749a609", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890733, "uuid": "ae1c3b60-7393-418f-ac18-a00b28dd337b", "comment": "Malware payload (Mirai)", "value": "f2b37f2ce8651579404c60ab3a0875bc81d338b9650b6921342668df591d6ab7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890733, "uuid": "3973fbc6-17c9-4c3c-8992-641af303c4c4", "comment": "Malware payload (Mirai)", "value": "425a8d88c631e9b19988c4c8a3b358b39f6f2d2a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890733, "uuid": "efbc6aee-4e7c-4059-8484-0b4be81dfc44", "comment": "Malware payload (Mirai)", "value": "9d1665cce3b2f629b317d71e7b8eeb0860f80b4ce166259f0c45beb57981336910a4a6437db29e728f2b51178cb6ea93", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648890733, "uuid": "e86f2938-85f1-4a33-9e32-3d4b53f8304e", "value": "T13083B60ABFA14FFBE8AFDC334AE91B05259C501A21A97B75B934D418F24B24F05E3875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648890733, "uuid": "1209b4d6-0847-4b53-9d1d-2091f09f7109", "value": "1536:O5lF6tRevEoSU8GCwEVjdeHJzonKa6zcHbCX8qIZgZzXn:O5j6tRevEoaGCwE8oKxsqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648890733, "uuid": "4ececf52-fd03-49be-b1bf-f14a8c8b5234", "value": 88116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648890733, "uuid": "e69cddda-b7e7-4e87-b03e-dc27a8702ddf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648890733, "uuid": "b0e9c598-490d-46df-b7db-1c55346b3263", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78b303d-b287-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648905651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905651, "uuid": "b138da01-c73d-42f2-ab37-06c9e81b68aa", "comment": "Malware payload (SnakeKeylogger)", "value": "a1a00377843e6f882bd1265681c27b4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905651, "uuid": "b330892e-7c12-4a32-be8d-b25b47281e9f", "comment": "Malware payload (SnakeKeylogger)", "value": "f75875a5382d8c90f69e600d494dccf8a1c8242c260e07666aabb6e504292a32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905651, "uuid": "d21d36db-cee3-4604-aa79-5a594684d1d5", "comment": "Malware payload (SnakeKeylogger)", "value": "3e6977425e73604601c40c2d0893251e8e09eeee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648905651, "uuid": "0668d5b6-5833-4830-9d13-c8fe04bd89c8", "comment": "Malware payload (SnakeKeylogger)", "value": "00e2523ad651b6ddfb451d7ba9d670b3c140e55452ac8fd0ba2ac51acb8cb70d01041322be53b8a573f7180425acb639", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905651, "uuid": "93e2c388-4a67-4a4a-932d-d81a0d809c61", "value": "T1FDC3285A3BF88804FAFF86B115B18124C6B4F9524536CE2D5AD1F5692D7CB808D22FD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905651, "uuid": "d87d6d88-94ed-43d5-bc5d-cf612cc1be61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905651, "uuid": "96128f5c-3fc5-4b28-a255-9e0f1abf70ce", "value": "3072:lGC1m6plSQxj7DYK2ba2gSsUXvMt7E15lbwBZUnbY:lU3K2brdsUXvMt7E15lsCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648905651, "uuid": "90b29665-48c2-458d-8be9-f4691356110b", "value": 122368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648905651, "uuid": "810d8a63-48c4-4927-9593-b4bf61668087", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648905651, "uuid": "5b933530-698c-4131-a2e6-8e1b4183636b", "value": "a1a00377843e6f882bd1265681c27b4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16293355-b289-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1648906239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906239, "uuid": "45a7ab41-35ab-407b-abc9-db3731a6b2c5", "comment": "Malware payload (RemcosRAT)", "value": "02d9a59c3300a4a005d2650f636819fb", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906239, "uuid": "a6dbc5e6-4093-4d5e-9676-065161c2f6ff", "comment": "Malware payload (RemcosRAT)", "value": "f7ba4648cfc37732e673a55dbde36390a21fb56aebf31284b6580ab73e599e3d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906239, "uuid": "3cefa588-15f9-47e3-9608-ff9824de80f6", "comment": "Malware payload (RemcosRAT)", "value": "19d071ef00181a170e979ff7f6014ad03f89ce03", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648906239, "uuid": "4fb7d6e8-68ed-476f-9413-f33b30bbd4bc", "comment": "Malware payload (RemcosRAT)", "value": "25556076c4b0f7ab56096d3708dcc8dbb5f73ee675ee7f3ba19aaf46b4e6458495f4133c83a36697e3fbe473bc89c2d5", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906239, "uuid": "2670ddde-a4b5-4413-b718-199e199b769e", "value": "T1B3A4025276DACD4AEB4F07710CA79B966B23FC515FD7929BB084B71D5EB1E808803207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906239, "uuid": "65352d2f-b347-4657-9648-8857c8594ab6", "value": "6144:Gk3hOdsylKlgxopeiBNhZF+E+W2kdAYtO+4Os6B6i9cWczaPpaZf2AOSbX3Ote0g:n/Ns6B6kcWxa3/bX32eDcTXPXwwR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648906239, "uuid": "4a9bfa19-1399-4790-a644-dd1eb3d58ce5", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648906239, "uuid": "8ee586d1-d846-4037-a366-b7f7ccf44828", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648906239, "uuid": "d1c1a3b1-2573-46c4-a201-aec09d05a598", "value": "APLL Remittance Advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc26153-b2df-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648943428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943428, "uuid": "76f0a456-5ee2-4cdd-acff-3faf1ac547f6", "comment": "Malware payload (Mirai)", "value": "6d1a0705ca7d78ab0ddf8888a4d90ee7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943428, "uuid": "c372a73f-9b2f-47ae-b3b0-df0b72ea7a67", "comment": "Malware payload (Mirai)", "value": "f80f9659f5ad1443bba8dae843da87f5c5a23814cb1f7d800a12587864a39c0a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943428, "uuid": "c40fe70d-64d2-4f43-98f8-4b9870c12025", "comment": "Malware payload (Mirai)", "value": "ec792b7c6cfd536d73bdeceb610df92228f19fab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943428, "uuid": "b6320258-2834-4810-a910-688c467d2f89", "comment": "Malware payload (Mirai)", "value": "7be6b9fa2d51b7bb1df8f2f1603df06c84e3c9afcdc1ed718253ead78233cf996e6cdf4054e08176afe257ebfc63839c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943428, "uuid": "f5fd2f05-9167-4bcc-ae23-f1322fa5abf0", "value": "T153632A03A69181FCC0C9D1B846AF7536D462F57D137AB1DA77C4FF1B3909E602A2E289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943428, "uuid": "01903fed-50a6-43f7-93e6-3226ff5fcafd", "value": "1536:oubsJMUbw8nXBKp76Z9CUwLGO/X6EXHmpujFC7Pfd:nGRbwIxy6qUHO/KEXGsY7PV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648943428, "uuid": "858350d1-bf52-46db-8b14-d94f5b73c426", "value": 71104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648943428, "uuid": "e59d9902-7314-4891-b6d9-2ad895af28fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943428, "uuid": "fb7623b6-6a92-45dd-9554-45651206333f", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbab32e8-b237-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648871405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871405, "uuid": "ac428cfd-58ac-4cf1-8aa6-127111ca221d", "comment": "Malware payload (Mirai)", "value": "7ee11cbc70232ea252ba44e5c80e03cf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871405, "uuid": "12ad92e6-6d56-4d05-bfa4-4f69fa5ec391", "comment": "Malware payload (Mirai)", "value": "f95bde0af215138864f62ce38fe2ce1021abcd21751579e9e4f2cf816bf31d4b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871405, "uuid": "8957678e-9a75-4e41-8203-6a3e6ea76056", "comment": "Malware payload (Mirai)", "value": "182aa894f2fbee3690341ad069d20c0efcc908c6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648871405, "uuid": "1520e416-0c9f-4e96-a209-79d7c220257b", "comment": "Malware payload (Mirai)", "value": "8be445bfdb160cde794ce5d6ffd15d40c22aab9e425af23456d72e6f396b0ebad11cb909be8f458e9552af9ef29cd711", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871405, "uuid": "36df94a1-66bd-49d6-96c6-f5aebf6a3563", "value": "T16C632A81BD91D626C7C153B7FB2F018D372963D8D2DF32029D291F60768AC1E0E67A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871405, "uuid": "aaec1176-7177-49f9-b9c6-ef9ab5d084a2", "value": "1536:t99nvKVR9sdyMyvW3THSXRM0nGwcgH9WcM:t99nvKroz3rShClC9WL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648871405, "uuid": "0e9653af-202e-4bc5-90c6-73a13ff0c841", "value": 67528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648871405, "uuid": "da1d121a-4b8a-4270-a62f-b66f5f1c545c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648871405, "uuid": "c4ad79c1-a1af-4a02-8ae9-e4ede627791f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8c1bbe-b291-11ec-8e58-42010a9c0032", "comment": "Malware payload (HawkEye)", "timestamp": 1648909877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648909877, "uuid": "d3eb2ccb-6696-4617-9766-bd322b6b3d7d", "comment": "Malware payload (HawkEye)", "value": "de8a8f710f5bfdacbc1843b997741b86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648909877, "uuid": "e78abb71-75f5-44ea-9aa4-e4e14691e3a7", "comment": "Malware payload (HawkEye)", "value": "f97f876b529e2569d80b1190a249088582117b29aef9af9d8a0e992c2df2db2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648909877, "uuid": "bf49d840-a538-4b06-9511-c2bcb8b24871", "comment": "Malware payload (HawkEye)", "value": "3abf5d61febd54753055bb2707853ea2eace025a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648909877, "uuid": "1c4d4a3a-cbfc-41c8-9067-a1f84202e2de", "comment": "Malware payload (HawkEye)", "value": "6598056fd4b246470af87c24bf0e74f34f1b2ce17cf06d46d3821fd7e4220ed9ad8c9bf75516babebfe95e3f04b3680d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648909877, "uuid": "4425e239-3528-4f69-ae57-fa3714d86322", "value": "T1F2F401ABC3F9AF1BD48F02391420892B3FF0E8D3B620D559FE4615F999AB79A0444753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648909877, "uuid": "c1809d45-2628-457e-a0da-83f6c821321b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648909877, "uuid": "2ce1d01a-eb1d-4dc4-827d-43f36d93c2e9", "value": "12288:0weOS9PfObujtx3NmAeRnDzKOuVjujtgsPGtJPps9uvIrwKafPTAHNacDG7UDPR:m93Out7mAeRDuOuYwJPpmcjAtac67UD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648909877, "uuid": "cbd3116b-fc66-4e47-a1b9-6c66bb0ad233", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648909877, "uuid": "9883f9e3-2647-4119-a006-f19e5a598a1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648909877, "uuid": "6e2d266b-c59b-4fb6-9029-a264b4ce2a5a", "value": "72QC-GMI2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e687c6da-b2b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648925916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925916, "uuid": "2da617aa-5efd-4f13-a1df-6b12dc7efc06", "comment": "Malware payload (Mirai)", "value": "d641f89d5c4348a96a8cabb6854e087f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925916, "uuid": "4f57ec5e-27ac-476b-a8ec-8a80dcf34de6", "comment": "Malware payload (Mirai)", "value": "fbb4bfe51d8f985dab0b352c35d04ab546c0f2b7dc9135d63b25c1365abd54d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925916, "uuid": "ffbfec7b-26f2-4212-a690-95026f00832b", "comment": "Malware payload (Mirai)", "value": "9d944ba21567aebd346aace29b1c95cf9355eab5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648925916, "uuid": "25f05372-8ee6-43a3-be6a-28772661e50e", "comment": "Malware payload (Mirai)", "value": "edc16128d573a8e0f19486de593922ec449ff4e91cd6dfc36314c9eb2bab44aa697ba0ec0fa5757cfde2b883b2711c82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925916, "uuid": "f68ad3e4-e3e2-4d97-905d-4a3878d375d8", "value": "T1B663934D7E328FACFBD9823487B78E51A64823D622D1C585D2BCD7151E6024E381BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925916, "uuid": "38cc5ace-464a-4488-b62b-371baea22609", "value": "1536:pMd3ub7mC+0TAk8bvZKjDsFNTiYzhNZD9CMx:w+Xmr0Tp8j8jwNTiYzhNZZCMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648925916, "uuid": "100e9f3d-e8df-434f-8fdc-a162d810108a", "value": 68692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648925916, "uuid": "2e4081a5-44f4-40ba-b8fb-219fbc755112", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648925916, "uuid": "58aa9738-5420-4865-ab0b-dd8117a4504e", "value": "d641f89d5c4348a96a8cabb6854e087f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdde4ef2-b264-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648890736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890736, "uuid": "bf559ae5-c60b-46f8-98d5-9b0efe868fcc", "comment": "Malware payload (Mirai)", "value": "b0d4accf405bbb2987e71efac210e138", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890736, "uuid": "ab67ef5d-ba0d-4a8c-aa54-0648329fe7cb", "comment": "Malware payload (Mirai)", "value": "fcd0662ea3466c75cab9e1083075e5844dbec90a52cbf4af15f030f1f22a01ac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890736, "uuid": "998a1c18-dedd-4158-b276-98559387b893", "comment": "Malware payload (Mirai)", "value": "df562d9af791645c9b92e7457c5a73c132bb60b5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648890736, "uuid": "ebf108b3-bc39-465a-8637-aaf45c958233", "comment": "Malware payload (Mirai)", "value": "74bd1e292e9f28e3428d4da7d71e793158aec5988f826419ea471901b9cfa1772c9761828bc08c5a669b43b7945e59f7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648890736, "uuid": "92532888-7374-4ceb-912b-f6f97a56d3a0", "value": "T16D632BC0F58785F2C91B893450ABF67FDA32D53A407096ADEF8A9E32E917701920335E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648890736, "uuid": "c532ad8c-af33-45e2-a729-fc9ef2f89721", "value": "1536:U70C+T2XYkhbEPHocjRMGy58vio3jTd2hSqzLQuBVsPyQ:S0C+T7khb6bdymviKDqzcuBVs6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648890736, "uuid": "8c009f47-e3bb-4be1-b41b-5b36f3559744", "value": 67440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648890736, "uuid": "930c4dbf-78f0-4e7e-acba-aaea39a07995", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648890736, "uuid": "47a7411e-05f7-428b-82f2-41d5c30e3224", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ff0684-b28c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648907851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648907851, "uuid": "90a9d010-d404-4d14-9df1-f1f448484a27", "comment": "Malware payload", "value": "84568b0259c2933b195b15e119a0f923", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648907851, "uuid": "43d6c995-05ab-4cd3-a2be-431a14412cf7", "comment": "Malware payload", "value": "fdbf873a5b98ba84b1e2d4b32b161360e25fdab595514666933bbb51f2f89a02", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648907851, "uuid": "44cf5770-4ff6-4aad-b8fd-497cc2f04761", "comment": "Malware payload", "value": "547217568da3c2970b80ae9714e61196dc4e0e0c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648907851, "uuid": "76602f6a-83a4-4ffd-8755-4dc83d5a49fc", "comment": "Malware payload", "value": "64a8515308609e8247c24a9581913f4c7be332514b6c848d887c657e2c19e49fa960df65b9958696404e11738d6c1b32", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648907851, "uuid": "f985615b-7ed8-41a5-845c-0c7aa94b2e89", "value": "T162F5CF26759AC636FA7E8270652DCB7A60B97FF00BB244EB63C4592E0D744C10272F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648907851, "uuid": "d2106b94-1009-4c58-98ae-5139fca73d7c", "value": "98304:mtMKAptulbxKO1fTCcOjSEPYtDu5+tK3Hyf3hy4:mLxfTCcKODu5w+HU3hy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648907851, "uuid": "c5977acc-dc62-49e2-9f86-d94c9193ddd7", "value": 3406848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648907851, "uuid": "2d36b741-94f3-446b-8870-9796192dda1e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648907851, "uuid": "f7bc865f-fadd-4979-ad3e-ea310734c8be", "value": "84568b0259c2933b195b15e119a0f923.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb76c38-b2df-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648943432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943432, "uuid": "d7bdc00f-d34e-4688-8fd0-4f2afa1436bd", "comment": "Malware payload (Mirai)", "value": "f73ec454e7ed3ed93c72ada4a3874994", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943432, "uuid": "a36a6998-7134-4dea-9ab6-02ada7e99bfa", "comment": "Malware payload (Mirai)", "value": "fefed3c44d80037d932a0964658a483e84ada8d9e88995c44c563e88f5f13735", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943432, "uuid": "9f06682e-4a04-45a5-b3a2-029c8c412f85", "comment": "Malware payload (Mirai)", "value": "53746e2bc116df261cd411bf63b864d09a686708", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648943432, "uuid": "436425cb-cbd4-40df-9a0c-ed2fff3492eb", "comment": "Malware payload (Mirai)", "value": "45c4180ceab620f92a2529c76f5ee77885fdbdb9163ed0c64073bb4cd744204ffe4bd37d1e70d6f2f00d7202ae044af1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943432, "uuid": "32fdca44-2bbb-45ae-aa35-f0d65347b27c", "value": "T1C8E32A46EA408B13C5D52B76FA9F414A3322DB54E3DB3306891C9FF43F86A9E4E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943432, "uuid": "273c39d8-12c4-4b88-9fec-a5766272cf66", "value": "3072:tmwkaDfiDPSYGI11nxCQ73yfrG8ASyEuQETxViXSb8:tmKfi+YGi6Q73yfrzAcuQETxViCb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648943432, "uuid": "63f3dc1a-c352-4834-b44c-684c6400718e", "value": 148333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648943432, "uuid": "010c9473-250a-4d7f-b734-2fbe26ce1314", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648943432, "uuid": "3b3fd0cf-899c-43fc-a0bc-14d4e9f4eab3", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4991a10d-b2aa-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648920499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648920499, "uuid": "bf7e3186-6038-423b-afb8-42d9bcd12447", "comment": "Malware payload", "value": "231da61d2ab3e7f30525efc6b89d7d50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648920499, "uuid": "69a49adc-d967-41de-99d5-223297994942", "comment": "Malware payload", "value": "ffd613adee9a323bcadae6dc192ab9a7606169623b3bf139443ba046c8ec144f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648920499, "uuid": "73495b23-8131-4504-bf03-a3066008f021", "comment": "Malware payload", "value": "306137fec351dfb7991620bb644e891b87106363", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648920499, "uuid": "30c9391c-847c-460a-af26-e58bf7d03811", "comment": "Malware payload", "value": "59b946a9d7b6977d30211695e6415149ea69ef56a3f638f880be7f386cb47cf660fb4f2f0bcc68b4cc579bd666d4851c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648920499, "uuid": "a6e067ad-ae87-4df7-9bb6-ffe2fb7f186a", "value": "T1E31623326399A1C5D4D6DC33C637FE92B1B143AF9B02E8F46AC16AC138324E5D217A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648920499, "uuid": "01940bdd-3651-4760-9fdb-00760b8b9c81", "value": "dcd3ebbef25b28fb0aa22ee1d7658c44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648920499, "uuid": "f065a549-ef71-45c7-be00-a33234d62003", "value": "98304:QpM4gDjAZ9sOI//kbLK3LCPynzMDIjBIcM1sa/FMYgir4U/6YgjLN:Qp4fA/sDHkK7CoMoILp9Mc0y1gjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648920499, "uuid": "f81a7f4b-7853-4c10-afc8-acdedce6737d", "value": 4086784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648920499, "uuid": "ab572d44-2931-4b0b-a293-b43d169b3e3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648920499, "uuid": "8e5c48ff-638a-4e3e-b015-b854ab23409e", "value": "231da61d2ab3e7f30525efc6b89d7d50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }