{ "Event": { "published": true, "date": "2023-05-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-05-28", "timestamp": 1685318582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "766e051f-95ef-431f-b358-3e8cc1de8fa7", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24885e35-fd28-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685258437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258437, "uuid": "a61f8c3d-de94-42b3-8207-e0c518365128", "comment": "Malware payload (AgentTesla)", "value": "4856aa91b3b25dc702acee5419906c0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258437, "uuid": "ac8b2519-5ae3-40b8-88a5-96b3ab0655ab", "comment": "Malware payload (AgentTesla)", "value": "0140ef4dd7bd4b560548e2b9f74ae66006efc7d0e0b3b017251f755bbd8b601c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258437, "uuid": "84b5ec1a-2c9b-41b8-b1c9-c697dd225e3e", "comment": "Malware payload (AgentTesla)", "value": "ede60a132a27265595f8744a44ea13f371357d08", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258437, "uuid": "6b38bfb9-c683-4b5d-92f4-d2a21752386e", "comment": "Malware payload (AgentTesla)", "value": "522e4181815f1170d887bcdc907be57d2c1daa03d61a9248a0f5bbe1a6354ab4ec38a011ad961985f9b4ec2a0b8db634", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258437, "uuid": "873e90da-effa-44de-a822-64157af6b215", "value": "T17705F16832E71E13E78AF7BFC4523970037A7B463827E3491AC463DAAD52BD1A50174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258437, "uuid": "408fd85c-90d9-402d-924e-c6e08061e079", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258437, "uuid": "11412867-d5a0-4545-81da-92ffbb584a2f", "value": "12288:TJas7z5GoJiGaq5aulLfqPoSCccNJzT5Fkjy6v6z4TgnnFxZAY6gvCd41x:I65GoR5ambqPo7Bk+6v6kTgFxiVd41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685258437, "uuid": "dff62dce-d0e9-4b21-88bf-5cad0dcf5e92", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685258437, "uuid": "81288af9-36dd-4342-936b-779dfaa3e11c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258437, "uuid": "ea834fc2-7933-426b-9a4e-2e179f8a998b", "value": "4856aa91b3b25dc702acee5419906c0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ad0ac6-fda5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685312119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685312119, "uuid": "4f3813dd-1c99-4c93-9216-b4f3aee4dd76", "comment": "Malware payload (RedLineStealer)", "value": "a8d5099c843e6294a49673286a719b6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685312119, "uuid": "22e2e0e2-af50-487c-9dc8-0e678ee2462b", "comment": "Malware payload (RedLineStealer)", "value": "014e574ce2454214c7aa61d94ebb9be669ead513d2bb60b9fdf527907c088792", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685312119, "uuid": "bba2336f-9cda-4270-8a59-65f7a5ddbb2e", "comment": "Malware payload (RedLineStealer)", "value": "7cf487b2e53082db71d2925e639a8a1f1364e8c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685312119, "uuid": "31e30ee6-9190-4ef2-952c-bb873abbca70", "comment": "Malware payload (RedLineStealer)", "value": "8e43dcc509860773e4e52747d8a84d29e2f4d56127ea31b063174b18932be73ba49833e102e33a747dec0f01f03c0761", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685312119, "uuid": "e45fc54c-84ee-4774-8f47-1fc687df3c19", "value": "T19F66F163B0DA2471F8732A3678929432393E1C9CE0462DA929F4AED7F572D0C5F4B791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685312119, "uuid": "63ae0660-aec2-4090-a661-774ff957287a", "value": "6011984d7c1f1b97a34d7517a498bff8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685312119, "uuid": "08f6db14-27cf-49e1-a6e1-f84649a0daed", "value": "98304:Rc+3jotiAEnqkTDeYTCBhllPTBrHJWGs2NyqeoNE/7SRYY2VymGu/m6zHAlA64T9:rjOpnkTD2ZZTVHJack+YlGlSRRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685312119, "uuid": "1f9501ca-1c85-4dd3-a386-6bed749c8a32", "value": 7065468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685312119, "uuid": "246c55c8-6acd-4bb0-8e3d-0ee980e5ac96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685312119, "uuid": "55dc9d38-7acb-496b-ab36-ed47e46c8af3", "value": "a8d5099c843e6294a49673286a719b6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c44498-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685300308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300308, "uuid": "8e5b4cfd-c6ef-4cd6-be22-4dcfd8ec9c6f", "comment": "Malware payload (Mirai)", "value": "db48633606c9dd9fb5bf1e2c5f4e6e35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300308, "uuid": "34efa990-0922-4d52-bf28-51f9fb5cc382", "comment": "Malware payload (Mirai)", "value": "016aa910fd72c70622ce46e1dd1e5a223b48197da5e79dee65bbc8d1083798fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300308, "uuid": "7066bf40-422d-4a49-8753-c5c78c04de56", "comment": "Malware payload (Mirai)", "value": "7ddcbe2b612b85391c5f14e77b3e0955dfd6b395", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300308, "uuid": "16053b32-93b9-4a2d-b360-dc72b3ee4077", "comment": "Malware payload (Mirai)", "value": "aab0efde2198c2ab7d18e766f8e737769962e0e45955d8da39366e2b3fd6c3092ce34524e69d98ee08238540c73363d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300308, "uuid": "1cba77cd-2072-4975-91de-9cb30a3992cf", "value": "T13B03F751BC829A77C2E1137ABA6E5A8D336163E8C2CF7217DD214B20BAD551F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300308, "uuid": "7b561f7d-4a4a-4e8a-b4a7-b0389357e792", "value": "768:MglA4CbIsG5f0OhnlUl0O9FRA1wArb9/3W5uv+bhLZAZXoTx/NbwWz:MyabXG5fDlUlXjwVe4v+cZ6qW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300308, "uuid": "e29d0378-a82e-4a93-afce-4f29f1b9015b", "value": 40744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300308, "uuid": "9d81dd7d-dc5b-47a2-a303-6873ac0ba81d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300308, "uuid": "4cd007e8-c74d-4e66-bd00-16064d9834af", "value": "db48633606c9dd9fb5bf1e2c5f4e6e35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b890ac1-fd84-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685297962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297962, "uuid": "47086288-d06d-4d31-9e21-33e2dcfaafa6", "comment": "Malware payload", "value": "54403ae86662345eec835b2177a5cd17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297962, "uuid": "ce22d9af-bb07-4f68-8331-215035bc5c1d", "comment": "Malware payload", "value": "01a5a583be5076fdb7d889ec170058085e0423318181e301f7fdefe4bedbb598", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297962, "uuid": "c7171c6c-d82b-48ab-b01b-d7c77d9c15e7", "comment": "Malware payload", "value": "07116cea456770a347f36ec0708170de6c73d0fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297962, "uuid": "6ee3fcd5-6e19-40f6-b8a0-e053026ab1f1", "comment": "Malware payload", "value": "9eff0f157ef2ae1ee425d09819236e5b634b47bf5614fbd62a9d84bc548c18590f35bebc9a9fdef076b546a9ecfb06eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297962, "uuid": "80bc9e8f-83f6-4b1b-9320-801220a34786", "value": "T1B2D4D081B39095D9C4B88430C693CE71CA317C64DB28569BA7D4BB6F2F32AF1653731A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297962, "uuid": "0a3b46f0-d163-4c77-b860-c392fe1b007e", "value": "ebd1eabd331d8362641fc5a98d7445a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297962, "uuid": "23878fa4-fb9e-46ce-892a-615281296f82", "value": "12288:172QPNjcXc8XM3lRkRc4YFwjsWAfRgantPbcTTn7axerx7:NpN4MWM3/kRc4lAgantPbcHn7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685297962, "uuid": "cf077acb-2d56-43b7-b3b2-dd1455ce8ca5", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685297962, "uuid": "7fa18680-0b09-4ce6-9d11-871e86455c94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297962, "uuid": "ab20d168-c0e9-405b-92f1-91a170dc064f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26cd118f-fced-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685233100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685233100, "uuid": "16d4158a-3608-4c4f-a311-041a94dce18a", "comment": "Malware payload (Smoke Loader)", "value": "fad9b3d3d9c4712e130e0d232c3a1ff4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685233100, "uuid": "4b524e06-cfca-41b4-bcf9-87d1fa5d22a6", "comment": "Malware payload (Smoke Loader)", "value": "0297db387476575d1e8dea19a04f088af54732b9053404734901585e97ef23be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685233100, "uuid": "0de16a06-de58-411d-89e0-dfde171b1d69", "comment": "Malware payload (Smoke Loader)", "value": "385507607e30fe809ac7070fa18b035db1009afa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685233100, "uuid": "b63d502f-f6aa-42e5-9dee-9e760a3519a2", "comment": "Malware payload (Smoke Loader)", "value": "5c836f5d2214515c71fd9f393366a0f666430d5a941058b48e5a4709889fe203ded593f5ddd025543f87a726e91b7a48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685233100, "uuid": "57cc4401-e981-4b83-aa87-7c881237594d", "value": "T14C543D0396E2BC54ED664B729E2FC6ED761EF2508F19B76921185A1F04702B2C7B3723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685233100, "uuid": "11b0ba53-b542-4046-9e3c-3a184f726a54", "value": "d302e4ac3406067f8ed838633897aebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685233100, "uuid": "0750205d-b5fb-4e81-beba-8918614d58f5", "value": "3072:lzvD8VGtBA8QS8F1patOpgVv6DGCsXW6x1nRvIfs/hPd5gG+uGvAjM:BD8VGLQS0Pak+Vv7RXms2GHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685233100, "uuid": "6715b75d-15fa-4261-8ec2-b1629a811259", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685233100, "uuid": "281f8a30-77f4-43db-b52f-febf4c728f3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685233100, "uuid": "15df5136-853e-4c0f-86c6-8547ea23261d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c45e4da-fcef-11ed-b3cf-42010a9c0076", "comment": "Malware payload (XWorm)", "timestamp": 1685234049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234049, "uuid": "3be076f6-bf18-4ba9-b50c-489843a5ae55", "comment": "Malware payload (XWorm)", "value": "c81e5ecd50fda5d5162ce5c920bfad15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234049, "uuid": "d02e6566-a41c-4e69-89e3-97170cb5809b", "comment": "Malware payload (XWorm)", "value": "02aa8d694fcb141522227f5890d5750d3759aa3ed20d6fd6d124d867db894186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234049, "uuid": "0fcb09a7-71fe-4afe-9a05-0a3789b9b608", "comment": "Malware payload (XWorm)", "value": "7b8929cf91b1cec30ca058117a2fade8d853cef6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234049, "uuid": "9d5adbb3-f529-43cd-bec1-61432dab1135", "comment": "Malware payload (XWorm)", "value": "cf51bdb882aec467bcae23b97630a5990b8483d4bd1392ffe7159b2baf91e0d928aab852d9c6ec44e173ca15c1ce2e26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234049, "uuid": "1f98f745-cf4d-4d6c-bc1b-7a83405d128a", "value": "T15D336B6CB7E14135D1FF6BB56CB6B226D735A3174913872F38D900DA2623A9CCA007E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234049, "uuid": "02754705-597a-483b-a309-46483337decb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234049, "uuid": "d0c18bba-25a0-4cf8-bb2c-91c46cce710b", "value": "1536:K7c2/5rEItNHHc7lwKDjXgebhO+YZbWwAXWvO3kP0y:K7c2/5rncxFHXgebhOdZbWXWvO3ksy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685234049, "uuid": "9e0e0cb8-ab89-4691-9289-117c371006e6", "value": 52224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685234049, "uuid": "6443aaf4-89a4-42cf-a24d-71c88f06dffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234049, "uuid": "93ea8e8b-2633-4dc5-a2c0-72799fda308e", "value": "jango.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb9226e-fd8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685302556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302556, "uuid": "83bc71b1-958c-4f4c-9263-f07348780524", "comment": "Malware payload (Gafgyt)", "value": "6d847da296e87cee4ea39a1c6b5b2771", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302556, "uuid": "745d139b-aa65-4740-bca7-7a768adbd22d", "comment": "Malware payload (Gafgyt)", "value": "04617062331065203ec328029e3691c2f637cf342c5f1363b132252462e87fe2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302556, "uuid": "6d7b6aa9-9a71-4ba0-9759-450110c31724", "comment": "Malware payload (Gafgyt)", "value": "6929b9586fc15f642b10771974d592efcbbd1b7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302556, "uuid": "09ed08da-d7f9-4ca3-a396-2eee0c86fd96", "comment": "Malware payload (Gafgyt)", "value": "f746f2bcdd4c18041ec389b2bd42c3b308382492df86139afeffb16f167f9a4ae640b992238644d06d9482e6043af289", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302556, "uuid": "d32936cb-9bdc-4947-9509-71979b89e269", "value": "T191933B56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F3A0987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302556, "uuid": "2d07827f-2115-4bb5-821f-590d4a4d3cd1", "value": "1536:mzqmXTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2emrGMUNLe5um7WAgcVjmZIcBI:mz52UVUtBUI8GwPfHkk8rBeLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685302556, "uuid": "d8ad2e6e-5312-4c07-91aa-2bc626d0b721", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685302556, "uuid": "89da47de-4f99-43f1-afdf-9c805db20d7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302556, "uuid": "6f0a7765-d05c-4d13-808c-e98416e62512", "value": "6d847da296e87cee4ea39a1c6b5b2771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d602a58-fd27-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685258129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258129, "uuid": "19d7b925-2420-4c8f-8241-cb73afb163e0", "comment": "Malware payload (GCleaner)", "value": "fad0be4aa6fb74b5f083a39faa753ca5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258129, "uuid": "00b21b79-ffa0-414f-9a06-68cde98bc396", "comment": "Malware payload (GCleaner)", "value": "04e4112e33bae95be1b7d00d1801772d09dae6ced5b91fd4de03b2929641ba7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258129, "uuid": "315a0689-2d3a-4305-b5af-9162a0bf19d2", "comment": "Malware payload (GCleaner)", "value": "b1413ed8bee187933ecfa9abb5bc3ba80fe7b8c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258129, "uuid": "b9c1106a-2a49-4926-8747-82b61b8a2ce2", "comment": "Malware payload (GCleaner)", "value": "ea7aaec4f189c38654044b7878c77b81734e408e3aff57c18af67e20e94cf9e3d39a6b0ee751efd889c3afdb6b02ddd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258129, "uuid": "a3c85210-8c52-4e19-b4b3-ace2cd40091b", "value": "T1B5747B1392E07D50E9264A33DE2FC6E8771EF2548E193B556228AEEF18F51B2D173381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258129, "uuid": "aaf1857a-933a-4937-9743-be3236387d67", "value": "bd191f6a78cc98a8bbe61db18ad8e9a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258129, "uuid": "76c868a3-51a0-4d60-808c-c5619c4eef39", "value": "6144:mobJN59AQMjc1EOi/2ZXkL5d6Qx9VZfs2zS2kuYH:mo9FSjc/i/6UL5wMTq7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685258129, "uuid": "5182e17b-bd5c-4524-a7a1-7ae17bc6de2e", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685258129, "uuid": "19dcb4d8-8066-4216-b195-1b58c37604b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258129, "uuid": "bd9c5c9e-0a65-4f47-bd84-dee657274c43", "value": "fad0be4aa6fb74b5f083a39faa753ca5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34be0c5-fd8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685302565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302565, "uuid": "545349fe-456f-4f20-8f2a-73852f79e530", "comment": "Malware payload (Gafgyt)", "value": "09658455030f6478cf37e88e92faf04b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302565, "uuid": "bffa1571-382d-4380-abd9-14a9b4a0e662", "comment": "Malware payload (Gafgyt)", "value": "05cd258d2cd50df395caa4df8691c52e02c024e5aa5642ec82f68a968eebedca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302565, "uuid": "e4b8deea-7d31-4e94-ab07-1846d2a68bc6", "comment": "Malware payload (Gafgyt)", "value": "406aaac6f2f73992cc12a1d3f2b20c322204c9cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302565, "uuid": "d59132d8-b484-499c-9039-91480ca2615d", "comment": "Malware payload (Gafgyt)", "value": "6acbbb3f174c5a9d868b2634fbb490c6c48a3ada6058a2b52200e0109ef582f9daa31f6848d112f1da7b184f69552132", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302565, "uuid": "0cc864c0-581c-4af6-acc4-731813060b7c", "value": "T117E3866E3E21ABBEE16886310BF76F70C39529D636A19342E16CF7185EB124C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302565, "uuid": "c623f321-4186-4786-892b-2de8e58517db", "value": "1536:mVNs7K797V+nv57gbj6l6T6B6v6N6/6AePe1ebeZe5bwClA2rKQA1dXAQTI/e0hd:vY01ZkXAQT4NM9//ImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685302565, "uuid": "7f931978-09b9-4a7a-bcf8-a48d9eeadd46", "value": 152121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685302565, "uuid": "ee7a5f3d-ccc4-48d0-9973-172a0561cc4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302565, "uuid": "6e1a7f92-8985-40a4-9d97-b5b7ac45642f", "value": "09658455030f6478cf37e88e92faf04b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e46495-fd52-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1685276716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685276716, "uuid": "bc39c3b0-0188-4472-bf71-dccdd7533fde", "comment": "Malware payload (RecordBreaker)", "value": "40dcb3614c663e7ef659044a6514d446", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685276716, "uuid": "4a35c796-011f-49d1-bdf8-635f4952b342", "comment": "Malware payload (RecordBreaker)", "value": "069b749dc167bae6560ea3f73a461184f0380f6ae3ffcfc095488063da4f9554", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685276716, "uuid": "5fbd95ca-7cf3-46da-9786-3575599402c0", "comment": "Malware payload (RecordBreaker)", "value": "4c25245ddbea2d5fb5330ce333d313a4973e5b98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685276716, "uuid": "82e1c21f-8711-47cf-b1a6-da998229d14c", "comment": "Malware payload (RecordBreaker)", "value": "8422a93ed20409c3ed1ae9c9e52c6b9e14c7033ff3ce1369b8fac4dc356087752f442d6eb95e3f4c8a2c7f0feaed9ad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685276716, "uuid": "3a316e6a-b252-45b4-be52-bd02fcb8eefd", "value": "T1FB54185392E17D54E9764B729F2FC7F87A1EF2508E5977A912189E2F04B03B2C263702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685276716, "uuid": "ebacc930-a81f-4a91-bb6a-88863d0c9cfc", "value": "937554e81340ac479b370382e43a74d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685276716, "uuid": "810dde1a-4e5d-4057-aa55-caf9be367009", "value": "3072:5NifDzAVBXaRLmIuLQO4RfI0NlusQ8+kdMEuj8hxdd5gWw9KDD5Qj:afDzA6RcefIq3Q/kWEu4GZYDDej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685276716, "uuid": "53396cad-f992-431b-8c6c-1e90fcbe41cc", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685276716, "uuid": "6fe444b3-3a0c-41b8-811b-ac175544e254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685276716, "uuid": "af2a8023-da04-4a08-984a-64675189c3af", "value": "40dcb3614c663e7ef659044a6514d446.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad03ea5-fd1f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685254823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685254823, "uuid": "ff57f32d-c4cd-419e-ba37-ed9205051cc1", "comment": "Malware payload", "value": "bc3289225be4c8b918d553d3ca61fb09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685254823, "uuid": "a12c867a-3bcb-4e8c-9807-2bfaf3123248", "comment": "Malware payload", "value": "06b3dc3c5631305376784eff267f46077c092b0d1a988cc28486352facc0fc2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685254823, "uuid": "0646a095-b0df-45c1-a2d4-062abf8a9a2c", "comment": "Malware payload", "value": "bbbdbf518bf8c6136f67a79ab856c471f94c3f30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685254823, "uuid": "bdfe2a79-c6eb-47a1-a96b-7fb201fcf15f", "comment": "Malware payload", "value": "3f7e95cc6417352b135e75682ec78e56e3574576ea5d03ea47d765a560137579ba0b18a7ba8ba32edf5587d094b9032e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685254823, "uuid": "132579a8-e0b9-4b16-8f53-235df3a0f999", "value": "T140C4BF0176C549B1E17225325A75DB30AA3F7C201A758ADB97CC4C5FBF736C09A32BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685254823, "uuid": "c7c5f9cd-015c-4fe4-8d2e-497719212c6f", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685254823, "uuid": "9dea3024-0a79-4a73-ba45-538f4d3ead08", "value": "12288:lgZXEAO/BUdG3gVdt7Kjz1rJsUHC5itTndOXSo:lgZXoZUTVdt7Kf1FfH/rdOXSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685254823, "uuid": "1add62a7-8e76-4833-89a3-9a9376a93a39", "value": 544445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685254823, "uuid": "4e78acb7-093f-425c-b1f2-201012686213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685254823, "uuid": "2d06d803-1e7a-43bb-b59a-08f0ca9238d6", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4d549e-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685299953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299953, "uuid": "283b4be6-2234-4475-92e2-303e22cc7762", "comment": "Malware payload", "value": "3af3e3020edece9faa2f0c61be19ce08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299953, "uuid": "5240930b-0584-4d5e-8f2d-f9f1f6c6e10f", "comment": "Malware payload", "value": "06b8b32eec0f6c1e627dc3654bc7f7768e63be391d26bdc5887f8ec41797f8b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299953, "uuid": "ba0b88a7-59d6-4ec6-9e03-3d53c39b55fb", "comment": "Malware payload", "value": "745ef4b38358a25b66c726856fb97b38cf36139f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299953, "uuid": "c49fe693-e332-4257-b03e-54b0f97953ac", "comment": "Malware payload", "value": "280c3acc637835ad9756839641d29f55031f69c118b523c66bae12d7da06f52e02b7c6d5c9b7078d4441dae96366148b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299953, "uuid": "98f3e3e2-64b6-4349-bc56-3c5f36296698", "value": "T160535B02B71C0E03D4A31EB0253F57D093BBEAD022F4F684255E8B9A9A75E365582FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299953, "uuid": "0766f8c6-a371-4946-b7c7-606a4822bff1", "value": "768:BwRlSshR+wdRpqRNhpQR7dYG6hBmAPJy2dEMRg/89DS89vqziWNNIeFV+trcwW/1:KRVyBYYkeyQdLDSWCziWNCK+59W/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299953, "uuid": "04dd3668-42a2-4a4c-863d-9c2b68abd4be", "value": 65220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299953, "uuid": "9607d8ae-9f52-40a9-9670-2f87acfed3bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299953, "uuid": "e6d7c9e8-a3ab-4619-a79a-8ba9aa13a351", "value": "3af3e3020edece9faa2f0c61be19ce08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27ecf41-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685299880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299880, "uuid": "3b77def3-109b-42f7-9923-bfeaf8041e6e", "comment": "Malware payload", "value": "2c132f255ce5b716ab2b51413d540f6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299880, "uuid": "fd85b5f2-a5f8-4399-9cad-6350ac620e8c", "comment": "Malware payload", "value": "072b6ff3174f236b67a2f5689109a4341cc2a592b4772f09d1c54a7fd49be4e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299880, "uuid": "a86baf67-e53c-41e6-a2dc-189e005a6fcb", "comment": "Malware payload", "value": "ef0ddb9a65f74ed7bc1c51937ae2c16d4b333a7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299880, "uuid": "f200dbff-8e32-4d28-b6d0-8f08cd4d2738", "comment": "Malware payload", "value": "59987677f3253196881bfe642f1921b950ecf38e24bb8532ed9a1b64da9b00dcc9c169378c0e47cd1bd1f56125cff122", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299880, "uuid": "b384b1b4-eceb-4cab-97f9-76d7a9eb4672", "value": "T1F5634B99F801DD7DF84BD77F4457090AB930A3D142831B3A6797BDA3BC720A92922E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299880, "uuid": "116f4a7e-6088-4b68-ad85-b935bb6fbdc5", "value": "1536:DqofWnSA7smdDsD4D5G803jF1kxfh7VdJHrCFvoK/Q/A:Dqo+nxsED5WF1ufZV/lK/eA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299880, "uuid": "a03c96af-9e6e-411d-a6f4-87fa08f2027e", "value": 71808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299880, "uuid": "e5c4e6b2-3cf2-4a54-a4ed-058be9204498", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299880, "uuid": "8264787a-c1fc-4d45-96a6-8a6a626485f3", "value": "2c132f255ce5b716ab2b51413d540f6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63509b84-fd81-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685296767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296767, "uuid": "f0d92fb4-909d-4017-8dab-727e81b70cb3", "comment": "Malware payload", "value": "41137f7416ece144472d99d51b2ea517", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296767, "uuid": "d6bca018-e41c-438a-b191-e1f31d7276c9", "comment": "Malware payload", "value": "076fd3678bde1a6faf413b3dc4e478f8fe2b36869a0b94f2210102537f8cdb21", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296767, "uuid": "35213136-0b94-435e-9a5f-636faf960187", "comment": "Malware payload", "value": "eba9a868c7794d2633fcc38d9ef4d6b190b72e07", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296767, "uuid": "142f77b3-ff68-4c02-9555-1f8cc62c91c8", "comment": "Malware payload", "value": "5b03df440234b71877976d6d047d69ccc4331b3a820db71bd8d815e5c667fedb8a749aefab811bdeb40e21e1c7534266", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296767, "uuid": "da987ed0-8cee-4034-b0e9-63c453dcde71", "value": "T1AB13E78DB694E174D5FF8BF1B4A1B2890B71A017A806930F99F114D98FB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296767, "uuid": "8f63c8b2-583e-4f2f-b9e1-8fa5e32e3a00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296767, "uuid": "c689fddd-c274-4f4f-ad81-c98e4223100f", "value": "384:J8ZySa33VarE8yTNJFqfQYMEnwpai0+dzEIij+ZsNO3PlpJKkkjh/TzF7pWnNmgm:J6xq3MY5TnFqfpMpLuXQ/ooC+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685296767, "uuid": "7a51b0d4-1cd9-40e9-b8dc-abcf5d7ff74f", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685296767, "uuid": "468d52d9-3706-47fe-b42c-5e484605587d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296767, "uuid": "5fe8c8dc-8d0e-4a4b-8889-9e081a0ef36d", "value": "08805499.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55813a83-fd7d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685295026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685295026, "uuid": "c56a638a-d390-4b8d-88aa-969067f85d36", "comment": "Malware payload (Mirai)", "value": "896adeb11222c4cc53311bcc4bdadbf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685295026, "uuid": "5fdd331c-f47a-4904-b55d-ecf807653bfc", "comment": "Malware payload (Mirai)", "value": "07fd0a4d340b20aadc0a185b0aee303bd55375afdce4d74be2bfae92ee074ffe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685295026, "uuid": "248f78a7-8198-471c-a1a3-d0b11e7e7d33", "comment": "Malware payload (Mirai)", "value": "f25580beaf165c0d19b49014a15e356a137a1ff8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685295026, "uuid": "27db39f9-5dd1-436d-98cf-02001441c285", "comment": "Malware payload (Mirai)", "value": "3e3073f6921631b5857928820ab92077d7f0ab41e79b3019a51a5497a959246f623735247a887572217b40ee06ce34b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685295026, "uuid": "3b87578d-a987-4e2d-8b34-7eec40907f46", "value": "T1D8536DC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11A02D11639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685295026, "uuid": "cd94941b-648d-4bbd-ba9f-58461c430430", "value": "1536:Z7qARubgzY/bEJynRcpk80LDHhklv4JQC9DSW:NP+eY/bEJZ4XBk9AP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685295026, "uuid": "0080ed16-3a41-42d0-bbab-f3e30fbdc52d", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685295026, "uuid": "60571b7d-5f69-42c9-b766-1e2cbdeb1b35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685295026, "uuid": "47ca1212-d748-4155-8ecd-4dbd2033c92b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19624d32-fd27-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685257988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685257988, "uuid": "a6fa0342-4aa9-446e-b717-a1c767644516", "comment": "Malware payload (SnakeKeylogger)", "value": "ae8c7734c1811f81ebd78183adaee2cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685257988, "uuid": "83841947-ae82-4552-88f3-966c9cd087e5", "comment": "Malware payload (SnakeKeylogger)", "value": "097f5dbc2976c1c2d16d12031bf0fb805f1212c695d9301877e00fc63591b240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685257988, "uuid": "d31ff180-11bc-4b18-933c-42e37d2661dd", "comment": "Malware payload (SnakeKeylogger)", "value": "3b2e55132e36664d52296b7b654eefbc40f59c6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685257988, "uuid": "5dda94b9-7ff9-474b-aa7e-a37fc4d7fc6f", "comment": "Malware payload (SnakeKeylogger)", "value": "94b177ef29b25f07b6d319f593f98508b3bdf7fb81e034b5017f09e77ec0a5500ac7781e7f2c6e033844132abbad9fa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685257988, "uuid": "08ffd207-dbf5-46a5-a354-e8b6c4787227", "value": "T1F9D42204127E661BD4EB1FB9882417B5033E5B9EB532E7A34E88F0FDAF01B8B154954B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685257988, "uuid": "70110715-c694-42c0-a471-70c06a8197ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685257988, "uuid": "d22fa117-bd77-4883-be4a-0438427067bd", "value": "12288:ImtPplTY6RhKuK/gIgxDX2oOCokFZ7c4a0UoDg/P6O:ImJTDEzjyLa9yg/PL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685257988, "uuid": "476e0847-562b-4883-9e50-6195ebb366a5", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685257988, "uuid": "2d4080e5-9041-44f0-819f-40f6d0cdd7f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685257988, "uuid": "bd27cec8-c52e-450a-8278-b332e1b230ce", "value": "ae8c7734c1811f81ebd78183adaee2cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39216450-fd80-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685296267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296267, "uuid": "435bd2df-de35-42ec-8dfb-e592bbdbdac3", "comment": "Malware payload", "value": "ec1255400b92ed7409929f0d89e1f992", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296267, "uuid": "764eb8ae-7c27-4838-99cd-3931595b38cb", "comment": "Malware payload", "value": "09ba59540b90eebf1e468503d9057b65c4d3f7b3ad229d2b144d8ea2ccd0a1e0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296267, "uuid": "ba5e012c-dd13-425f-891e-7d4dc7145e18", "comment": "Malware payload", "value": "b9802163ae4dbb85e50143a51fbb4f2337ee2466", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296267, "uuid": "fed973d7-14c9-47ff-a92c-3cfdee90d6b2", "comment": "Malware payload", "value": "a9bc275891c4bdaabbfb87e1fe43c92e890adecd2efdacea64dacf7b8add1d6147b07b2f52364cf3d22a7088d8a6b1bf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296267, "uuid": "3661010f-26f8-4468-ba6e-d029b37d221a", "value": "T1D306D842D6D91E90D4E14BBA263AD700933E6F84A25BA22F1325721F2D77F0C8DE5F19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296267, "uuid": "78e70c0e-f4a8-4813-b004-e10b5c031cfc", "value": "9ecee117164e0b870a53dd187cdd7174", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296267, "uuid": "7bf67d86-1533-44b0-96cc-b70d2b59daf9", "value": "24576:2bLgddQhfdmMSirYbcMNgef0QeQjG/ZtnfFpoMuS82h54kDDb346n04a8/74/t1G:2nAQqMSPbcBVQej1poMr/5r3yM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685296267, "uuid": "98d69a49-78bd-4596-bba0-39294f8acba7", "value": 3723264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685296267, "uuid": "7047891b-2cf0-47c7-84a6-b1fb19d40c31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296267, "uuid": "a9f523ac-b345-4560-ac81-7a5b1439ccc6", "value": "02353699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62d2614-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685299940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299940, "uuid": "d2570394-5db9-4222-bd9f-92eaa2e920c9", "comment": "Malware payload (Gafgyt)", "value": "a5f90f58e2d2f2f7183ef035dbba2b05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299940, "uuid": "8b86ed22-5ac9-4532-ae66-7a53abf667c0", "comment": "Malware payload (Gafgyt)", "value": "0a074aaf31a9754df28cabe88b031b1ffd006599b5faa5d9646638a10410ff21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299940, "uuid": "8e09a191-17b1-46f2-a9e6-9f34251fd7a3", "comment": "Malware payload (Gafgyt)", "value": "657aa3f3df6e8a84246e03b90cf00c8e124d26ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299940, "uuid": "95a0688f-6ff2-4d6c-9034-bf8019522fbf", "comment": "Malware payload (Gafgyt)", "value": "24e2ece6615dac2e3d68d0525a242d70cde546ea1e741fde9ef6f0e5ef63805ff4e7b9ce4b79b0832a3acf0c40049b48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299940, "uuid": "9f220824-c935-43e4-9b8f-04576e0ead6c", "value": "T1C5933B56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F3A0987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299940, "uuid": "969d2696-e574-41ff-8dad-f7352f2ab5fb", "value": "1536:msqmQTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2emjGMUNLe5um7WAgcVjmZIcBI:msi2UVUtBUI8GwPfHkk8r1eLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299940, "uuid": "139b5b0f-abf3-47f0-9f3b-8ef7e846bff6", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299940, "uuid": "0575773f-fdaa-4969-95e7-9d54491a6ff8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299940, "uuid": "c04bbcb3-1a5b-46a3-9968-b5b447423bf4", "value": "a5f90f58e2d2f2f7183ef035dbba2b05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5e4018-fd84-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685298291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685298291, "uuid": "c380ea2e-eaca-4d1e-8a1a-a1ed7f1579d6", "comment": "Malware payload", "value": "e854040050be5dbb687209732e9d87c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685298291, "uuid": "7afb005a-77bc-4024-bdd8-fa0a0b5dbc92", "comment": "Malware payload", "value": "0ba5e9903774f1cc2f322a22033e07915efc7153dda7a84c1d4cf6456a8b5bdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685298291, "uuid": "b8096d38-748b-4f87-99df-25fb93719528", "comment": "Malware payload", "value": "89e22ea8738ee699972f2ee7840e7fa4faeec2ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685298291, "uuid": "aacda5b5-0867-4c0e-921d-5912d393ba01", "comment": "Malware payload", "value": "7054b9c6d73634e2ff0203da33e518a6db04d5d9637e8e3878493924db8de15efb65c5cd9a19a85c614b4fdd703d8c9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685298291, "uuid": "c5835e13-ee81-43df-9e29-c1ba25a88ea6", "value": "T169051216B6CC1536E8B123B51CF21B930E367DA12978437B27159D6B4DB3AC0B83176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685298291, "uuid": "b1bfd038-3561-4207-a7c9-4dc6418716d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685298291, "uuid": "bbbaac51-ba34-4c5b-aa87-bc75ac6491ca", "value": "12288:dMr0y90GjUvZMS9BAQkXGoNmRYjNJWFUM+t3SAdXUHipKyVFlkN3rv8fjwc:RyBUvOA+Q0GVSZJWKCAd3pBFGN7kLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685298291, "uuid": "4f927f79-f938-4dd4-aa83-387d167c594e", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685298291, "uuid": "cbeb50a6-e675-45ad-8cd0-8081f32ad74c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685298291, "uuid": "df5f264e-14da-4f74-84a8-80a58a6c670e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab13a6a-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685299867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299867, "uuid": "b92fd250-f879-4401-b5d0-19f7cd7f93d0", "comment": "Malware payload (Mirai)", "value": "0a18dff4e9acbff5af64a614a59dc387", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299867, "uuid": "119547dd-05f5-494d-999c-04799353132b", "comment": "Malware payload (Mirai)", "value": "0c6510723a8bd6c79f2f5bdd2881a6d9096b278bbdfa43cfd2747223deb55f5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299867, "uuid": "3aef75f5-076f-415c-8ce5-1232e548e7e3", "comment": "Malware payload (Mirai)", "value": "3aa13c951d84852b9eeab7bbbd943442aeaa69bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299867, "uuid": "d96ed5bc-7bc0-45fd-b7d2-97d46f9f11cf", "comment": "Malware payload (Mirai)", "value": "00fbde5f3087373cb3966cdf1c821f3540eecf93b4106eb9f8c59737625db1ae2cb9015d17c7e7d44d52ab8d36e4475f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299867, "uuid": "7ff565e2-6a09-411c-8028-e97d6c163861", "value": "T1F3434A50F8819623C6D1127BF66E468D3B2613E8E2DBB3079E225F2037C686B0D77E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299867, "uuid": "aa027b17-52b8-4707-8bf9-3c128962ccb4", "value": "1536:pjzQgyzv4qsU9K7U+0FQL2g4TtiCsyXvqn9:pjoE/0qLh4p9Zqn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299867, "uuid": "ab60fd9b-0d97-4914-8ed2-77e3fdf03808", "value": 59640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299867, "uuid": "884f4a97-ac6b-4efd-bbaf-0bea5ff06286", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299867, "uuid": "5610f1db-886f-4be9-a5bf-2bcf429bcbdd", "value": "0a18dff4e9acbff5af64a614a59dc387", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1491f0e-fd63-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685284067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284067, "uuid": "0e6cb6bc-9253-409d-b48c-01e1d48ad4c0", "comment": "Malware payload (SnakeKeylogger)", "value": "bfba47a7bf66791b7063200296791246", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284067, "uuid": "75185cb9-5e40-4d93-978b-d39c12be03eb", "comment": "Malware payload (SnakeKeylogger)", "value": "0e61f26144aed994bb81781ad31813ff3e3fdc19767c07784e18ac73bf2a63b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284067, "uuid": "7d470652-0030-4c6e-96ad-420ce218596d", "comment": "Malware payload (SnakeKeylogger)", "value": "758070d667146b6f070562a4ae0e6deac4378b87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284067, "uuid": "142f6451-a37f-4c39-a6a3-903ad4c9c37f", "comment": "Malware payload (SnakeKeylogger)", "value": "3d549c7b198e37a37f1baf3d1fc27d59ed1bbf3307aab3268cda0d235b730ce8079ae7ebf928abe1f757a39c91841963", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284067, "uuid": "b04c6613-40ac-4dee-b8c5-82bf7c543eef", "value": "T11635187D0EF547DA826BC664DFC8DD27FB24941BEDC4AA6808C607537242A4FB0861BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284067, "uuid": "4a0e0ba1-55fd-49b5-a2bc-3075e5346cd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284067, "uuid": "b4dc8ac9-958d-4081-8670-4d994e87290b", "value": "24576:k7+m1BvLk7zsDGqdY8NlhCAcbTHV5pGaAZ:kscDJ3NqAaTHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685284067, "uuid": "6eadefd1-f1a9-43dc-aeb0-3951748d20c7", "value": 1127424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685284067, "uuid": "97c05968-7cf5-4744-93f5-fe8e735cff9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284067, "uuid": "135b002a-12d2-4817-a21c-932cebb955f3", "value": "Payment-086767.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3301f1d-fd63-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685284124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284124, "uuid": "bd14b45c-5a26-4bc0-bccc-a3ea0b1ce1ec", "comment": "Malware payload (AgentTesla)", "value": "ccf0daaab9259ad8f8c19a03c347e37d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284124, "uuid": "d504f995-1724-4b50-b9d5-c4ccd62d57dd", "comment": "Malware payload (AgentTesla)", "value": "0fa74cf4ff97d9687aa53285f66180f822f7c200eff98a77e36d848ceb36155c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284124, "uuid": "2ed57ce8-ff63-4c26-804e-7cbf9f21938d", "comment": "Malware payload (AgentTesla)", "value": "bab20ecc7d8dd0271669c6a6c2fb2790a86e1a0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284124, "uuid": "dbadb0a3-c2b7-48cf-9a7b-c622714d5aa9", "comment": "Malware payload (AgentTesla)", "value": "be2a27961c803f71cfe34fcc16bc698c3bb95ca2dd75bdd241c5edf13d1358f14b58bb0840b1550a93a8d9ea07a5f239", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284124, "uuid": "a52f42a1-213c-4034-b67f-c3143f0f64a4", "value": "T14E05F1AC31D31D13D79AF7FF885139B4037A7A063467D60A2AC423D9AE52FD1A401B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284124, "uuid": "fb2f0c3d-0573-4392-a162-c79d5592099a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284124, "uuid": "3f112673-af42-4d98-b301-c429e45e940d", "value": "12288:CBFc7z5GoJiGaq5aumquJBlcpptUud+A+88/ZpeGQf+ckX:y85GoR5a3gld+48xpeGQqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685284124, "uuid": "3441eeb9-f58a-4707-8206-f1822f1ad1d4", "value": 799744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685284124, "uuid": "c062d263-6027-42a4-92cf-88054617615d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284124, "uuid": "c706c1cf-c2e4-40c8-9b8c-9b08c5535422", "value": "Curriculum Vitae Debora lopez.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ee3984-fcf0-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685234578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234578, "uuid": "f9e153e2-6b62-4e70-8954-15d7470ced86", "comment": "Malware payload", "value": "e22ffee57a49fa419b65b484d6ea62b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234578, "uuid": "f91ff737-4b96-4bb3-bd45-3b068f30059b", "comment": "Malware payload", "value": "10c3b61ee321398d021fcb8981eeac2b44cdefc2243a36d7ea4dee1d5dd81bbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234578, "uuid": "f819ff2f-7d13-49a5-8b2b-417fc869e7c8", "comment": "Malware payload", "value": "fa6aa394aff8c1333570bcf2805de493dcb6144b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234578, "uuid": "28eb47a1-b0fb-4975-9a81-a6e0c54b1c7c", "comment": "Malware payload", "value": "9dfe79ae231292856f28bfaa1aaa4507ce1a5cb45ff9ca217b18c33962453de7140f3d4f37c7d368bb5f1f7141d8827d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234578, "uuid": "0dc00df2-959a-48e6-b50f-f612c0005efd", "value": "T1C7763304A7940CE9F5A7003AE5A09915E1B6B8334350D9CB9B78D2274FA7AF47DB7F80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234578, "uuid": "20bba8f2-e35d-436c-b5e5-4a0156bf55f7", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234578, "uuid": "e9b2408c-cde0-4367-9837-2e245a6284a3", "value": "196608:7lxnNpICteEroXxDVfEqlbkkwR7VTEmLEN+x0SxDTnBPG:ZpInEroXzfEqirRRomLo+uSxDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685234578, "uuid": "0fa2c62d-822f-46a6-a4b5-931cd7db412f", "value": 7354630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685234578, "uuid": "4388054d-9380-4842-9710-7af0061663a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234578, "uuid": "e2aae01b-7de6-4ff2-923d-f07565bc2c6c", "value": "explorer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1829b3ba-fd27-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685257986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685257986, "uuid": "114ecc92-a9f4-41c4-a789-fba2de6ce549", "comment": "Malware payload (SnakeKeylogger)", "value": "0f51a3b984003a24b73266d958d515d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685257986, "uuid": "57717855-d195-459e-aa7b-db2cefe87965", "comment": "Malware payload (SnakeKeylogger)", "value": "1237eec0287f5d0590ef5a8d6bc33e37c3f1384ed1ee265645f8efa054255f38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685257986, "uuid": "f123f064-c747-4e4f-96ba-cf2b463043dc", "comment": "Malware payload (SnakeKeylogger)", "value": "5203dfffc39d5e8706a00a003121352a148a7853", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685257986, "uuid": "3149ece3-dc4f-4c8c-bf12-1de9dd4dd657", "comment": "Malware payload (SnakeKeylogger)", "value": "9d7599f692d749f7045ac3cf9a5497cc19ee820ee3d1a34ee9f2d810daff5ac7a61df8d92fa965327f06fa603dc5fbea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685257986, "uuid": "dfa58855-4de2-4566-a4b8-9f0edaeadebc", "value": "T12FE422D86AC65729E9B70BB142646BF003BFAF6634A2E1675D87F1CCDF16B080150B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685257986, "uuid": "b630a21a-45e8-41fa-8b90-7463cc31ec7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685257986, "uuid": "20e7586f-ef04-4b1a-8e16-b69270513ff7", "value": "12288:UaWIm6lVvtzZBEP859h42YdZRP66J6eVNArN0cXiPbL6VrTa5Hhas9o:ZTmIt9BEP8TItC6keVNAr1iPb55Bt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685257986, "uuid": "f111e260-a96d-4e16-9640-1dd5e726ca0d", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685257986, "uuid": "9f05b36f-7dd8-445c-8f98-fb016d5d13a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685257986, "uuid": "1e31b737-fc49-4e0e-b5d6-4f3767a44e33", "value": "0f51a3b984003a24b73266d958d515d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9316a24e-fd7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685294270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294270, "uuid": "3532783e-46a2-46ba-95b6-730d17a1e007", "comment": "Malware payload (Mirai)", "value": "c28451dc4e279fa9ef5a78374aef7321", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294270, "uuid": "f24b5cee-656b-4118-9878-35638f8382a4", "comment": "Malware payload (Mirai)", "value": "12dcfe7bcdf52f852c6609fbcf48cc39d005fbf2f1cee80527acbfa649115925", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294270, "uuid": "7732bd1c-5893-42d1-b4ce-55a39d16f9d1", "comment": "Malware payload (Mirai)", "value": "1a17da3d7a98da0c0442a55e1bad107501b73663", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294270, "uuid": "e3e4b73c-d372-45a4-8298-e6fc477e3cd8", "comment": "Malware payload (Mirai)", "value": "c35efb6198c75c3ccee39c7c783595b91433e3ecf4e17ac4b96e4da8b795eb6aafac6bd31659cd4562e65f047f50247f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294270, "uuid": "f1c24048-fa0b-4ef9-bafd-bbc31385f101", "value": "T187635AC89983E8F2EC1616392477BB728E73E03E5025EA87E79D5677DC02622D50339D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294270, "uuid": "b3cab937-0ce2-4ebb-b55b-1aff04406628", "value": "1536:UKk9cTd8k0OF4Rm2imkbyJPkFYjSF4BKf5o68c2HhMbD32:O9cT3LFs8oUcKf5ZVway", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685294270, "uuid": "c5f0f824-9a0d-429e-92cf-3018eedf464e", "value": 70736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685294270, "uuid": "3613f375-881a-4b8c-a072-0b16cbebde15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294270, "uuid": "e9dd82f6-7abb-4e3b-80cb-d812bfa9f996", "value": "c28451dc4e279fa9ef5a78374aef7321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4a09a4-fd83-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685297566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297566, "uuid": "2a842085-ac0b-428f-a30e-3a6e250b80fe", "comment": "Malware payload", "value": "4df7b5192d1f16e8d62324cceb27aeae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297566, "uuid": "406a9d05-abcd-48db-aa38-4892db25fb94", "comment": "Malware payload", "value": "157421e9f0949a7b659b49ba4a93c0e988c1f7aff655677a1204a22ea765b807", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297566, "uuid": "1fac0ed4-4d04-4b70-a56c-1c73d05068ac", "comment": "Malware payload", "value": "ccf7a392d3e86934340d859b0c1cc2dd98bb1c2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297566, "uuid": "0d161a68-3b87-4a5f-8751-254f4029e3ae", "comment": "Malware payload", "value": "67a738ad0f7abf983d69d4082affd53d57554ca18f62d1835ebf2894745c887c9c9ff09ac814b0da34b2e4f24791e990", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297566, "uuid": "9dc66e25-d327-4763-b469-c61d861576c4", "value": "T1A2334AC4F643DAF9EC4705701177FB339A32F5E51229E743C3A99A32AC52602A906EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297566, "uuid": "3bd0f8a4-d510-4aa8-9fd6-a61d70391ba5", "value": "1536:GWa2d5sf1Gg+ya+nlQyF2zjHDffwVsp3MSfCYF:Gt2d5sf1GCammo2PjnMW3dCYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685297566, "uuid": "41e489e8-6f51-484a-b872-81cdece0a568", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685297566, "uuid": "f78773ec-8f92-4759-8ed4-a581860eba67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297566, "uuid": "f5836afc-17ee-4626-9987-98435d1c6746", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce140f5-fd53-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685276946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685276946, "uuid": "93f972d4-6086-4bdf-8e7c-3e53ac49ed6c", "comment": "Malware payload (GCleaner)", "value": "65dd3ed482f22906e70dd004a73e5cef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685276946, "uuid": "4687bee4-1536-4490-a69d-1c212aa646d0", "comment": "Malware payload (GCleaner)", "value": "15f5d9cd2cb95efaecbf0bc1a455cd6cc301848a5ba71cc4788e4b68c327382d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685276946, "uuid": "9b05e66d-8b83-4df9-943d-be3a4ae5d88e", "comment": "Malware payload (GCleaner)", "value": "ffe8496a9d3f0a2f5571e683b466d3f3d2092172", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685276946, "uuid": "55746949-85b0-4be4-9e24-874cee9c3442", "comment": "Malware payload (GCleaner)", "value": "fddcfecf43116f30a90137151c6e991f6a97875bb34038044ac970b6dcf62b16a2ec1a7ea0ce14f6a1424a32d1e28487", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685276946, "uuid": "99451ada-78ab-44fd-8fa9-8f674adb3155", "value": "T1C1A5337192B54276E1C2C5BB6EB2CB705576FEB80660718C326DFC794E32242DC6A31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685276946, "uuid": "0d04b222-b3f3-4f13-b044-b84cb35d94d5", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685276946, "uuid": "6317e544-b518-42d5-bed3-79d33457fcef", "value": "49152:Sii/UTUrr4aL/bmKCAnjHtY4pxw2XZs8wux:Si4W64aWKC6NYGnXmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685276946, "uuid": "bc06d794-16cc-4912-914e-d6160f5401ce", "value": 2146015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685276946, "uuid": "d2984dd2-13ed-4eba-a9e9-57e0902c6a93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685276946, "uuid": "8ec272eb-7d95-46fc-9d64-0f2bd3101c78", "value": "65dd3ed482f22906e70dd004a73e5cef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ffd208-fd80-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685296280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296280, "uuid": "c31f137e-a831-43ea-adb0-1b465fe4b2c2", "comment": "Malware payload", "value": "a6eab5086cbce1877f444473643b21e3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296280, "uuid": "c2a82467-f251-4abc-a6da-4e51b7e76da7", "comment": "Malware payload", "value": "171bd709c8c0af65542cad05831218c94c6f9f6040355fcc046cee33a8e89712", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296280, "uuid": "9f9020e2-7bf8-4367-82e0-a2cba9aedb0d", "comment": "Malware payload", "value": "0271f6708383f4bcac1f083e3a83efbfc7e6cea4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296280, "uuid": "f0f6ac88-7835-451c-9955-756c2b291dd5", "comment": "Malware payload", "value": "9df233bbcf2f4b68953a9960990419ee5da7930fc55db0dec6e3d36685688e8738925eb06b66b7c0e76b8e35b60b73cd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296280, "uuid": "ee17d8d5-3b29-4613-a322-81211a6a9f85", "value": "T1A8F38C1971D1A0B2E4F34936D5B8AF12446DFC211BB07CDB72E61A9E19320E39E39B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296280, "uuid": "d9fdc1b1-8448-428f-8a02-a90df1e273dd", "value": "7848011b763d00cd02658995847dd30b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296280, "uuid": "d32d8fb2-5c38-4451-98ea-2b2f4f48704b", "value": "3072:S5K/B0toLQSNJ0lxwsx89TSdBgjMqqDL2/TOKyQGY:Scytwt/TTSdBgQqqDL6SK0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685296280, "uuid": "a6fe339c-6a35-4586-880a-84296a2165c6", "value": 159264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685296280, "uuid": "ed559827-22d9-4bf6-9355-a78e9fa71574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296280, "uuid": "c31a5f04-c1ce-4dc4-aa12-d513a9618882", "value": "03805899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f96ded-fd8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685302884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302884, "uuid": "3d8c32a3-dbe2-4633-92a0-dfdf5cd63b41", "comment": "Malware payload (Gafgyt)", "value": "8fb46222183c04f1d90876f2750764d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302884, "uuid": "dc5f45f6-b5a4-4438-b8db-dab39ab20374", "comment": "Malware payload (Gafgyt)", "value": "1b27bcf2b51b43c89077e8987bc0d419fad035bac104cdf7d9153797dce03076", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302884, "uuid": "3f88cfdd-52f7-43b5-873d-80af8451f349", "comment": "Malware payload (Gafgyt)", "value": "51832fc310955c919ca14131de33af40676aea43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302884, "uuid": "736ab5c9-a370-4e27-9aae-784bfe50788d", "comment": "Malware payload (Gafgyt)", "value": "43d43b0065d198d93fdcaf74dc979108d3dcad9a9610ca42d84fdeeb7868a44ef9da20d8edeb410e5da7ccb53d4cf919", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302884, "uuid": "abcf8a34-b1ee-487c-9a4b-ef2f55795e7a", "value": "T18BC30A44F901475BC3E327BAE78E038C77355E6857DB33156A38BDB42BE1B982D29260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302884, "uuid": "264a521a-1d3b-404d-a9ad-0d69da0d00f3", "value": "3072:H63VpNeuWDGeQf8sRCVt3DxkS2YmyVUQuiXfQd6W:OSuWQEcCVt3ZmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685302884, "uuid": "3cfb489a-4cff-4d1b-8ccd-3787680f8623", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685302884, "uuid": "a48c5752-ac22-476a-91a7-a6ac8f0503bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302884, "uuid": "235b552d-2d95-4d8e-a27c-3a93d119821b", "value": "8fb46222183c04f1d90876f2750764d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14023ad-fd7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685294321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294321, "uuid": "eb566aec-84f7-4fcb-813c-d0a4ffb0b9c5", "comment": "Malware payload (Mirai)", "value": "bb9ced7f64e8235110038c87ddd99f96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294321, "uuid": "6dbf7838-e6b0-46ee-9fc4-aeaaf59ffafc", "comment": "Malware payload (Mirai)", "value": "1bb2a1be2fd7c8e0b0d9e0ade18f519e07ac03a50c9c16faa887b5d80dd28dee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294321, "uuid": "cff90d59-dc2b-4b73-950f-ad0b0e3ede43", "comment": "Malware payload (Mirai)", "value": "f039ecfe0eb6b7dbaa212feaf48d1257a720807b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294321, "uuid": "ef3e7273-7aa0-48c8-ac31-08b495c0c993", "comment": "Malware payload (Mirai)", "value": "dcc74f29a874d0facc64ad3feba2dc420b2b39808ae99aefa0b503ddbc912fb0173a756de1a869862e0afbf61358355b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294321, "uuid": "ba646f69-f481-4df1-88ac-f71cad93a3d9", "value": "T1AA733A0273184B07E9931EF06D3F17E187AEE99122E4F689694FEF468575E33044AE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294321, "uuid": "76bdfe1f-8038-4df4-b278-5fe0f7ba66ae", "value": "1536:0dvprNqixCBIBY5AJg/1sZg1bxRXLkVcSfmPX51t533X:0dl5Cogv1bvXL/XX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685294321, "uuid": "fb14c248-8cab-4052-866a-22364bbd5a51", "value": 75160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685294321, "uuid": "93b9a411-2a1b-4e58-9e2d-d8da584bd313", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294321, "uuid": "93efe3d6-15ff-403f-82b2-2f39975c1ad3", "value": "bb9ced7f64e8235110038c87ddd99f96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba745bb-fd8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685302875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302875, "uuid": "870a5497-ff85-4c6e-a424-f80ae0b24527", "comment": "Malware payload (Gafgyt)", "value": "bb3ca9525edec9fe065f5a4c6df96201", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302875, "uuid": "2ccdd075-2cf2-4d3e-b9b1-5556e260f251", "comment": "Malware payload (Gafgyt)", "value": "1c26f6693b453effc90f5d9e3927f6c817daf3f14efe1fa86509353e982338ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302875, "uuid": "6073e0c6-e3c2-4a97-8695-4b47e385d54c", "comment": "Malware payload (Gafgyt)", "value": "220600b6f25c0934c5628357db9eeb19434b3e5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302875, "uuid": "5e7f20eb-e34b-4aed-9bcd-2c2973199bd0", "comment": "Malware payload (Gafgyt)", "value": "d5fa483167bfc83cfb7fb7f16300244a6bf5ecf05bfa4184d4e77a86689d4bd3f2cabacd5bf0ad47632cf07a2463f00e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302875, "uuid": "5d4640a2-da12-45ac-897c-808c1c80386a", "value": "T1CAC30A45F941875BC3D327BAE74E428C37355E2897DB33156A38BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302875, "uuid": "2df2fff9-aabf-4f67-b621-62e0753595f0", "value": "3072:hQrFRNfuLrGhEPOD0Wg3gNlmBoHQuQekQnYW:IFzuaEGQWg3CmBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685302875, "uuid": "eefcd425-a1e7-4d9f-9758-e7227d38149f", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685302875, "uuid": "14884138-ca34-485a-ab0a-420eb4c4ec04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302875, "uuid": "63bb068f-650a-47f6-a678-c265c5dca7b3", "value": "bb3ca9525edec9fe065f5a4c6df96201", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3c273f-fd80-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685296297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296297, "uuid": "7353c54a-fb47-4fba-801b-49fc6c577b81", "comment": "Malware payload", "value": "437d99b73eb54b759b444c956caff76a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296297, "uuid": "d6513930-bac4-458f-af95-3cb42eb9c6f7", "comment": "Malware payload", "value": "1c339fbc01e2aef03a05a80666a26aa6d1b46dd2a2adefb17aba61117fc5883d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296297, "uuid": "222f3ae8-d64c-47cc-81e6-66c976211965", "comment": "Malware payload", "value": "96fff3691bdf49f058e83d459b286e9deea7b267", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296297, "uuid": "f4c7979b-5985-460a-a14a-c5448eec9d4a", "comment": "Malware payload", "value": "74d5907d9c9d6d7c52fb130dac375c0c153eca447327e3784b6181f111d2d6c42e0611f794bbaeacea268e54ad0170d2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296297, "uuid": "431fb936-3ca8-4ec7-8418-ff1c9250f12d", "value": "T195F4D00392E13E55E9768B728E2FC7F87B9EF5508F597BA912189E2F04B1272C163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296297, "uuid": "1098410f-99e4-4988-b7b4-eeae10c6d07f", "value": "65c93b10b21b6000b67df4ef3ebe15bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296297, "uuid": "436a4598-26e5-4d47-9884-2635d610a1cb", "value": "12288:CIQcxCKL1zaZxO6NR9RIfhK+kUUL+0m77GD1BLV36QoH:CIQfn1mQ+kPjom0QoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685296297, "uuid": "8ff680cd-a9ce-432b-9678-18bb545a3ee0", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685296297, "uuid": "16485fb4-1834-4ab8-9b7a-4cfd9abc15a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296297, "uuid": "c49244a7-e2b9-4c68-9b5d-f4b5eb6f3d1f", "value": "04293299.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbdb766-fd63-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685284084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284084, "uuid": "41d94bd3-2be1-425c-8cd7-b995bbd7d04b", "comment": "Malware payload (GCleaner)", "value": "456e083a9755977cf99b843e12902404", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284084, "uuid": "0ec38d81-5468-4e91-a628-81de27f0e4c8", "comment": "Malware payload (GCleaner)", "value": "1ca24115524ea3587bc03d07e87500fd3bce21ae45e775ff1d5b11cce8304088", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284084, "uuid": "672d31fe-cf5d-46fd-8adc-8fcff53639a3", "comment": "Malware payload (GCleaner)", "value": "e4c2696c6686d3750f77a81613df0994786e0e64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284084, "uuid": "5e3f7126-8449-410c-80f6-51e03660424d", "comment": "Malware payload (GCleaner)", "value": "a0ad07e796e6a0361f15d964ef672064c91f9220d340b7b6ad3fd5bd1952fdeb39dd702243a417f91c19bca8f0c83ddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284084, "uuid": "83b25420-2e00-4486-b495-35dddbdc028e", "value": "T1C6746D5392E13D54EA655B768E2FC6E8365EF6704F193B65322CBA2F08B00B2D133B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284084, "uuid": "53d7283a-27b7-4074-9190-0ba0c7718ed6", "value": "2d9ed3462f8a74bfd1231e2e9de56b43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284084, "uuid": "defb53fe-c9d6-4322-8602-f6712c70eb44", "value": "6144:jDTDDq33bhKgeUlTYTrDad3s6vq4ZJrzTtihF:jPDDq33bh7tl8Tid3R9ZdTti/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685284084, "uuid": "c846197b-cf94-49e9-bb02-f5e172d8aa14", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685284084, "uuid": "cd3ed4a5-a0cf-494e-8148-61b3f9eb4f18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284084, "uuid": "ffd0a56f-d8d6-475b-97ae-a2acd36fd1e0", "value": "456e083a9755977cf99b843e12902404.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "defdf598-fced-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685233409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685233409, "uuid": "280a8cb9-00fa-4c2a-be45-4d5070e58558", "comment": "Malware payload (RedLineStealer)", "value": "01955d822b4a426a852faeb1b141e4cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685233409, "uuid": "e207b1c9-e1cb-4152-83bc-d22f157b505f", "comment": "Malware payload (RedLineStealer)", "value": "1e6cc8ee3d2b82fc2b4538d1692a743a4248e62aeecc5f398f12c29a182b45b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685233409, "uuid": "0f1429b2-ac93-4307-b8e5-ca1869962655", "comment": "Malware payload (RedLineStealer)", "value": "984503eed21c38482d053d255f6c10658c2579de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685233409, "uuid": "d49ba529-781d-4e01-ace2-0bc32a2cb4b5", "comment": "Malware payload (RedLineStealer)", "value": "27814c8cabe09a2414a47ca1791363178503b3692f3b92316a7dd2815ed83eb695ff14ab32e48eed422385f5c9e35f22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685233409, "uuid": "6e868f36-f9b4-401f-b14c-0926a5485ef4", "value": "T157F4130267D554B2DCB6277489F217C317367DA64A78832B3F85B55B1DB22C8B83232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685233409, "uuid": "ae269951-0644-44c7-9e79-b3981427150b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685233409, "uuid": "c01224cf-679f-45ee-a626-d305ae7bb6b2", "value": "12288:cMrty90XS0nZobHPJ20R6xMjvohgcXtxZCrHLnm8MSb4VjVpwDT0lEznC:py0nqjPY0R6xj9eBMjVAT2MC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685233409, "uuid": "38048c51-484c-435d-901f-154358d85464", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685233409, "uuid": "b9016033-16ca-41c0-b996-ce32b961a56b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685233409, "uuid": "ab148e58-c381-434c-8904-5acad7d02cfc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d6fb64-fd82-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685297045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297045, "uuid": "5e926d30-5e6b-43f6-9dd5-4f83fa6397f8", "comment": "Malware payload (Mirai)", "value": "8b499852f11d443d861d9256c961861a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297045, "uuid": "a0e4bce1-a925-4daf-9cbe-e5b2388dcdb1", "comment": "Malware payload (Mirai)", "value": "2036f67eb51b20db1ef3c05102212286cc049ab015049f3a3dd23869326e6832", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297045, "uuid": "e2a15c9f-b26b-4779-8c7e-0a05d7feac84", "comment": "Malware payload (Mirai)", "value": "186c5671ebd42eed0f45cd2b259825c0201b7cc8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297045, "uuid": "9b8dff4e-20fc-4495-9112-6261ce4ecc68", "comment": "Malware payload (Mirai)", "value": "16f66bb8cf2557ae4a397dc1017bd92ae33895520ececc9e982c589ac4e6acfc6b487ded0490a7a98992547b27d8343d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297045, "uuid": "7203566a-0820-4fda-8883-535e52568db6", "value": "T13E231855BC929B66C2E0277BFA6E418C7310A3ECD2DB3253CC291BE4768552F0DA7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297045, "uuid": "db5c5248-50b9-46e9-b821-5806104123f8", "value": "768:wD6dZmaoGjgzGaywdZuMfHnD1NC8saEDoCerCFg+JcNbm4jNAPzI329uGpEX3TJ+:wkmaFEGarS8sxg+JcNS4jNIc329usy3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685297045, "uuid": "5f66037d-7be4-4920-b84f-0dfbec98b6b5", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685297045, "uuid": "ef55871b-108e-4c26-b394-ed48c199b9e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297045, "uuid": "a9abf096-ff73-4b2c-946b-2b9609d62246", "value": "8b499852f11d443d861d9256c961861a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bf9f3c-fd82-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685297072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297072, "uuid": "eaeb9488-c288-49b0-949e-b26bc6eed508", "comment": "Malware payload (Mirai)", "value": "5500e6bcf621dee44d4ce0b6258f834b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297072, "uuid": "ce5f5f3b-b020-4b3d-b626-a5d12a72c91f", "comment": "Malware payload (Mirai)", "value": "20a182430f4086e8e4c8164f96359d3fab17f617f4db0dd7bca03144f4d18254", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297072, "uuid": "2be5437c-3d9b-48ee-8e56-add492c0f490", "comment": "Malware payload (Mirai)", "value": "6d18b3fdcf89c465684bceea6dfbefd5c662d67d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297072, "uuid": "a44abf23-dc28-4da4-855b-9a54d1608567", "comment": "Malware payload (Mirai)", "value": "167d76995879306e12befe872154e8ad6657f726b3dac64bd0a64abfcce9e3fbb05ad9b92666420b4bec982fe0c6d860", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297072, "uuid": "dcd16d69-326f-462b-9e3f-cb4abc8534f4", "value": "T155C33A46FA418B53C4D51B7AFAAF41493322E798D3DB730689186FF43F8666E0E63601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297072, "uuid": "279c16a3-2c28-40e2-ad50-8d19e88b42f6", "value": "3072:SJkHK8uzHYhlKgZPqRJd7qNl7y1+b2L8M/91ce/:skHK8uz4hlVPqRJd2Ndb2wM/91ce/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685297072, "uuid": "a8b1bf64-f1ff-46b3-9cc5-8381bb5b1094", "value": 128096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685297072, "uuid": "d33deffc-eed2-443a-9a1d-48cd08148804", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297072, "uuid": "fc151914-103e-45db-9e75-f17022761e15", "value": "5500e6bcf621dee44d4ce0b6258f834b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83367c4-fd78-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685293098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293098, "uuid": "8bb4059a-372b-4786-9d26-e7dd97edace2", "comment": "Malware payload", "value": "19ccdab79f3836c806c58bbe295fe1cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293098, "uuid": "40f8d440-4ef4-4780-97a4-78b831d5011b", "comment": "Malware payload", "value": "214f8e9e3621a502d208941e1ef0a9d2f17b3ad952881d51e4fec4cad3bbfea7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293098, "uuid": "5f7c1b09-627c-4677-8803-2ace8cf8afa5", "comment": "Malware payload", "value": "f47a580ba769d534ddc63ae0dcbe1b5a4d502993", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293098, "uuid": "ef590fb0-6783-4261-a4ec-522bb46affbc", "comment": "Malware payload", "value": "776f9bd568a78e84219bc9f1485342c65e9fda24accdabcb40ad4d4d08b04a50f362d96ee6b3cf00858522b62e65075b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293098, "uuid": "f6e06258-1ebf-4db0-9112-18d2eb976cc6", "value": "T19B435CC6E343D1B6D86304B5216FFB27A6B1CD214025D76BC7999B32AE62B11E60738C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293098, "uuid": "dc708f60-7a0d-43ac-9730-69ce02fbd332", "value": "768:50ShL9+Sv/WvwCcNZ/WGyV6ag9ppJ/RXHHuCWEjEd8F4F8EV8OxL2xV/mLL1NR9e:7hhSvmkkppDn7jsw418W2/mL5NR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685293098, "uuid": "41c485c3-101b-4a8d-82c9-f3b759fdc19c", "value": 59984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685293098, "uuid": "c0bb65ca-d2d8-40bc-8e32-4e487db3d755", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293098, "uuid": "bf4e78ce-f762-4a5a-ae71-377b9018973c", "value": "orcod.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e947b0-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685300426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300426, "uuid": "daaa7573-5c7a-4b51-b6d0-c3d45f475d4a", "comment": "Malware payload (Mirai)", "value": "b08e3f329796fac9ae00c89b65afbf1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300426, "uuid": "d53d6b6e-d7ac-450c-8e64-c11b9a2766d6", "comment": "Malware payload (Mirai)", "value": "228cb3eff4ece1c587ea5ef3f02760eb25dd8f739889ced2554f4711d40fd13a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300426, "uuid": "4e8d86e0-0511-440c-9571-53e755a267b4", "comment": "Malware payload (Mirai)", "value": "c1a62bb251c5832c2a44a61b61c4f7736de90a8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300426, "uuid": "d4c51292-7160-43e3-b372-b91cf69a4096", "comment": "Malware payload (Mirai)", "value": "16f0ae9de2a5db0b2e62bddd952becb3d20243ef1494c2daf5b1bf5aa9fb11ed72c5760df05fbb57ee616da437c30511", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300426, "uuid": "36e3d65d-2582-4841-8596-d2deaccbd5b4", "value": "T1A3730756B8814B12C5D512BAFA2E118E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300426, "uuid": "aede33e3-33a3-4499-bae1-09155189449b", "value": "1536:2lnHaxP6XkC/zTkS7IDHtzMwo3a2ta0J0GIgi/z3KvcIc+5UYIWtj:nxiX1LgbtzbMtabz3KvcIc+uR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300426, "uuid": "e99875a9-0b26-4d0a-ad20-8b35c06f0272", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300426, "uuid": "031780e8-2f16-4136-beee-a2737cbf21f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300426, "uuid": "a402d8b9-36f5-4f7b-9354-f8ea31ae029e", "value": "b08e3f329796fac9ae00c89b65afbf1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c9553c-fd80-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685296508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296508, "uuid": "2b15007a-eab9-42c4-be2e-8172a135982b", "comment": "Malware payload", "value": "2e28ca9e8e8c1d404ee66f3ec2130336", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296508, "uuid": "bf99b94b-cc73-4b09-a882-fb60ba3595a7", "comment": "Malware payload", "value": "22c32238f5a19a13774e137e2a4c0c75cc3202b243b6bbead0a5b40578183a51", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296508, "uuid": "21c4b1fe-4440-4fa8-b8af-65a3fa1768fa", "comment": "Malware payload", "value": "a8e3a812176be954ab04a13cb61d886a2895f085", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296508, "uuid": "86f01f01-0ec2-403f-a9a0-654dde954b29", "comment": "Malware payload", "value": "98e668480abaf4dcbd83f6e48b1ac4652f4892074cf853df1f04d85f8f58cad75f3ed1a1290a40a1b6450e6a138bd57d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296508, "uuid": "a84e5d34-3be5-497b-8f18-48250ddcb412", "value": "T14EF38D1971D1A0B2E4F34936D5B8AF12446DFC211BB07CDB72E61A9E19320E39E39B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296508, "uuid": "5d16ee1b-64bd-4290-9b29-7cea40a38c5e", "value": "7848011b763d00cd02658995847dd30b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296508, "uuid": "40cf84c5-a471-46a3-bd5c-fbcf5f82127c", "value": "3072:S5K/B0toLQSNJUlxwsx89TSdBgjMqqDL2/TOKyIG:ScytwtvTTSdBgQqqDL6SKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685296508, "uuid": "ef94022f-1667-4724-b7f0-1021820a4e17", "value": 159232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685296508, "uuid": "601e7dec-a6cc-4c49-a7bf-b1c5b16b038c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296508, "uuid": "0c30606e-e653-45a8-8cdd-bfea5a8e85e1", "value": "07339599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "123ac411-fd82-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685297061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297061, "uuid": "bc885893-1743-4321-b34e-178d7858ab83", "comment": "Malware payload (Mirai)", "value": "54f9715424293898ad8ffa918554247a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297061, "uuid": "9e2b662d-cd7e-43ce-a4ff-3a2000f8abe1", "comment": "Malware payload (Mirai)", "value": "234c8886ed698f433acd52b4d87d12829126b6e79f46960eab6bbd0229bf2648", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297061, "uuid": "ce4fb4be-514b-4387-b5b6-504c2b8c6e49", "comment": "Malware payload (Mirai)", "value": "d8bb62f816e86ebffc9d4467202f8fe584d4ebde", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297061, "uuid": "1fd20f5b-2508-4e2b-b374-1124e4a08118", "comment": "Malware payload (Mirai)", "value": "751932b73758959d8742dd7250ade0e6a9543b6cc4a4cca52cb8333cfb674c481ca2c00b1240da0e5b7bda927f15b5d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297061, "uuid": "4c886ec5-d42a-441c-9e0a-7817580d5f31", "value": "T1D3333A4332280A07F5A65EF0BD3F0BF083BEE99125E1B184654F9B564235E73198AF9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297061, "uuid": "eae2f4fe-3551-492f-83f8-87bb6a37e840", "value": "768:ffQOM1vLx13THWDKlRE4hs3fU+1z3YDnBm6g94zHdsYVyKlRfWXXfiS4AmOz:mZLx13THMqfpT9mDWkGRuXqP1Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685297061, "uuid": "ba295503-f003-482e-9875-7d995574dd20", "value": 53164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685297061, "uuid": "4f48e19d-9fb9-46e4-9e6b-ef4c79a175d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297061, "uuid": "1de97769-6a3f-44eb-b1c0-9618783a79c9", "value": "54f9715424293898ad8ffa918554247a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e0d74e-fd85-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685298600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685298600, "uuid": "a681cbc1-2e58-4537-90c1-c7db0e807dd2", "comment": "Malware payload (Stealc)", "value": "e70784e6dbff536d40d8931c1452ccb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685298600, "uuid": "6401560d-fdc4-48f6-a64f-bc4c1ba609bb", "comment": "Malware payload (Stealc)", "value": "24089814a99edccddb1a0b87184bb27b1838fb78c91becfb5735b2f187c48f6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685298600, "uuid": "7cbb5b3b-a67f-48ca-b0d4-64709af88230", "comment": "Malware payload (Stealc)", "value": "f2d6a89bd7ab19b142649a2ab7047678cdcd66e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685298600, "uuid": "6804f2e6-47cd-4110-b6ff-1671aec4fd75", "comment": "Malware payload (Stealc)", "value": "b96c9a0bbc551ad94988d7550d7a6f2db14cd7b762acb717dbd5297813733f5ba8a532d12443a6d58ac02c988c6aecde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685298600, "uuid": "7e3c2ce4-62f6-4cda-acdf-588045fa90ff", "value": "T1F7541A5392E13D50E9668B729E2FE7F87A1DF2508F9A7BA512189E1F04B03B2C173711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685298600, "uuid": "710d0633-c63d-4d98-b079-59e02f08dd24", "value": "96475f7ea3cc105ae1bb971e987af868", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685298600, "uuid": "ec65b997-5d25-4ae7-b9d9-4b57912c0110", "value": "3072:XwDg5KBGZS8nFOawLVdHl3OiashQYRKnsr3FGY4Mcm085TPwPuQ:gDg9ZLMBLvHl+ias9RIAz4M/oH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685298600, "uuid": "8d077e47-612c-481b-9376-1fa12cb76c23", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685298600, "uuid": "f457d8bc-b598-4ae8-b0f1-186b282a04e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685298600, "uuid": "38149adc-a50e-4073-8715-eac27e661f0d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ac8a16-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685299930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299930, "uuid": "0077ad9e-adf8-424b-979e-61b5c0871a13", "comment": "Malware payload (Mirai)", "value": "ed487dbad0e80622cba40b04e52169ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299930, "uuid": "f6cef718-03b0-45c9-947e-2396994eb76c", "comment": "Malware payload (Mirai)", "value": "24e877a08f483eda08b7fa9f1963ccebe934f8f13809dd59ab1d4aefd384d841", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299930, "uuid": "a381d38b-4e45-4bc2-ae14-b9ee758f503b", "comment": "Malware payload (Mirai)", "value": "c4522a81620fb33f26c1037c2244cac2028d34ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299930, "uuid": "317a96cf-1fa5-4896-88a1-34046b503136", "comment": "Malware payload (Mirai)", "value": "ad2cf779fedc101377d2afb1e8dc6111106915b350adee93daded9441760ee5c39884e36e7a73e040212ef40049e576b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299930, "uuid": "f2ae277f-9840-4c9e-8d0b-a1d59640aea2", "value": "T14A434A50F8819623C6D1127BF66E468D3B2613E8E2DBB3079E225F2037C686B0D77E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299930, "uuid": "040f0fab-27cb-4a45-9e37-16de95610d6d", "value": "1536:pjzQgyzv4qsU9K7U+0FQL2g4TtiCsyXvqnF:pjoE/0qLh4p9ZqnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299930, "uuid": "571afa98-cf98-41ba-9fae-aa6c685fb212", "value": 59640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299930, "uuid": "4dbdbd4f-9f74-47a5-a19c-543da5ce4c7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299930, "uuid": "c73efe90-a0fb-46c5-add8-2d5ae7fc953f", "value": "ed487dbad0e80622cba40b04e52169ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e807d16-fd82-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685297054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297054, "uuid": "37dc323c-636c-4931-a305-01ba2265cea9", "comment": "Malware payload (Mirai)", "value": "a508a7913f2ef2a21fbfcdd1880a722d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297054, "uuid": "30eb1ca6-d9db-450c-a8a5-6d3edff2fd10", "comment": "Malware payload (Mirai)", "value": "2515b08680e0a5785251fe679cf93e6761bf89d93fa68351ebadf70c39a1b6fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297054, "uuid": "6d33b826-ae1f-4bff-9a9f-fd777711a6c1", "comment": "Malware payload (Mirai)", "value": "2365cebbda119c3ad96693bff6d3d369c3bb9aee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297054, "uuid": "977d33c8-c425-46d9-8934-fdd66dd0d198", "comment": "Malware payload (Mirai)", "value": "8d280d713ecd7304dede0e07f16f1cba7f69784833e3f039ced3d427c75604972861fc0c891be56349f2048e33844371", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297054, "uuid": "56d2260a-f291-4315-93ad-b96d30cc6e8f", "value": "T17D637116BF601FF7E8ABCC3785A95B4A25CC541A31A93B797D34D428B24B25F05E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297054, "uuid": "45e2ff75-aacc-4000-bede-e5599ba249b4", "value": "1536:FJs9gGYlZma+9KRJisXkBg0rruxyDV1Z:FJs+9mLiJMru61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685297054, "uuid": "1e6fac84-5ef3-4387-be07-506725c44246", "value": 73324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685297054, "uuid": "06713f45-9d22-4350-804a-0c1d2519cbfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297054, "uuid": "f26952b8-31bd-4149-acdd-8818cde7e0b3", "value": "a508a7913f2ef2a21fbfcdd1880a722d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f661a31c-fd92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685304315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685304315, "uuid": "281d950f-1e4f-4850-804d-b8e429c82d1e", "comment": "Malware payload (Amadey)", "value": "6bde706c22d02505a22c7bbb696e6cd9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685304315, "uuid": "db75ff2f-e123-455d-b4aa-ac56d14433de", "comment": "Malware payload (Amadey)", "value": "25481a08ea2741edf933c91b5db78a04442d666d7d2b92069d2d3b88287245c9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685304315, "uuid": "b1d46aba-97f3-45e5-8ef2-99ac5041e1cb", "comment": "Malware payload (Amadey)", "value": "53c49171de280916ab87f37e07b9c80a6a178ba4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685304315, "uuid": "ef2072c2-b143-4fe1-8253-6c1cd34bfd60", "comment": "Malware payload (Amadey)", "value": "2114a08b6e857d75c0916bfbdafdec8d08ea67bf5d9680175b60e5ef23eb47c7e74e3fac081d30787afaa6f8c942d1f2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685304315, "uuid": "9e299344-5d49-453d-aeeb-c8bf41a5b8ec", "value": "T1FC051227ABE48073EDB9273578FA06D30A35BC775A3493173758AD191CF2698A03532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685304315, "uuid": "da8df228-11f6-4bf1-a712-2e6454519f42", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685304315, "uuid": "2d3cdce0-5bca-40bf-a10e-18f6952cbab7", "value": "12288:iMrAy90DOqEKOYWYZQq17wIiOeKS8IWAP4pq67xXXqsHJ7tutsuUxxZxjCt/nDOq:+ygOPKZZ91c0S8Z3Rt9Fk2uUxZk/nCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685304315, "uuid": "c37d9168-2781-4f5b-8ced-def9e364dee1", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685304315, "uuid": "b4ac5959-30dc-432e-9bbc-fa2350bead87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685304315, "uuid": "eab7f0a8-dfd2-47c4-b031-0b2c09a518ab", "value": "6bde706c22d02505a22c7bbb696e6cd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5efeb4e9-fd1e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1685254240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685254240, "uuid": "4a76287c-c26f-470c-a5fc-33c6cfbb9717", "comment": "Malware payload (ArkeiStealer)", "value": "2cc4e1e1de9400f12f4e8d85c0a02435", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685254240, "uuid": "2e917e29-70d5-4283-8165-089ab8325b27", "comment": "Malware payload (ArkeiStealer)", "value": "25f17d615e6ccbf3de2297fe28ba2c78b8db878d5609cf70baf4202e5fea90eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685254240, "uuid": "2e001da2-3a91-454b-928f-41a4a3be7847", "comment": "Malware payload (ArkeiStealer)", "value": "436637991950728a5217ba44338976eb65ef13cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685254240, "uuid": "4889aa47-3251-4627-9bfc-c8756582a2e2", "comment": "Malware payload (ArkeiStealer)", "value": "f3cf86a57f98f4bb48fb167c27fe2c290f2b258ed2ed6488c25fcd894c0034703355a6485a84f0cbbd9944e640343d8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685254240, "uuid": "f435b284-1781-470b-b132-d9f9dbbf7994", "value": "T10D848E03D6E2BC54ED668B729F2FEAEC761EF1518E09376A26185A1F04702B2C173717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685254240, "uuid": "e0dc697c-a97a-4927-9f22-588da65735fe", "value": "d302e4ac3406067f8ed838633897aebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685254240, "uuid": "e4f1a481-47ed-4ea7-9638-13a6da140172", "value": "6144:ug8FnVPv2ietghs764HC6cq8/w90sbxslOqlepGQO:uVFVPPet0s7RHbcq8I3mEqlesQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685254240, "uuid": "be4e4b97-865c-4b03-91af-31b9e988f7cc", "value": 397312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685254240, "uuid": "418d8d98-0f23-4e63-864a-14706fd2e419", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685254240, "uuid": "a2a86768-f712-419c-a9db-f25a68edcb7d", "value": "2cc4e1e1de9400f12f4e8d85c0a02435", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00ea5ff-fd8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685302560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302560, "uuid": "9e2cbe45-1466-4c4d-b7ac-5e1bb0fefa38", "comment": "Malware payload (Gafgyt)", "value": "bf69b286e919248b464cb561afe14266", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302560, "uuid": "c12c1791-78f4-483d-a628-4c075c896cf7", "comment": "Malware payload (Gafgyt)", "value": "27580fd8db99029610a4868ee7a75bb3cec0cc9ac9aa671b3e93f4afaa0094bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302560, "uuid": "4b35ef24-086a-41cf-b29f-417760fa70c2", "comment": "Malware payload (Gafgyt)", "value": "5a3828e0800d879d51a189d0c337d0875c524318", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302560, "uuid": "f8a07710-c465-4a66-b37b-edaf1fc92e2e", "comment": "Malware payload (Gafgyt)", "value": "8ad4449b38745a94efc7efa0e3819c7ea86dc630a1e9f04424ad3d7b693e732affc1bcf1da3057b925b40a8bb30655af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302560, "uuid": "e6d14473-0513-46fe-a483-121732147021", "value": "T164B328436B1C0B87C49B9AB01DA737F18B69BD7112A351C9A90BFEC04733AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302560, "uuid": "84995d28-059a-444d-938b-71375d5f4162", "value": "3072:WD3l+XQzPeV91310pWudMKakpNDtm2pgYMidIP1W:WD3l+XQzPe713CpWCMypxtm2pgYMidIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685302560, "uuid": "9542b5f2-0614-453d-a157-118e25098e52", "value": 113194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685302560, "uuid": "ec0ba0f4-65b6-4f37-a2d5-87cb1b3a5ead", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302560, "uuid": "00da4674-2311-4a2e-961c-b9472034fe24", "value": "bf69b286e919248b464cb561afe14266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d39bdc7-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685299871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299871, "uuid": "37ec1978-e3de-4ccd-b90e-3cae559dc8ec", "comment": "Malware payload (Mirai)", "value": "c81e38406c322728c07fe34b32ed03f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299871, "uuid": "ec79fb82-371f-413f-993a-50f7d4c55bf4", "comment": "Malware payload (Mirai)", "value": "27c091d99c5d4469292fb6d2d590664254a0868ee9e6ccbbe66a66eee424b190", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299871, "uuid": "9291ba1a-d346-4da8-86eb-7445f8d62921", "comment": "Malware payload (Mirai)", "value": "2f7cfa772c5e791c148fa5e4eb612c11cc084035", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299871, "uuid": "4a471446-0d8e-4efe-90a6-7db630e5a1e3", "comment": "Malware payload (Mirai)", "value": "e25df22ef0a47d33fedaaf981762e01b6692bdf9f029b67a336eca99e9a59be6e465eee6f57cdedd71805a03ff573028", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299871, "uuid": "094b584a-6616-4359-b1b4-135e6a3a6289", "value": "T126633891BC819613C6D1127BFA6E028D3B2613E8E3DF72079E225F2137C696B0D37A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299871, "uuid": "aaa580f8-ea4b-43db-a974-3ddad25ebee6", "value": "1536:xZ1ltKm9nMtfTa7/KrVJYvyzLvkuyCG3wfqvfWI:xZkhDSyzLvkyEbfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299871, "uuid": "302be134-bce6-4ea9-b1c0-d80be4c7db65", "value": 66900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299871, "uuid": "33632431-82b0-451f-bb9a-7f87e279327e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299871, "uuid": "514eb227-3dee-4f2c-9842-e9a3f22e13ae", "value": "c81e38406c322728c07fe34b32ed03f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f362d2b-fd7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685294291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294291, "uuid": "ae5a4745-ae9d-4826-bbaf-848858aefdf4", "comment": "Malware payload (Mirai)", "value": "1ea026733bf4c6c7c7dcaa9cf9e785ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294291, "uuid": "23ad6c46-5ecb-42c1-b4d3-87320c3d0516", "comment": "Malware payload (Mirai)", "value": "27c10e63e2fc2b7babaf1cc80ef0629b026331cde5bd463358d8ad4ef830a4aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294291, "uuid": "378cce94-9b2e-4d94-acd9-11dd11477be2", "comment": "Malware payload (Mirai)", "value": "59eca643d051ab1c65ab9180c6182a1fe8c50ee2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294291, "uuid": "fe31848c-f890-42f9-8607-65dbd3a58c43", "comment": "Malware payload (Mirai)", "value": "6db3be5314a9b6012df3a1a8d3dd0d0562518e91779c7a92edb767185864e37d580863ef939bdf40e9e8752b06a24050", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294291, "uuid": "562f41b0-c68a-4b9d-a7d2-c009733e0ece", "value": "T1D47307C2B88B80F5C80749349467F67FCA32E4794031A6ADEF8DAF36D967701951329E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294291, "uuid": "a5548a3e-f08b-4f1e-8bc3-e1bfa013ce9e", "value": "1536:r4b01pOP5Mc5+Q28RkpoWAxFMTAsXyWzrWNJWgmQqhMbZ32:r4upc575+GRkpVY+I2WNJWFnas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685294291, "uuid": "b2e3642d-8604-42a2-bb39-d04f97efacc4", "value": 75888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685294291, "uuid": "059ba836-689e-4e6d-8eb9-21a30ecd1d71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294291, "uuid": "6c6d5162-069a-411e-abdb-5f3e2a27c258", "value": "1ea026733bf4c6c7c7dcaa9cf9e785ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91162b9-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685299918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299918, "uuid": "d4771ae2-b595-4800-ab18-c71d3cf64617", "comment": "Malware payload", "value": "34d10d76d15ffe68c9a614bb05c70678", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299918, "uuid": "b3c97696-624a-4808-9dde-b4838be73519", "comment": "Malware payload", "value": "2a33c2e9466971c00f1333769cdad75d3bb786d90f2ef5a6fbef30b830386447", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299918, "uuid": "fb044e66-8cef-46ab-bade-7653a7ae1177", "comment": "Malware payload", "value": "7c9654e544b2e25f42c133259d979bdd0d243294", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299918, "uuid": "f4c564db-63b2-4179-8254-36c42aa4f7b7", "comment": "Malware payload", "value": "b75a19544bd93568d9c6248846a3ca08a59aea439b33718748ed2183059476a3cb972d2099dfcb26968a51b23e06fd7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299918, "uuid": "aab39f7e-a97c-480e-94df-8c34de542981", "value": "T11693E606BB510FF7DC6FCD370AE91B0528DC694A22E87B367634D428B65B24B49E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299918, "uuid": "cc755fc8-aad6-4a82-8de8-df5b8a6f0b77", "value": "1536:Eu2fNXRbqPZTPYsIaxf0/HZhKkwjAhMgWUoBB:Eu2fNX0nxfSHBlJeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299918, "uuid": "8cd96ead-a9ec-4e28-8b62-02522d4ed9a8", "value": 89468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299918, "uuid": "6122820f-628d-4b79-b4f8-821695ac232b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299918, "uuid": "1c21cd3e-13f4-4cea-9ecf-20e289942e16", "value": "34d10d76d15ffe68c9a614bb05c70678", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd693e1-fd81-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685296783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296783, "uuid": "7bb83a73-21e8-4957-b9f8-4fb5636f00fc", "comment": "Malware payload", "value": "076e8cfedfa31e546087a943e5e7c681", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296783, "uuid": "52adb163-a4a7-4a8e-88b2-82ccf77e8712", "comment": "Malware payload", "value": "2aaae232c889912fe61abafb3dd36bfa3499d21daaf61d8c839ed53c50ffa388", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296783, "uuid": "772d4f06-b02e-47dd-b164-3dec9097ff1c", "comment": "Malware payload", "value": "19df36322342a4084ecf28606ad9372eb348fd3c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296783, "uuid": "ff8df0e1-be98-4870-9568-dc76a9659eb1", "comment": "Malware payload", "value": "89ef7bf83870d800f13f669d2e9e37244c775585e6cd6a7e8ace35c7ce91e83234dd3a5498c6ddf01c25f82897730b31", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296783, "uuid": "45238bbe-a13b-4cdf-898a-8af69ee7a1b1", "value": "T1BAB4AE53D6E13C54E9268B729E2FC7F87A5EF2508E593BA512189E2F04B13B2C173721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296783, "uuid": "66478a52-311b-4266-9d30-841de6e02e0d", "value": "96475f7ea3cc105ae1bb971e987af868", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296783, "uuid": "bab3db2b-4728-4412-af63-bcb9305d404b", "value": "6144:AeoWC4NAyTwOZiaOjhl/xMTU4uaa1XcqhcmK2AD/5/klaT8F6:LoWH9TwOZiLjl9DKL/kg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685296783, "uuid": "e71dbe0e-36a8-4347-ba50-37a2713da4dd", "value": 502784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685296783, "uuid": "ae37940b-25ec-41cc-803c-c055575c8bb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296783, "uuid": "83ebddf8-d185-4dfd-b4eb-3fabdf16d493", "value": "09208699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04d0ce5-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685300413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300413, "uuid": "96eda6a7-6bd6-45a3-81c6-29bf34e22e02", "comment": "Malware payload (Mirai)", "value": "e34ec7cd6bb1fe3a6d63682242d3abfc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300413, "uuid": "b6aad9cb-9649-4423-9065-a3daaa43eed5", "comment": "Malware payload (Mirai)", "value": "2c2116b147e3edbe9ca61fc5cc604abf8b33be9867140da6bd618644a7ce9c37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300413, "uuid": "2d30c250-24ca-4e91-b836-d5ce46e2b392", "comment": "Malware payload (Mirai)", "value": "1dc8910cb9e79275bdca29bc42d55419b1bc980a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300413, "uuid": "7ddcc8ad-ee2b-4275-9636-7aea17edf5d5", "comment": "Malware payload (Mirai)", "value": "cc3324a996531d7842905ed052cdddee27304fe2d79106fca73a7bfc65a21522279132af12e4fe47ea268fdc0a18826e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300413, "uuid": "cd71ea20-9386-4e12-8963-6e9a118aa8e3", "value": "T10D731856B8814B22C5D512BAFA2E118E332327FCE3DEB2139D106B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300413, "uuid": "069b5055-fe44-4c2d-857d-1095eaa58386", "value": "1536:tKnn2WKd1+4Zjg9w1pmT7uEr3dLNEab50nIhiBgDXvnTGPK5WYIW1:XWS1d2w1ArvEaegDXvnqPKER8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300413, "uuid": "58fdd838-8106-474d-a423-82681cce6b07", "value": 80160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300413, "uuid": "13653c6f-c5fd-4ef3-8e8c-9cdbcffc7c98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300413, "uuid": "07a8e45d-adf4-487d-88fc-821873fca4c1", "value": "e34ec7cd6bb1fe3a6d63682242d3abfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd9e440-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685300409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300409, "uuid": "385eead6-3dce-4619-b786-6817c6d3cb6c", "comment": "Malware payload (Mirai)", "value": "52d9d22143228421f806b751e577e200", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300409, "uuid": "cc05d7f3-49da-4002-873d-ca707ea797d9", "comment": "Malware payload (Mirai)", "value": "2c8f7d2707b19fe610db7c05477ff92c2837077476a366d310cdad504dc3d4df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300409, "uuid": "7baad83e-d98b-4da3-a39e-56c48ea3243c", "comment": "Malware payload (Mirai)", "value": "86632a7e61bebbeb778e87fb78ffd3013ea88957", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300409, "uuid": "f4269689-1948-4e59-83c5-53d3d3f7f675", "comment": "Malware payload (Mirai)", "value": "55e3663df7421975e29191d878d6a7781a965fa7139f04f803432f497e4ab4dc09b76ead1da548f84493ab5e8cc98132", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300409, "uuid": "86524767-3737-4c4e-9fef-be52085ce612", "value": "T189436DC6D143D8F6E80B0570603BE72BAE71E8EA2219FF47C7689631FC86641A5179DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300409, "uuid": "32dbfdaf-bf80-41bb-a45b-24a30fe6c5d9", "value": "1536:DIqD1xfYqyDgZtmYXs8pJmpYUz2jMY5ts0Aj+ISeWYeLu:DIqDXfYqykZ4YXsIJmplsMytzG+MWYeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300409, "uuid": "95035d8f-08b1-4265-9fbf-16daa41e1b0c", "value": 60080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300409, "uuid": "81b1e456-b248-4024-87c7-4106342d2eb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300409, "uuid": "49f193d7-d4ea-458b-a5e3-654f1944091d", "value": "52d9d22143228421f806b751e577e200", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd310742-fd7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685293965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293965, "uuid": "7e1d5065-9907-4be8-b206-d8f763780d01", "comment": "Malware payload (Mirai)", "value": "a618a1a4866260bc7a9ef66302b868b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293965, "uuid": "68419a90-5038-4ae8-ae23-2febdf958000", "comment": "Malware payload (Mirai)", "value": "2ca0b9e2691ebf3300a1532dfb2b756e6623d34b84b5458c40803a5c53f1dd51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293965, "uuid": "d7e291a5-3cc3-44bf-8a4a-64fb10e608a6", "comment": "Malware payload (Mirai)", "value": "1ef1ec15a3063f7efc0fa05e6dcf78454e4e27a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293965, "uuid": "8746938e-e1c5-4d68-be21-5cc4816cda1f", "comment": "Malware payload (Mirai)", "value": "c0e9a3611091f198150156d19e454257de9a755e8c8fb7d4436b439290773457134eccdee628c09257139be41541ff9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293965, "uuid": "453f34b2-0906-455b-ab64-3c7398dd1fcf", "value": "T15363AF7AC6355F84C54C45B8B9A8DA389703BD0491A76EFACA4587AB8007DFCF109BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293965, "uuid": "816ceb49-ec43-4153-b865-bd2d3aa7bdd4", "value": "1536:h/mmdIpaLacjwt+iEbdbV+5MQA7M1VmyfSnwHLmUR8C57PX51tU33:h+KI8luEbdbGHA7M1VmyfSwrmUR8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685293965, "uuid": "c0d07089-37b0-4959-8b65-08c7b9fd9238", "value": 71020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685293965, "uuid": "a791747c-c88f-4e80-b5df-b7d0c4c6ac69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293965, "uuid": "00bc0b1b-e5e8-44ac-97dd-805afb29282f", "value": "a618a1a4866260bc7a9ef66302b868b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ccd1f3-fd8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685302543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302543, "uuid": "22c8ec5d-1ca8-4834-af7c-b7bcfdccf3d4", "comment": "Malware payload (Gafgyt)", "value": "8d9894d8c3e7e51e0ac7b0bc06b80247", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302543, "uuid": "fa6a5895-5541-458e-89d8-227c1734dbf0", "comment": "Malware payload (Gafgyt)", "value": "2d021244f11906e91b6ac76e849659d898cbb04ba2c36ec502b16b50dd62cbed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302543, "uuid": "e4a12543-ff9a-416b-8964-cd05344cd69a", "comment": "Malware payload (Gafgyt)", "value": "efaf3a219aa99dd5091ac6c28536964be6aa4792", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302543, "uuid": "9b58965d-299b-495e-8100-57673079aca4", "comment": "Malware payload (Gafgyt)", "value": "2ae0c1ffd55e8ca79e3c3bb58571fa3504d3322be7539019a0fdc729b108d35df09159a4766e28fe8effae37a114902d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302543, "uuid": "909f11af-f9da-4e93-a291-a0737d40b87e", "value": "T13CC30A44F901475BC3E327BAE78E038C77355E6857DB33156A38BDB42BE1B982D29260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302543, "uuid": "11084cc5-f5d4-45cb-a52a-bc67c9df6bbb", "value": "3072:H63VpNeuWDGeQf8sRCBt3DxkS2YmyVUQuiXfQd6W:OSuWQEcCBt3ZmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685302543, "uuid": "37b7cda6-4661-41e3-b766-8a6ab38ead9f", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685302543, "uuid": "4d1585e0-5c78-46b0-963e-6f2dbe431199", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302543, "uuid": "57f9db0b-b54c-4ae4-8e67-911f1d6ef03d", "value": "8d9894d8c3e7e51e0ac7b0bc06b80247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c8208a-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685300343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300343, "uuid": "f19d3b4f-01bd-4282-9984-e403de1c55c0", "comment": "Malware payload (Mirai)", "value": "bef980b982c33b98515829862bb69d0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300343, "uuid": "f563733b-ceae-466d-ba94-c3f44ccddd56", "comment": "Malware payload (Mirai)", "value": "2d428f6af457a0a9413a91d5843e9b91add891d3c1d0eac2097bdb7352461044", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300343, "uuid": "a95c59d4-0b6d-4088-a389-4e63ba647a99", "comment": "Malware payload (Mirai)", "value": "2011f2bd3029535c8275f75f30c235b987319914", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300343, "uuid": "7d7bde15-b4b2-43d0-84dd-fb8846d673f0", "comment": "Malware payload (Mirai)", "value": "b7bef50f9da707790d77d2066bba1a1ec5ef3fd36d6589d629dd1eb82868a59148fe0b3286f88a2f55d571ddb9411497", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300343, "uuid": "3d30b7ea-e44c-4e82-9e7b-e67969981fc2", "value": "T187830856B8814B22C5C512BAFA2E118E332367FCE3DEB2129D106F2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300343, "uuid": "589f27a9-89f8-4f99-9df0-e8deb8a968cf", "value": "1536:KFnXbIbitamERO8XlmL3BrCunz9DgiaAF0qI0i/ZssvkAH65JYIWj:eIbVmO/Xlx0zmiabZssvkAH6/RC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300343, "uuid": "319c2ffe-f448-4559-8c5e-f9b4ad330fb7", "value": 83256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300343, "uuid": "26474a75-9ad7-4a0a-88c3-4e79ef3438a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300343, "uuid": "2cda88f7-ea77-4825-a39a-dbaaaac3f650", "value": "bef980b982c33b98515829862bb69d0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cab10e6-fd11-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685248572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685248572, "uuid": "70093a8d-278a-4bd2-b997-271a5ce46860", "comment": "Malware payload (Smoke Loader)", "value": "3a66a27b79651f7c45a136a08a44a571", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685248572, "uuid": "339ad89c-8972-4251-82e1-5ff9ce407f63", "comment": "Malware payload (Smoke Loader)", "value": "2e229f0a4035b58e6c24c519e93f56a9aad7af92405c8604e5e8cb1d23174f43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685248572, "uuid": "0ba481fc-6af9-418c-9a5a-afa83e95777b", "comment": "Malware payload (Smoke Loader)", "value": "2c5ef7ea40a7f24c559818e25a166cacb9b0c6fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685248572, "uuid": "b3e506f0-8a70-4ace-b88c-fd93b15c14e1", "comment": "Malware payload (Smoke Loader)", "value": "e3cc46f4ee7606c9997091b264fe3d42a68addc67bfb68c7f110cd1811e7c50f145ce0d30df173a5203e53a1c62f878d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685248572, "uuid": "266c0c6a-0d8e-4404-a0ab-7e247d50fdd9", "value": "T1B824BF2236D5C072E12775349E72C6E24E37B8B29B6499CB37D14A7E4E313D2DAB4306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685248572, "uuid": "0a9cd25b-169d-4e78-bd30-932a7a6d4d5c", "value": "f76f27c730e6db54fe2a82dc14343db2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685248572, "uuid": "0ff331b5-9e03-46fe-8198-8a45e3e6158e", "value": "3072:VVsJbQ1aKw4eML540EeACDTF8K7BlXk1OahFdkogWTKb0IjMa09irQn+:+c1aXQ40Wgx80w/aV4a0Gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685248572, "uuid": "61a4f4fc-c97d-4801-819e-5c86bdac5fbf", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685248572, "uuid": "5c7629bc-d588-4352-a981-f5fbe31f0c3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685248572, "uuid": "348007d2-d8bb-489e-8e0a-94ccd75a5374", "value": "3a66a27b79651f7c45a136a08a44a571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893e16b3-fda6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685312722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685312722, "uuid": "7d93d40d-3e5b-49c2-9b2e-bf14964c1bfa", "comment": "Malware payload", "value": "64806167a0e3b3d2b5bb3bd4d1b32f17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685312722, "uuid": "1acfc391-9ceb-4af6-b4a5-11762eca9a75", "comment": "Malware payload", "value": "32279c5b0f9a949784e0a7b86aa92c0870cc85d7fa8f12312ea77420dc408931", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685312722, "uuid": "1cc2b9c5-fd47-40ce-975d-547dff933fc2", "comment": "Malware payload", "value": "c2835068a54fd3c919a918d062f28ebbefeb3e05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685312722, "uuid": "d1d515bb-ed0e-46cd-858e-9999d0b6b6f5", "comment": "Malware payload", "value": "b3303c4948c09300a8367f976498feed2d8cd8b9ba75bec9dc573c2ba6253a5c3120b34d8b402f50001efc5484c1c874", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685312722, "uuid": "13d66270-ac7e-43fd-93ab-42b1b25edb3f", "value": "T193744A5392E13D50F9664B739E2FC7F87A1EF6508E4977A922189E6F04B03B2C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685312722, "uuid": "9e0ae178-b451-49a9-8e41-4577f5bdf8ae", "value": "8e382607a3e33198b48c3f30434124bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685312722, "uuid": "b41f2191-75c2-446e-97c8-32d5b6353b0d", "value": "3072:pHvLA5tMF+rvZlMyu2TakqF5fw8zwHb0UN8o1mvQt1vb2GFqH5ZQwKqpQ:lvLAo4vZlMo4Zw8zFUZVHvb2GwvKqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685312722, "uuid": "6991442f-0c0b-4391-aa9f-88e5b5df6d3f", "value": 347648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685312722, "uuid": "5ef6af27-427e-481e-a198-69f55450fd60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685312722, "uuid": "41aabcf4-178e-4fd9-bbe2-c9d7edae45c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c048b7af-fd63-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685284038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284038, "uuid": "da86ee36-096f-4141-86d0-fec557d091ea", "comment": "Malware payload (Smoke Loader)", "value": "56c6dc11344ec09e1587de2e2f15d489", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284038, "uuid": "e85c4253-f2a7-4bab-95a4-7091304b6f1a", "comment": "Malware payload (Smoke Loader)", "value": "3350f50e705b773254b1506e65950b9d610e97b6d002fd02c0307f1e8abf2a3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284038, "uuid": "04f4d9b7-9759-49ff-8b22-f89b4ea65112", "comment": "Malware payload (Smoke Loader)", "value": "82f9b8a2260a796648b9ea9f06e4be85aeb60399", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284038, "uuid": "c8cb856f-75db-475d-82a4-b2a3bcea6815", "comment": "Malware payload (Smoke Loader)", "value": "8d2a462821a389a0ed5c70470a3d9a81bfcf35de2f1f7cc0b5dd1b709f16d13fb4d70bec92e73212190ab4a8206ef2ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284038, "uuid": "0633b2a1-be64-4f28-b5b5-709f37f5a66f", "value": "T11254181392A13D94E9664B728E2FC7F87E5EFA508F5977A912189E2F04B03B2C173711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284038, "uuid": "9d626afe-505d-4e1d-98ba-01bc2fd69d8a", "value": "937554e81340ac479b370382e43a74d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284038, "uuid": "a7d49161-d743-492d-b242-79fb07bf5d5e", "value": "3072:7S8+jk7BlhRoGXz42vplpUyHsGKJ6sqf1cGJcLJy3yKw+Zdd5g6wIYQj:e8+jkNRfXjhHUbD6suJcLJyiPVmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685284038, "uuid": "e54cd1ec-fb7c-44d6-97de-0304cd34b334", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685284038, "uuid": "ed222cc7-7670-4e75-906e-9d819775d3c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284038, "uuid": "a23bc9ef-f907-4de1-8e83-70605f966b35", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de92dd12-fd90-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685303416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685303416, "uuid": "035f21a9-f48b-4fb1-b250-2e55e7607068", "comment": "Malware payload (RedLineStealer)", "value": "c7ed1c43ae4dfaf073d6b9d3c86187b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685303416, "uuid": "a15e18e5-0994-4512-a2a9-2aff4c86c95b", "comment": "Malware payload (RedLineStealer)", "value": "3427064d551baa74ffe92cf4cedb8d030df71b4f118c317df72a6bbe526ba6ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685303416, "uuid": "78e1baef-2e00-40c3-b8a3-1df0276b9e1e", "comment": "Malware payload (RedLineStealer)", "value": "ea9b83080675a3a1b5fb1d4458882bb788027fd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685303416, "uuid": "e26653e9-8e93-4421-9590-da9aaa1b6b8e", "comment": "Malware payload (RedLineStealer)", "value": "7d339be0c2245d82876631a0ba5dff242cb5fbc2c703c6f7daec8f4a43ce8b699a7de4b228748a3c422fae67b7e0426c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685303416, "uuid": "bf208c15-489e-4131-8e10-c8bbf8545d24", "value": "T1400523A357E89131D5BA2BB028F703A30731BCA16A7451BB23492DEF1C736815176B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685303416, "uuid": "270ede56-7935-4232-8b4a-f8ad15c32ed4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685303416, "uuid": "ff6ffe93-a58d-44e6-9905-ccedf0d197d4", "value": "12288:dMruy90QJGjb4EMzZMYKAlY92dS8Ls2oP2wttCnkH+tFMSiF4tu:HylGjkccB/Ls2ImkyfiF4tu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685303416, "uuid": "6310726d-b1e9-4dd9-b01b-9b2a495707a5", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685303416, "uuid": "11802613-f5c0-44c9-b652-0c9eaff6a052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685303416, "uuid": "eacfe8b5-df0e-435c-9c72-541e9074f02b", "value": "c7ed1c43ae4dfaf073d6b9d3c86187b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e7f169-fcee-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685233718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685233718, "uuid": "eaf533e8-0cfe-462f-983f-3a5b79f5fc74", "comment": "Malware payload (Stealc)", "value": "e82c9c0fe4dd8a9c413350c819932cce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685233718, "uuid": "b6232bef-c3e2-408a-aa84-a160d862a69a", "comment": "Malware payload (Stealc)", "value": "34d81fa01e7570ee734e04e8d2be5c2d54c3a343ad3340b26105627b6124a2db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685233718, "uuid": "4717a375-19e5-4d56-8e1b-68383d9037ff", "comment": "Malware payload (Stealc)", "value": "e7235da94c76f3e0cc330f37289681c4c185278b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685233718, "uuid": "dfeaa7a5-56c7-42ed-b308-d04a2dec7403", "comment": "Malware payload (Stealc)", "value": "65a037b2fbf5167682469c1c10dcb37a904522651fbbe07495dbfc4c3156edbc74fa7f50aa80b5026a85bb7a9310f198", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685233718, "uuid": "dc668fe6-558c-4310-ad05-d2054b7c3ae9", "value": "T16B543B0396E2BC56ED668A729E2FC6EC761EF1508F1977692218DA1F04703B2E173713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685233718, "uuid": "d97b5454-b662-452a-92ab-ef704badfad7", "value": "d302e4ac3406067f8ed838633897aebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685233718, "uuid": "f75518eb-7dba-4a0c-8426-1ea294f70c46", "value": "3072:aWwJO0B7sQIthhEWGrtJ4c0XBnY9twLHz4mFxAQ8499UPd5gG+NGvAPGGmR:TwJOjQIPkLlcC9tw39Ax499TGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685233718, "uuid": "32e2d640-b63b-4e80-9dbf-d06060630bd1", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685233718, "uuid": "0fb4f0ed-ef61-4c28-b2e0-075079f3a819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685233718, "uuid": "df667a9e-632c-4127-b76c-8d535984e942", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90124abe-fd8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685302855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302855, "uuid": "c63f834e-ff78-4aa2-9a8b-e8dfc4cf8b74", "comment": "Malware payload (Gafgyt)", "value": "34b16467466b977f9a10c514a8a270a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302855, "uuid": "76b5cc54-2a44-42e2-ae31-e000e9ff15bf", "comment": "Malware payload (Gafgyt)", "value": "3566ef5fa742cccb1a38af8f62b4e6a43dd2812dd4f9ec7b9ee16acc33eee358", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302855, "uuid": "49cd00e3-a5ba-4c65-9720-13c69526470d", "comment": "Malware payload (Gafgyt)", "value": "52a4d3568a892a91a25e8814d6d493d16c60acc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302855, "uuid": "ebfb48de-3f44-4dd9-9551-ffc28770cef9", "comment": "Malware payload (Gafgyt)", "value": "92fe345088544afe005ded33f44fe13b3c3edb8eb2b4fcce6eb2781484edcbbe92dfd5144219939f3f4a93ec3b1f394e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302855, "uuid": "f951ece8-fd58-46ce-b938-73beac5ea052", "value": "T134D31905F460876BC2D217BAB64A425D37231F7893CB33256A34BEB42FE1B981E79531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302855, "uuid": "3de3fddc-b617-47bd-bf71-a037bc94d4ae", "value": "3072:Sdf+fvEqa9FazYA7IboRhMe391CErktmCQA9FX9aH:ifWEqa9FaNhMe3DrktmCQA9Z9aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685302855, "uuid": "fb5b1729-a3d5-497a-b36b-c951e8d80c5c", "value": 139585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685302855, "uuid": "0dafd364-dffa-4086-9439-030913e5fcda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302855, "uuid": "fd481be7-e9c2-47da-b722-ac70ee7732d7", "value": "34b16467466b977f9a10c514a8a270a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f3f151-fd7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685294279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294279, "uuid": "fe77e733-f18d-4e5d-8017-441e4b4bb574", "comment": "Malware payload", "value": "e073f29b1381202ef3f0822fd9e8170e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294279, "uuid": "8710f9f6-687d-4199-be12-d31e34c94fa0", "comment": "Malware payload", "value": "35d219aa88560f0481fa7086513713cf41056dd8642fbe96a2f233ae43caccf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294279, "uuid": "20597b3a-542b-4e40-a747-0b0d8cd114a3", "comment": "Malware payload", "value": "e6b646dff649911cb90bef83d95e4d62409bddbf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294279, "uuid": "04f93c37-881b-4c96-9f4b-1e70e41f5ae8", "comment": "Malware payload", "value": "35eec6cbabce0108cd9c8cdbd6df685d6f295d63e35618c8490406f0457e2d52c1441b8eed24d0dce1a3c797156aa9cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294279, "uuid": "60700db7-0fed-4664-b4fe-d3e207c9a82e", "value": "T13F34B701AC508E76C6C3837BF2570FA83215ABE453A3EAB69B575D603EC17623B3D560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294279, "uuid": "ff2c4b5e-4449-4bfd-b04a-dd0fd2f6195c", "value": "6144:YyseSvdxDpNWTetJ8ajANEVd1858zRqgm/WDQ/rwO8PQD:DseS1tKetJ8ajAvAqgm/WDgrwO8PQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685294279, "uuid": "64d61583-eaa8-46bf-94a5-626bbe11b7a8", "value": 236888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685294279, "uuid": "0ea683f6-981c-4301-ad4f-057498a4ac93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294279, "uuid": "391c4131-83d5-49e0-8cac-72e1f7dc9b87", "value": "e073f29b1381202ef3f0822fd9e8170e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23173725-fd27-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685258005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258005, "uuid": "6c666050-0596-48c6-80e0-47ce5a051aab", "comment": "Malware payload (GCleaner)", "value": "d30e54f53559860093096109d25ecabb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258005, "uuid": "59ad4093-48d0-4e77-ab99-015f29ae5be0", "comment": "Malware payload (GCleaner)", "value": "361ed549476b6ec80f9c95564cc7e3979a8e5d31f8f95eb4c71c46800f0bf327", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258005, "uuid": "57dbe924-f08b-4ca4-9359-32cc013bdecb", "comment": "Malware payload (GCleaner)", "value": "114d19d380744159c8af59513b652104ea61ed4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258005, "uuid": "c0bcc46e-3c66-4ae1-ba2e-2380fbf84295", "comment": "Malware payload (GCleaner)", "value": "bac3e7031846e37ed7d27fca65cef094f1b3ee526c957fed7bccb4ca9eda6c58e5950042c2db20983c6b1a8b9af3a5f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258005, "uuid": "92fc4fe3-dd75-4ae9-b4c0-2c7a092c1aec", "value": "T1EC85BF3FF268A13EC46E1B3245739220997BBA61B81A8C1E47FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258005, "uuid": "d8cdef66-49e9-4e07-8b8e-137b91549b44", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258005, "uuid": "3942ee06-84e3-4e8b-b7d7-432649eb2c60", "value": "24576:s7FUDowAyrTVE3U5F/fGqKGKic6QL3E2vVsjECUAQT45deRV9RW:sBuZrEU6wKIy029s4C1eH9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685258005, "uuid": "4bb7d7fd-221c-4eb9-bb44-9bdbdfa28017", "value": 1766781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685258005, "uuid": "2010b0c2-90f9-4d50-b51c-80b46c727556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258005, "uuid": "96a38009-54be-4345-8936-c631c5e08aab", "value": "d30e54f53559860093096109d25ecabb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a69a071-fd26-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1685257695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685257695, "uuid": "d16c2f73-52e0-4993-84b7-4566cba81a64", "comment": "Malware payload (Rhadamanthys)", "value": "fcec2cbdec0ef30831ad1c9ec5513d4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685257695, "uuid": "fd424608-4c26-4c01-b9d4-73c7d9119151", "comment": "Malware payload (Rhadamanthys)", "value": "380c81695a2340dbaf8d0427188536d1eddfca4ee41a5aa7d23eb8a91d617c4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685257695, "uuid": "d5d82854-c89d-4c21-8a0d-d758d2ee2ca8", "comment": "Malware payload (Rhadamanthys)", "value": "efb3f8a76db7ed05327427ec1080e2cac40cac53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685257695, "uuid": "0d7b736f-710e-4a6c-bd3a-14391bbaa815", "comment": "Malware payload (Rhadamanthys)", "value": "c74088120eef8f026d3399f3e2dc259115a3294d80a563a23cf21901668cc9fad28368ab6daab12bb1accb4fab75f454", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685257695, "uuid": "a3457d2f-1d7e-47f2-ba61-d10a065c1370", "value": "T180B49F1396E2BD54EF668B729E2FCEEC762EF1508E49777A21184A1F04702B2D173712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685257695, "uuid": "84bd09a2-4a3d-4ce9-b532-94a29b088c34", "value": "d302e4ac3406067f8ed838633897aebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685257695, "uuid": "c7b3e3b4-646c-4393-940a-5db36484ecfa", "value": "12288:5nX28I2rkGc277psmy/76QkR7f0B0PuI:pX28I2/aZwM0mI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685257695, "uuid": "7120ddc8-6293-4941-a1bf-545094243026", "value": 496640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685257695, "uuid": "5eb7d774-3e23-4f28-b0bc-83bf63393a84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685257695, "uuid": "150126ac-44f6-464e-9b8a-b65782652223", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c59413-fd80-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685296288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296288, "uuid": "7b05b4bf-53f5-4d38-bdd5-c49732c061d5", "comment": "Malware payload", "value": "bae6c0faa24fda3118cfdfc7f3f2553d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296288, "uuid": "173a59b4-521e-406c-9a6d-9e66d6071d94", "comment": "Malware payload", "value": "38f792a175c366b53407143da8c13ea2f1d3600b00ef8e8f6ec7e0ef79dcb6c0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296288, "uuid": "325ff7de-2400-4ea1-82f5-b12b648fbc99", "comment": "Malware payload", "value": "e6592d7122a73fda5f9cd98b5e49d5d80f0fe4fe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296288, "uuid": "04058767-4224-4ea0-814e-2ee56db68568", "comment": "Malware payload", "value": "906661afb46c651075e4095bc3b0d52b8b063d20a2c8f824e8f14f1dc7896f1be81c46573ffdb6b89261d899e24abbe6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296288, "uuid": "1dba31af-2a6b-4caa-8d4a-45a64b05189e", "value": "T111345B2A739A4F63C27D5AB890B3411413F3FA4B7277E78A3D8841E90EE27948F45791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296288, "uuid": "409b587f-652a-42df-931a-2c2c3edd115e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296288, "uuid": "a9f0c423-4d94-4ee7-ad2a-de041e71f915", "value": "6144:8+jn7PfWDycKPudCuS74kvw6Mr9zmduLn+70pKXQl29ur4cm:8+gycSzre2q+70pKXQl29ur4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685296288, "uuid": "643acbe3-ce9a-49c7-8eb3-7c0eb8ffa75c", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685296288, "uuid": "8839830d-5dd6-4ed8-b017-c3b7d313f209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296288, "uuid": "a0e877c4-0b21-4750-8cb1-ba3364edf1b2", "value": "04099999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6978433-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685300316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300316, "uuid": "59ce2de0-84c2-4b50-83f4-020ae38a1006", "comment": "Malware payload (Gafgyt)", "value": "44fd0ab94a23734aa91ca28b0f412946", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300316, "uuid": "6d507102-f987-48ec-b75e-97eab359d14e", "comment": "Malware payload (Gafgyt)", "value": "39049c006affcdff3476a317732a70e08e64d206dadd71de8ff89fd9575bc3bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300316, "uuid": "eb565a9a-94c2-413c-8366-4fccb205fd64", "comment": "Malware payload (Gafgyt)", "value": "329f6045f68811017a32b804909a6c386c7e8b58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300316, "uuid": "b49ce181-6f4b-4eaf-af9f-c030c4d54eb9", "comment": "Malware payload (Gafgyt)", "value": "49e75e2874f8c7e3f07705a460c486ab18164d0e73879682f0f3717831867abf502be3f424c615dd965b5d4404604741", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300316, "uuid": "2f529668-3b58-4de7-8c82-a43e93a2c218", "value": "T1A4E3866E3E21ABBEE16886310BF76F70C39529D636A19342E16CF7185EB124C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300316, "uuid": "c7247852-3345-4cfc-8fe7-9b1ac4225afe", "value": "1536:mVNs7K797V+nv57gbj6l6T6B6v6N6/6AePe1ebeZe5bwClA2rKQA1dXAQTI/e0hb:vY01ZkXAQT4Ny9//ImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300316, "uuid": "d28e375c-ea5f-4233-8276-31e932f4b145", "value": 152121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300316, "uuid": "a608bef0-8d63-4b55-9d81-4a127eff77b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300316, "uuid": "38de3fff-130f-454b-b416-e678b8698d69", "value": "44fd0ab94a23734aa91ca28b0f412946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7835e1-fcf1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1685234994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234994, "uuid": "96909248-4024-4b2a-be21-2502be1d59f4", "comment": "Malware payload (LgoogLoader)", "value": "bf8f302caa117de37a368e5e1b92944c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234994, "uuid": "ebb818c5-8193-42db-a45e-90412462821a", "comment": "Malware payload (LgoogLoader)", "value": "3938761608aefadd2334475fafbf1ef2fd262613978ef2f2a8267c4aa8cd1e06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234994, "uuid": "39399eac-af4e-4f8d-a7b0-cf2bed9c9d03", "comment": "Malware payload (LgoogLoader)", "value": "9a35d1113f23eb70dfaaeed05d9cd34e7e0ece4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234994, "uuid": "b6785946-be96-4e81-99b5-6917b6edbf08", "comment": "Malware payload (LgoogLoader)", "value": "df3b5cbb1a895908dc258684f3d40006e687f89d13511fe60fb0a55055c65682664bf729f0696c3d4f73444f258373ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234994, "uuid": "672e5694-5b53-442e-9289-809bac19695e", "value": "T1DCB4E062E3E30471FB98D1726B42E901C2E6AEF59561E5C3FF819B9CAD1039345326E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234994, "uuid": "ea05a646-706b-4e72-8cae-345fd7c4e6ed", "value": "12288:MhhZ7zEJ0DqxP60hghGo7M8BFiYo43wU17fmEzdJ:xxkHTBFiajJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685234994, "uuid": "8739ecdc-305e-46df-a1c4-994547a7403f", "value": 506728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685234994, "uuid": "84ab4108-2009-40f9-b964-ae52fe79a894", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234994, "uuid": "8be09a20-015a-4a66-90d4-9cc38d6adeb4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c49bcb-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685300360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300360, "uuid": "75cc6324-e42f-4f02-9b0a-4dcb79ea8d8c", "comment": "Malware payload", "value": "4fbebabe5d31911915528357adf04c84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300360, "uuid": "1423d74b-24a6-4c18-9a4f-9ca638ee506e", "comment": "Malware payload", "value": "3a0966f7a412bb467a53a609ac1b3a485de520b9b9fa535791670126c7596a94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300360, "uuid": "2fc2b705-7066-4fbb-b5cd-4af58f0f369a", "comment": "Malware payload", "value": "8d24f03f2a05803e59c87a8686d214285efaeeab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300360, "uuid": "9b5c2f83-ce62-45ee-9c9c-771e42c4696e", "comment": "Malware payload", "value": "0b3666ed2fab25896226504a29768d07422c924645c4d6f7b1d3a87da0103fc06a8a5ac944bb6f2779539a4d5ce379b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300360, "uuid": "dd90cc6d-6753-40b9-8477-10274742623c", "value": "T1F6632A31BA761E17C0C1A47A21E74B65B2F146CE26E8CA1E3DB20D8EFF619402543AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300360, "uuid": "f060e1be-262b-480b-95cd-3425ca5267a1", "value": "1536:OUOYAhEslbt4HKP0FoG88Qk4N75NKbt8tuc:jO1QH6G34NV5Mc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300360, "uuid": "28492c7f-59dd-4872-9a91-51d8b3b76d96", "value": 70152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300360, "uuid": "cd7f94fa-6980-4191-9e7a-6577c74362d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300360, "uuid": "c4dc9353-b28c-4e67-a28b-6a539354f7f9", "value": "4fbebabe5d31911915528357adf04c84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c342f20b-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685300364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300364, "uuid": "6baf0f76-acd3-4777-a27e-fdfc8c82c28f", "comment": "Malware payload (Gafgyt)", "value": "848ba04d1cc0ee00cb4fc4f38cc7c1d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300364, "uuid": "5e5885ef-0913-414d-82c3-4ecfc13c193d", "comment": "Malware payload (Gafgyt)", "value": "3c519281cb34cf88e05170fb6cb665a8e16ad3718e886595344f25b7c10c34d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300364, "uuid": "d06ce2fb-61bb-4986-9562-b2228c79e1db", "comment": "Malware payload (Gafgyt)", "value": "db59c5312940516a9d2f89747f96954c77c52a97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300364, "uuid": "d7c1cae9-8479-4ac9-918a-c93375bd8bd5", "comment": "Malware payload (Gafgyt)", "value": "f38d230b8c6c5a578e21b03192c4d52fdc6eb4b4c89b4284e3491d15e67511dce3318e48c84acf5f60d8eb1de7fa006d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300364, "uuid": "57dd72d5-e9f1-47c7-bc23-8c898dac01bc", "value": "T116B328436B1C0B87C49B9AB01DA737F18B69BD7112A351C9A90BFEC04733AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300364, "uuid": "a7bcf3eb-a426-4d06-8aad-c3457871123a", "value": "3072:WD3l+XQzPeV91310pWudSKakpNDtm2pgYMidIP1W:WD3l+XQzPe713CpWCSypxtm2pgYMidIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300364, "uuid": "636e787d-291a-4d4a-8f81-391c2a424d3a", "value": 113194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300364, "uuid": "bb5793c8-c8d4-4c4a-97ff-84010b491b12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300364, "uuid": "c52bc39b-aec1-449e-97eb-36451bc51e29", "value": "848ba04d1cc0ee00cb4fc4f38cc7c1d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d5ebf9-fd93-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685304440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685304440, "uuid": "8c0bb326-afa0-4eaf-b934-7a9320d336b9", "comment": "Malware payload", "value": "6871449a52e2076a89a6c9279fb35475", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685304440, "uuid": "548f7b6f-fbc0-4c87-a7d7-9c0912e2c36d", "comment": "Malware payload", "value": "3cb22c29fad4b8369e7c77f5b7d7bf81941cbe57bc5df6fcadff39810234ee31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685304440, "uuid": "5b2965d7-13ab-4021-862c-e7f249333a5e", "comment": "Malware payload", "value": "de600d1a6a97cd29bd977cd0db2bddfc2a403e63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685304440, "uuid": "7d965e20-d317-456d-812a-2b64420f3d0c", "comment": "Malware payload", "value": "18373ca9bf7b5a44bdbb55f476c6a180729e3cd5ccf6655937189bedb78eb58f4cbe085e6e9659b48fe0a8652840d11a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685304440, "uuid": "81a8fef9-8f2e-44bb-a127-03264d4febf5", "value": "T16DB21A4F3FB98866D57C177486A5965003B091870423EE2FCCC554CBAFB36D92D48AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685304440, "uuid": "9bbe9542-10d8-4e38-91dd-8fe392632ad3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685304440, "uuid": "bbd23faf-3e90-44a8-8594-58113812acdf", "value": "384:ocqbCK0l4h7o9SVyDGvENuh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZVVJP:X30py6vhxaRpcnu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685304440, "uuid": "c1798ec3-ce8c-4d25-b964-f20f7c4763c8", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685304440, "uuid": "ca5c909e-8af6-4537-9c66-353fd5f3056d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685304440, "uuid": "e56efacc-441e-445e-ae8d-f5a91362cd33", "value": "bMY4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a77a507-fd64-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685284216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284216, "uuid": "012a800f-6ad1-4be4-ae85-0d5e888d60d5", "comment": "Malware payload (Amadey)", "value": "f15f8447083e29f68427f68fbabb40ab", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284216, "uuid": "9a28c66f-b982-4176-b558-45e1dc860405", "comment": "Malware payload (Amadey)", "value": "401843b736202f24efce50245a8ef503d67c561a857a31adfe825cc005c8de51", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284216, "uuid": "b36d3bb5-2b1c-4a2d-accc-75e79aab81af", "comment": "Malware payload (Amadey)", "value": "5623cb5c8d3ca279eb9891f589c23068208d70b9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284216, "uuid": "1bcb7cfc-0644-47bd-a37f-c2250f988e27", "comment": "Malware payload (Amadey)", "value": "556ba08cf7592856074f2c2f5f62cbe9efbae343e313aa6d32163c14ee1d5cf41b95312de8913d8a9e24f18b9c95b6d5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284216, "uuid": "7bac472c-90e2-4f07-8f9c-d739293292f0", "value": "T147051281BBC99072D9B427745CF347C30A373CA25E3887261351A5AD5DB3A9858B2B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284216, "uuid": "9447a2fc-429c-43d2-83b3-37faae6e6d4e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284216, "uuid": "d76639c5-478f-41c6-aa2f-ddf0eec5b003", "value": "24576:gyjIcI9W7kpIMYQ+kj/kSwmsdrZ9XxJl2MpWIUhMHK:nj3H4jsSwmsPBxJSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685284216, "uuid": "26a6d303-bfd2-48d8-9864-a4eaf30647ec", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685284216, "uuid": "7859e6bd-4c6c-49ab-a238-13e1d2584f48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284216, "uuid": "45fd1303-ba0c-48a4-a47f-c82b100bc9d1", "value": "401843b736202f24efce50245a8ef503d67c561a857a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc51de20-fd81-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685297024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297024, "uuid": "9c71b347-3376-4914-83a6-7c578857f111", "comment": "Malware payload", "value": "b9d219eba586f59176db758cb41a245d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297024, "uuid": "2e1e83d7-1de6-4826-9cc0-826379646d25", "comment": "Malware payload", "value": "404e0620233f6e194107894780ca37bb2792d6a21271563a896287735a2a23a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297024, "uuid": "e3b85556-5f32-4dbb-9f96-2c7650731390", "comment": "Malware payload", "value": "92f76520012fda1094ce747ceb6685f1c200d151", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297024, "uuid": "372e07e5-e16a-4062-88a0-34845d9effd4", "comment": "Malware payload", "value": "2111a835de5cd38c6169fd84bd949d89dab8c8e43733ebe2b15eb1c24d04e2dba4db10bed621f6b59e3fa109c467fff6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297024, "uuid": "0c08f9e2-bfcb-4682-8f66-6169e4b7160d", "value": "T103050222B592E076DE0B40F0105EE6371FF08E224C66CE5FD791EE75DEB22911865A3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297024, "uuid": "9bfa0542-63ae-4d86-8871-281714202e46", "value": "e3c6148870b3ee2911cf20d47e6d7e64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297024, "uuid": "4f56dfd5-e587-4c09-b9e6-a6b8f939bd62", "value": "24576:urfmRBdMgY+/6CQwVtTnofcD3JxgKqWzcj:4fmRB6gYU6lwTTMcbYKqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685297024, "uuid": "66e384cb-115b-4666-adf2-fe7d6d5445d0", "value": 807136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685297024, "uuid": "0b6fc84a-5042-4608-b4fe-c70b0f9eb231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297024, "uuid": "a25c19fe-f610-4bbf-b5cc-2cdea9d0cd26", "value": "MidJourney.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a461f221-fd6e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685288716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685288716, "uuid": "72a28b4f-a784-46db-8c5a-f2edbf2924e6", "comment": "Malware payload (Amadey)", "value": "54d065d10ad88b6080baff4c9022cefc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685288716, "uuid": "cba451d0-514d-492d-ad2a-37d7b02ada36", "comment": "Malware payload (Amadey)", "value": "412bd8c4546d08c9c75382080465565edbddc407221934823da9bf4ff123d115", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685288716, "uuid": "2fef400c-0609-4d76-9ac9-cc7965fe4ae9", "comment": "Malware payload (Amadey)", "value": "d9b643436915fea88540eb0fbbf935983250f1ff", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685288716, "uuid": "3e994535-6132-4f38-b8cd-00ef02ebf8a6", "comment": "Malware payload (Amadey)", "value": "7a85dbb34b81d4604197e636ec97f23edbd7f2412039e2eb80c16efdd818ed82dda6b281452f8a452a78821a5cc3389b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685288716, "uuid": "0b21ecd6-74eb-4b02-b25e-c6b0378d09a3", "value": "T1BA352312BBD9A032CA751BF458F706931F31FC154D38626F72886A8D5DA26C8E97036F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685288716, "uuid": "d51feff0-b707-467f-9a7a-2b0b2f5bcba6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685288716, "uuid": "2af1528c-feb6-4ab9-8cb5-3159c2e47bd0", "value": "24576:IyX3/4SELG+qwIDC/948Y5D8Wfs6u0VPD+9iG2bel8WvelERK:PH/QOXDCl48Yh+6ucPDjG26aie2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685288716, "uuid": "5946217c-ebf0-4a62-9460-a3ad9192a9e2", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685288716, "uuid": "2daf8318-dd60-48a6-942c-abb62e0ac27a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685288716, "uuid": "6affc413-6265-4717-8ab8-b4af5b1527ac", "value": "54d065d10ad88b6080baff4c9022cefc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a57c2498-fd6e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685288718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685288718, "uuid": "7913f217-b5df-4845-b23d-e447ce9de4c8", "comment": "Malware payload (Amadey)", "value": "ecfd629d62d306a1cbf683345938d870", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685288718, "uuid": "c45c5d8b-e3d5-4c41-ba25-2b3041916757", "comment": "Malware payload (Amadey)", "value": "430179456dab467022eb705c119e2a6251c5e4eecbf68764122b7831da42c1cb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685288718, "uuid": "4c6336fc-72e3-488c-a6d6-06907aca8b4f", "comment": "Malware payload (Amadey)", "value": "8574a1913fe8e0c0f9bc3fbc5df17c4a85c1a18f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685288718, "uuid": "634c54bb-14ac-4360-8dc2-6706fdd8cae7", "comment": "Malware payload (Amadey)", "value": "1e6fcf960815276145e600f4b06385081875a72ef3f2089d4234bab19b04b068d2f049fd3ca3c54574e3085ab756c882", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685288718, "uuid": "94d6b253-eea0-47b8-a3e5-bdf2a06e2333", "value": "T1CA052307ABED8477F8726B705CF322830E39BD611E7983076B617C198C726C4A93536A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685288718, "uuid": "79d34d0b-9cf8-4272-a61c-be9603bf1e3b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685288718, "uuid": "d618c08e-74bd-4901-8eb8-6f88e36bf195", "value": "24576:IyHDrgG4rdyK08jZ4kXObebmlJu2gLuE4:PiYKVO96bmlJu2gL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685288718, "uuid": "2d9d12b7-1eee-4518-97e7-00df16bd8225", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685288718, "uuid": "2594b9d1-ce43-4787-bc4d-3d408dae4068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685288718, "uuid": "5388c93b-e565-47a2-b4e6-cd13152e59db", "value": "ecfd629d62d306a1cbf683345938d870.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d3e949-fd8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1685302974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302974, "uuid": "7fbcf8f2-d1b1-4cc9-b185-8ef1e48a847f", "comment": "Malware payload (AsyncRAT)", "value": "fba73c5a9abd2782af4bcfbce153e299", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302974, "uuid": "8479d389-ec48-4a69-b832-1e227ae65b14", "comment": "Malware payload (AsyncRAT)", "value": "43cc6ed0dcd1fa220283f7bbfa79aaf6342fdb5e73cdabdde67debb7e2ffc945", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302974, "uuid": "4f16aa69-fa24-4b15-a0d3-9994123a7774", "comment": "Malware payload (AsyncRAT)", "value": "bee739c3bcc4f415ef1f363229efbedf359cab6d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302974, "uuid": "bde31c37-1a27-410b-a432-f264cd98fef8", "comment": "Malware payload (AsyncRAT)", "value": "0ecdcde846eb40787c2227a86ec9ef9866a6ddc1bab88f87148944cb2b1f827747eebd4e75c46e37f1d0be8c4159ed5a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302974, "uuid": "35ae7ee9-ab72-469f-9543-5ef1e0ed1c37", "value": "T130940B202DEF501EB173EF6A5BD8B9EB991FF2733A0B6479209103464732D81DDA1939", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302974, "uuid": "9150a44b-1eba-4cff-bcb0-65bfacb21964", "value": "12288:f8n3bVLUBUOw4ra554+zy+RG+EBH8ATUUC8up:mlG+G5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685302974, "uuid": "662743ad-2ec0-4e95-9ca6-51d0d69b3680", "value": 445440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685302974, "uuid": "310d100f-44d2-441a-8aa6-98a9a357eff4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302974, "uuid": "c2751f8d-1eac-4978-98ae-ee34bbb21c51", "value": "filehistory.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3628dc8-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685299935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299935, "uuid": "97e53ad7-9590-4bec-a57b-b6c02a652217", "comment": "Malware payload (Mirai)", "value": "af9083ac8b21081b538ec41c3c3e7d06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299935, "uuid": "099b8c71-38c3-4f0c-93fa-0806b6b0c6cc", "comment": "Malware payload (Mirai)", "value": "455056686666d8e25486e5876280b09411e461a12f0ec3744c62b2be0492af6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299935, "uuid": "8b41c97d-645f-4cda-b963-27589616b999", "comment": "Malware payload (Mirai)", "value": "a5dd358e23b00665445f9cc535ac3b21ba606de0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299935, "uuid": "61e983cf-c67e-496d-8e44-52a89529a385", "comment": "Malware payload (Mirai)", "value": "3248f6b0da91a970605a6d89418039fd92e643ddb8426d3fbac20941a125f7156a7f07ad9cf91482ddf5078d151eef91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299935, "uuid": "c1f250f8-79a8-4abb-b7dc-75ef3f3a2cf9", "value": "T1F9630956F8814B22C5C6027AF92E118E332357FCE3DEB2229D206F2077C696B0E76D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299935, "uuid": "153e28b1-5bdb-4ca8-a57c-cc8d6817bce0", "value": "1536:dpnqh/sOR5YbAP+uppI46Eoq1aHg1zGI7ic8I2+lhCS5bYon4:a/9R5ME2MaG8I2+lhCSRBn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299935, "uuid": "5162238e-0f06-4159-87b5-8a609335d7ac", "value": 70964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299935, "uuid": "006c805d-078c-47a2-b25d-5e97ac8d9e4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299935, "uuid": "510f2f98-a795-479d-846d-fe882cfa53ac", "value": "af9083ac8b21081b538ec41c3c3e7d06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3320b05-fda5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685312417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685312417, "uuid": "d7f4eefe-4666-41e6-98de-20f6bd600283", "comment": "Malware payload", "value": "4e1f62986430c5b5ff027520ab6faaaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685312417, "uuid": "6480a9fe-9518-4357-bbf6-a956d91ab6a2", "comment": "Malware payload", "value": "47150fbab90dc78df784138b4338b730abade86a28378bfc0885b5eb17a711e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685312417, "uuid": "9cf14801-bb91-4e95-aa13-5d7bb56b352b", "comment": "Malware payload", "value": "e6651a3eb1a6d40168faf3d849f7136279d21880", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685312417, "uuid": "0bbeb15a-2adc-4753-80e2-b83a8011377f", "comment": "Malware payload", "value": "5c2d2cd36754b4058265108dde8e6742410fa471f29126db14e3a07452e92fb17850a3fdfcf1e7fe41912898385f2eca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685312417, "uuid": "b2ee0145-200f-490f-a8b9-72aca12c884f", "value": "T1F6A53320C39ECC37D67799F36C2A13F1907BFD098975848DB689872E0A2B1598C1F697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685312417, "uuid": "f47d7c8a-1c91-4971-9a70-4fb3fc23f20b", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685312417, "uuid": "f2051084-b460-4a06-a2ac-121be6af6a4d", "value": "49152:eisfaeaFRUnri0b68u7jaT8hJRvqQjXIHTpauGi99Ya0vs8wuf:eijwnezLjaT4JgQjYHTpFd0UC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685312417, "uuid": "8cb7ab52-e1da-4156-9205-d6f440e2ce53", "value": 2195972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685312417, "uuid": "eaa9fe11-eecf-45d9-9eb4-4b83de9ac29a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685312417, "uuid": "2bdc7b4e-4ae3-40f9-9d0a-47d653a65d4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef88101b-fd63-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685284118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284118, "uuid": "67084ce3-69ba-4477-bd96-dc33640f48a1", "comment": "Malware payload", "value": "8da89ac6a3f661cfd17e4aca84b27f05", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284118, "uuid": "9883bf2e-a4ab-4f1d-bd52-60373501e08e", "comment": "Malware payload", "value": "4a23054c2241e20aec97c9b0937a37f63c30e321be01398977e13228fa980f29", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284118, "uuid": "8ad6311d-653d-4d66-b4f1-112b17c96cce", "comment": "Malware payload", "value": "71e1610f2c2d84760d3fb90060cfcca7c307534b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284118, "uuid": "37041b85-d591-4f1b-8955-ad40f766193c", "comment": "Malware payload", "value": "52db26c72c9150d236f7d3b83f939c39fd031517e7145930dc9763e6e98318c58071b783f7f2efa2c16894ea72b851d3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284118, "uuid": "bb25245d-a2b2-4bdc-9851-5423cca49fbe", "value": "T16CE4B51177AECA17E9A2B1B40FC5F9D7A955BC62AE0E471B3088B30FC631DC6A911F14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284118, "uuid": "67c4bd6b-c213-44f4-90ce-511672cbccdb", "value": "6144:THK/MBNPvInOEo4a0k5EM/NYh1KtDhUjszPkaDNasQMdO7OdgvkWmInj:THKsPOVo4o5/NMYtUjDaZOOdiqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685284118, "uuid": "4863cbd4-f499-486c-aec3-576724078e6d", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685284118, "uuid": "fd1f42ce-b768-4976-a99c-a5b72e8b3229", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284118, "uuid": "0e954e6c-404b-458a-9d95-a258a1597d55", "value": "Specification List.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628ffe6c-fd34-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1685263695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685263695, "uuid": "a23b2e8f-9346-4056-a9bf-0976d096af8e", "comment": "Malware payload (Rhadamanthys)", "value": "57dd320eae0fadd155619407c8b5313c", "object_relation": "md5", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685263695, "uuid": "6c11afd0-1154-406a-8b82-93c535317269", "comment": "Malware payload (Rhadamanthys)", "value": "4a524e63c81e6cf9ab8a86f8de0973ea6a6d0973545867d34eba1b777e238628", "object_relation": "sha256", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685263695, "uuid": "387bd8c1-7645-4f61-9d5f-28e393492e4d", "comment": "Malware payload (Rhadamanthys)", "value": "fc2ce4b86d64025dbba19bb84e561a27fcb6ffb3", "object_relation": "sha1", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685263695, "uuid": "f171172b-560d-4f23-a356-8e26372ef994", "comment": "Malware payload (Rhadamanthys)", "value": "b1adc38355381bbaf19474b13972593951d2914b4f23515dabb57b6cd66a7348bc8d5ca46e647cc6e676403066616f30", "object_relation": "sha3-384", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685263695, "uuid": "529649c2-bd06-4eda-8384-476a44f2540f", "value": "T162B49E0392E53E54E9A68F769E1ED6E8760EF6708F193769311CBB1F08B0172D263B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685263695, "uuid": "bebec556-2e4b-4939-8e26-082dddf48eeb", "value": "2d9ed3462f8a74bfd1231e2e9de56b43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685263695, "uuid": "b3b88f8a-906a-433f-afc7-a74ed997da2b", "value": "6144:e1z0CQa13pdiPumUtZVUqkj+VOVGakSEPhVHUk9ZuyxPwF7XgivTtiuy:eV0CQa131t1keBSEPHHUSu5tTtiuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685263695, "uuid": "ec39991b-e95e-4020-8cf2-a7df5d613793", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685263695, "uuid": "5ce51592-32e9-4627-9be4-9cfb3e1a1a8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685263695, "uuid": "56cb60cf-b41d-45ef-a404-0f0169ecdad5", "value": "09212399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db47d741-fd8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685302552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302552, "uuid": "951125e5-6732-42fe-a54f-35d9ddc69249", "comment": "Malware payload (Gafgyt)", "value": "3bff445d803c1a4dd3d3dfc491b657ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302552, "uuid": "76d5f9d3-2a2c-40dd-9755-823dfb5bad23", "comment": "Malware payload (Gafgyt)", "value": "4b1edf909fcdcd600476e70447a1f81f666e079b28b2a1662d759ad74d93f41b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302552, "uuid": "c9dc92be-1da0-4904-be62-638f0d5e1edd", "comment": "Malware payload (Gafgyt)", "value": "7a59bb3eb7be1b6dea0b26f3ddd79542f6e10832", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302552, "uuid": "7fea094c-0a29-4691-a1a6-85e5852456c2", "comment": "Malware payload (Gafgyt)", "value": "5e10cde07711ec6c04d4c19061f7e545450661e837847ed83b8e2669fc07fb2a707f45dd93b98548f6012ddf560602ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302552, "uuid": "0b2b406e-db91-459f-aa82-d79510cb72ff", "value": "T16FC3093B6B270A23C0D9507102E31332B9B9DE5938BA43D7A9D07D9C6F3A58834567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302552, "uuid": "bbcbcf19-c263-4374-84b1-c97dbc4b0216", "value": "1536:ctrv5GE2dFg8aI0DN95P8tf7PJtAcRdc0sfm7ypwYujl3IdnuW:ZP0DNPAB5sfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685302552, "uuid": "fd3e73a7-9546-4470-95ee-93d9e871cf37", "value": 126446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685302552, "uuid": "0a5ca615-7897-448e-92cd-c3ffc261e975", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302552, "uuid": "67e6d0d9-d92a-45bb-b363-23960b992130", "value": "3bff445d803c1a4dd3d3dfc491b657ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9204ad7-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685300347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300347, "uuid": "0df7c4be-0290-416c-98ad-617b0e614fa2", "comment": "Malware payload (Gafgyt)", "value": "81badec4b391da66b028b34d5036e136", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300347, "uuid": "3e399cb1-413e-4fac-a1d5-7db4736c9562", "comment": "Malware payload (Gafgyt)", "value": "4c10a77737c90203d36604eed8bf58ee051728fd7c4e5107bf4d5570b4e25910", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300347, "uuid": "89e0e0f0-fc0d-4bb1-9819-acfd85acb707", "comment": "Malware payload (Gafgyt)", "value": "3aebd1a737d56a49eb3567becc001e7922444b5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300347, "uuid": "fb420225-eb4e-48cb-8062-83e6387a69fa", "comment": "Malware payload (Gafgyt)", "value": "7922258c5191c3a0d6e8ec2ce05b291bbf369eaedfa0fac2ef221b05924be5a6737a29e3483633dbb20b8daa4e00c2e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300347, "uuid": "533252a4-4a1c-418c-9a80-ee1c1c422c9b", "value": "T1A4C30A44F901475BC3E327BAE78E038C77355E6857DB33156A38BDB42BE1B982D29260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300347, "uuid": "a38ad1bf-f0f1-458c-a281-0af2ce332f1c", "value": "3072:H63VpNeuWDGeQf8sRCzt3DxkS2YmyVUQuiXfQd6W:OSuWQEcCzt3ZmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300347, "uuid": "ee57279f-a80d-4621-860e-1bbfdc4a6efc", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300347, "uuid": "9b5cd788-2ceb-421c-ac30-1c29be50e17d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300347, "uuid": "d0534305-5ad4-416f-98e6-7563550d45cd", "value": "81badec4b391da66b028b34d5036e136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f4abe7-fd1e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685254248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685254248, "uuid": "5daae0db-3d64-428a-a5b9-45d86fd628d5", "comment": "Malware payload (Stealc)", "value": "efd9b832ee16d7d8675748986605ab30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685254248, "uuid": "ec4e7c90-de65-4878-9e98-493e6d9420fc", "comment": "Malware payload (Stealc)", "value": "4c39950215fb5cfb06df1245ed6544b82430e970e98e1e8d592e2c414e8d9ea6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685254248, "uuid": "95a7b853-2d09-47cc-b13e-31fed6596c2a", "comment": "Malware payload (Stealc)", "value": "1e707c3e5853847ee7f2115807b0f1e9b74ec9ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685254248, "uuid": "c4ba08cc-8e69-4634-8193-7024f0a0f2ea", "comment": "Malware payload (Stealc)", "value": "ee2379e62b02a199801859ec54de25a8f4b674e8481dfa58f566966c2eb9243833045284503dfa36aaa1386707724b14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685254248, "uuid": "4b295611-6938-45ec-9c34-b892fef00715", "value": "T19704BF18E28C5960D7189D7A89D2243403B759DA2E72FF3F968D625D0B437E7128AF0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685254248, "uuid": "7e63292d-92ae-4c02-9374-d4048e3d841f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685254248, "uuid": "95decd0d-d8dc-4031-8540-725689afbac9", "value": "3072:cYa9i7R6x+HUg9uMb4T7P94zTSg+vyt48UnjuV1ByeTSrvTnm7W9:cYR7R++0gKPVWBtWuVKL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685254248, "uuid": "3ce6e50a-a454-4631-aa81-23557e99d9e9", "value": 184296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685254248, "uuid": "6e14e385-8d64-4dd6-81b1-87cf1e9dc725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685254248, "uuid": "942049d4-c45d-456e-b59f-f755cf1e1712", "value": "efd9b832ee16d7d8675748986605ab30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d5341c-fcff-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685240903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685240903, "uuid": "ae4badfa-3fe9-4667-bc17-612eedfa7bd1", "comment": "Malware payload", "value": "53233a389ea9c05a23d9750571b25eb4", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685240903, "uuid": "840801c0-485e-4859-b46d-bd3df2f3d64f", "comment": "Malware payload", "value": "4c5a6bdab07dba57fe5536b23995fc1ddf117a238b74ade99acd26a2bf545be8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685240903, "uuid": "005cf021-ab61-4a82-b7ad-fd2c511c522f", "comment": "Malware payload", "value": "adea02faf44c6899ef4bb7f63e0955c12c37ceca", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685240903, "uuid": "9f0f30fb-129e-4571-a649-f01d489d892a", "comment": "Malware payload", "value": "ea8f524c71fae71b8da4994456e99f6318f75b3e747f9ac763ae345bc40f22441e1604ecf17c6173c49aa799afbb9b69", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685240903, "uuid": "4c457ad4-4e5b-4c78-a4e3-30d0c8c5a0e9", "value": "T1D6F6228BF3ACB92EC07BD0335A5A853674994C65DB46D313542CB36CA9F3AD84B48BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685240903, "uuid": "46dd11b8-9919-4ce3-ba34-0c3f72a603ae", "value": "393216:T8PQYDoa8R3TcX1XuK+5QRiGSQOLGLuRgZW7ptY2VdQrV:T6QYDoaVY5QAhZg5kQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685240903, "uuid": "f0c1dc43-954c-4f7c-b06e-ca29d9bb1f5b", "value": 16310510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685240903, "uuid": "6ad3a7b6-99f8-4409-9f09-f823bd50a026", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685240903, "uuid": "01cd9d65-1f02-4aab-b793-e2dee55406d2", "value": "wmd-latest.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e560a4cb-fd7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685293979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293979, "uuid": "38e30998-173b-496b-ad42-7d7e60be4a30", "comment": "Malware payload", "value": "1346019efe1f681cbcc48ab46dbe5d18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293979, "uuid": "63077d28-821b-4d51-ab35-118d7402780c", "comment": "Malware payload", "value": "4e72afccefb99d3c711b9ba32ad4e06771bb9194b1d14abf6299b80b8b3f2f60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293979, "uuid": "9b329604-eb4a-4888-b60c-d342da2d308c", "comment": "Malware payload", "value": "290cee448d57ee4215e66a91dc9e97d474f7afe3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293979, "uuid": "8befc34b-2405-4e02-ae1f-a6e14a6069a3", "comment": "Malware payload", "value": "51c84434e237eeea7afc05b01f1cbfd925925d6763b2bfa57d675084453a224e476233b3174165ee6cb1471fc57cd210", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293979, "uuid": "4e6f44b9-9b93-4888-807e-dfcfad3ac3fa", "value": "T1ABC3AD87F64B15A0D86342F90BC70BDD2F6321519F2FD8E76C0D6A7B687A1DB0A05392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293979, "uuid": "68eace8e-c45d-4d20-9a8b-e577cb033be5", "value": "1536:nQLZOqcbEYXlOeEz1L7HwThPcr2SXJ6ThC3NKEbd5uGPFhOZMg8P351g33Q/LWL:nQLZ9ADEBwcyEpNK2uGPFhOZMg5Qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685293979, "uuid": "03e52366-33c2-466b-8a89-09e92bf299ed", "value": 124180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685293979, "uuid": "6fac07df-9d44-452b-8092-96fcfc249d4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293979, "uuid": "1218aa39-94ed-486d-acd7-8000cb96332a", "value": "1346019efe1f681cbcc48ab46dbe5d18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626ca857-fd86-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685298913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685298913, "uuid": "5145aae7-62d6-4388-8b8b-3ce2693d9af8", "comment": "Malware payload", "value": "64526d68799a4eed9997e2eafd9bc48d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685298913, "uuid": "89e8a6ea-0a5b-4abc-b14e-444d9c00949a", "comment": "Malware payload", "value": "4ed68097ee23816012547d4fc6348f28add26227747de46f0fdd424511097419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685298913, "uuid": "32b729dd-88fa-43c5-80aa-df06c65bddc3", "comment": "Malware payload", "value": "7a9625ad83508cc4691184c3c72fc720010700fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685298913, "uuid": "384ae71f-3856-4811-b1ed-41e0a1082963", "comment": "Malware payload", "value": "eac4fd6a0ff87e4e3bf83fc01d15c8d2390292a49434fbaacb77a25c86781e7d0be0e70eaf1146f56faa167758edfdd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685298913, "uuid": "973b9bc7-bd0b-4017-98b2-8ba65913845e", "value": "T1A254071392A13D54E9764B729F2FC7F83A1EF2508F597BA922189E1F04B03B2C563B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685298913, "uuid": "5c7ba69e-0ccb-4cdf-a736-ae5f1f4dab3f", "value": "96475f7ea3cc105ae1bb971e987af868", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685298913, "uuid": "a61e4750-327d-46a9-a4e2-9f5d800c0a7a", "value": "3072:NLkcmKcLP+pizokfgcPnhKekR9WoB085Tmw3VyuQ:hkc0PgikkRng3Jly/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685298913, "uuid": "f5794dee-7ed7-4df8-9e84-36f49b5cfe73", "value": 287232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685298913, "uuid": "9e4852c3-9efe-471c-b878-aac406ce1dca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685298913, "uuid": "90a25765-7b25-4745-be5e-b15b025e2294", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af054a7e-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685300330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300330, "uuid": "406f9ed8-a899-44ab-b803-abfcc490d223", "comment": "Malware payload (Gafgyt)", "value": "8ba9037e2e5a973db3f65ec36a142a46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300330, "uuid": "785ac81f-1a19-443e-bcf2-85a7b25ef5ad", "comment": "Malware payload (Gafgyt)", "value": "4f27cc05ac87f99f9eff94cf40c017217d934063fcb8211e63664f02076d460f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300330, "uuid": "22f80a57-fd2a-448b-bdd7-7628e7aa17e6", "comment": "Malware payload (Gafgyt)", "value": "a8b0c17fb808a412e647a9ba074cac873fc166a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300330, "uuid": "4839e4dd-6b5c-41b2-b19a-c7e81d749182", "comment": "Malware payload (Gafgyt)", "value": "03c9f3f883da9ea4e8a4008426caa94165dda1ca2fa4b2756217de3961d149228eb9e95bc651f1e27ea9cd09a04285de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300330, "uuid": "43a6a6c3-6e1e-4292-bb70-1a4a66ff2245", "value": "T1E6A34B8AD743C2B3CC530AB2124BA66A4621FD3B092E9F49F7197DB09F374C97125B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300330, "uuid": "974ee9ca-0646-4437-9917-fb1243868206", "value": "3072:4WCjQrLpnr85EdT9Oa8vqbVr7F/CEgmqAgcVyZIcBI:4f5EdTbpr7FWmqAgcVyZIcBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300330, "uuid": "b8c47f97-035d-461e-8e5d-265d79a5fb25", "value": 99084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300330, "uuid": "9cbc5bb9-b612-4d40-812b-c3124787eee6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300330, "uuid": "14a28f75-ca43-4da8-9f38-32526b508a1a", "value": "8ba9037e2e5a973db3f65ec36a142a46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb56a331-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685300378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300378, "uuid": "001f57d7-7f78-4eef-b611-68e14fa846e0", "comment": "Malware payload (Mirai)", "value": "d2a33b68dda20dfd90579a7067b956ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300378, "uuid": "eb99f80a-307e-439d-9fe9-4a6313a03e5c", "comment": "Malware payload (Mirai)", "value": "5229a1c1033183b9a69d4f2c8a67a50b5d314008230ba43d88daa154fb71059e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300378, "uuid": "cf950d0e-e9b2-4df5-ad10-db99158331c1", "comment": "Malware payload (Mirai)", "value": "0a485184798048e204211969be4fea2f1cc15a0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300378, "uuid": "7bbd6f6e-94e1-42c9-bee0-33a432f89640", "comment": "Malware payload (Mirai)", "value": "d58e087445e9652277d061c12862c1873af3dd5ed4d4cf62fa004f79cb6dd3c73c6a67158da8054dc5c24410cea0f364", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300378, "uuid": "143077f7-bbeb-498c-966e-09682ac39ead", "value": "T18313E755B8819A3BC2E0237BB96E568D336067E882CF721BDD215B207AC651F0D37F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300378, "uuid": "e5897161-9f13-457d-86a8-2268d96fc1f9", "value": "768:ZgcsYpbYLgK9SX5XfXSEn9oPDTZQVV95pemOi6PDmfRoNZn79oel/NNwWU:ZBbygK25PXSuWZMremBkDmO7h8WU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300378, "uuid": "e2548339-6a3e-4003-8c34-cb39e009057e", "value": 43872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300378, "uuid": "8eaa981c-c2ab-4339-bcaf-f0e36aedff9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300378, "uuid": "cbe0a83e-82b2-4bb1-aa9b-cf8a4f35afab", "value": "d2a33b68dda20dfd90579a7067b956ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bf1e1b-fd28-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685258432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258432, "uuid": "84075395-8ff5-440c-8aae-25c6b10d4601", "comment": "Malware payload (GCleaner)", "value": "01eede3e54aa82303b303d70e934581a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258432, "uuid": "e3254ec0-7df0-4ac9-b7a5-9eefba013cb6", "comment": "Malware payload (GCleaner)", "value": "553b8b4dba248dab016b3ec35d5c6ef565bcbb46fc9768e40cbe5b3c7bebc260", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258432, "uuid": "73c0762a-ad20-4699-b30d-d0660751a0ba", "comment": "Malware payload (GCleaner)", "value": "36566f9fd824a05eab62a6afd726a03381ed7d06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258432, "uuid": "90733e51-3a5d-4634-9a48-a2ec98ed9359", "comment": "Malware payload (GCleaner)", "value": "73bf57cfe214dc64be1a5625fb71572d557701d1e07a8010e41de8e621be48d46282fb94dcb7f73fd3eee1e6b9f21046", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258432, "uuid": "abf836a5-3cd3-4f51-a89c-8226f4d307b1", "value": "T133847C5392E07D54E9665B339E2FC6E8371EF7548E093B552228AAEF08F11B2D173381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258432, "uuid": "43d796bb-bf99-4c7b-8bf9-4527b2fca3eb", "value": "697c6731df2df92c82c75859d21c5f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258432, "uuid": "516877ec-8761-4f4f-8084-30c6e88caa84", "value": "6144:sGc8oBHXSl6SNCGnXHrd08SguyIXytR4dCeZQpgZBXX8O:sG5oBHXS1AaK8zahXEin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685258432, "uuid": "0a8fd8db-a687-471c-8945-abea751e0c5e", "value": 371200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685258432, "uuid": "674d2798-0411-4993-ad32-2fec311aa013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258432, "uuid": "b34326d1-93f0-4990-8085-2be95835d0cf", "value": "01eede3e54aa82303b303d70e934581a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631c09e1-fd80-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685296337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296337, "uuid": "f2747864-7bb5-428e-9a6f-46260f54bb75", "comment": "Malware payload (Smoke Loader)", "value": "ecf37c6fdc04f6e3ba13f132b937e41d", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296337, "uuid": "1bff3554-06e6-43d6-9f5f-af4fd0604195", "comment": "Malware payload (Smoke Loader)", "value": "5572abc4caa2343e8c96aeb83fd77cc2c18749d261029e8148bb5fa404d9c810", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296337, "uuid": "9e4ba440-6039-43bc-8d11-e619053014e1", "comment": "Malware payload (Smoke Loader)", "value": "c65cf13cf01fb7cd3c4074c5c910d2032496bd41", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296337, "uuid": "c07735df-df02-4630-b51b-f8e137b56581", "comment": "Malware payload (Smoke Loader)", "value": "9c67462c5e6b01146d68564d8a66d2182b2ac0ad8fd4a49bab40e8d768ea426f84bd6234e564c4af6a37dca6071748a4", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296337, "uuid": "40ae2722-7898-4bc6-abf2-8363dde428dd", "value": "T108541A1392E13D64E9668B738E2FC7F87A1DF5509F597BA912189E1F04703B2C2A3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296337, "uuid": "487eed70-f5b0-43ed-ad5a-f2ad490d3781", "value": "96475f7ea3cc105ae1bb971e987af868", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296337, "uuid": "3cb0a259-c476-4217-9c90-82e030572c3c", "value": "3072:SNvccK8L+9fUXhYZN50uLZMjfeT+iae5Y085TBwCKoQ:gvci+mXGNDLqTeT+s2eCKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685296337, "uuid": "9c97d1b7-c09a-497d-806c-5cc82eb694e1", "value": 287232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685296337, "uuid": "eea4387a-f7a6-4ce7-b2d1-73cae2b2b26e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296337, "uuid": "a0b3a56a-81a8-4f7e-b193-cb608fb41462", "value": "05422999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd48f8cb-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685299978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299978, "uuid": "5e374447-528a-481c-a9f1-16d239c7993e", "comment": "Malware payload (Mirai)", "value": "ad8535ea3c585cf81a6f8ed9cc9b0528", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299978, "uuid": "dd4f697f-8600-4786-b6b0-13e7dea93519", "comment": "Malware payload (Mirai)", "value": "55984d47ea92a41ef772b8060467698404ed84bfe5f46a010d017df8d85d481b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299978, "uuid": "9630f43c-c3e2-400a-9129-7b4b082a5c7f", "comment": "Malware payload (Mirai)", "value": "1c8c2878a7b8671f058e81bbba424a7d890d5f0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299978, "uuid": "b46d94be-e3a5-4d3d-8eb4-f7757c07ffb5", "comment": "Malware payload (Mirai)", "value": "161679ddb143cba06094684e1f82ade4152ea14b428ba20ee893a98c7996496198b8425e53bb5caa22b7c9ed0e52c146", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299978, "uuid": "14cec592-3ab5-41b0-8dd3-d4edd16fb66f", "value": "T17EE32B56EA418B13C0D61779B6DF42453323ABA493DB73069928BFB43F8279F4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299978, "uuid": "e5bd55e1-0666-4a3f-8a42-ad11bec7ac8a", "value": "3072:iJLceVpEpBZc0aAHbz4Nb4JJXpIe1FbEXMknM/9cwAY:iJLcBe0aAHbz4NsJJfHbEXMEM/9XAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299978, "uuid": "a819ed1e-e946-44d3-9b54-72de13b27a5f", "value": 150610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299978, "uuid": "3c1812e8-0afe-4e4c-924f-b56656ed4004", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299978, "uuid": "d22a9e21-8d04-4460-85b4-35e02ac840c0", "value": "ad8535ea3c585cf81a6f8ed9cc9b0528", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e1f59e-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685299959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299959, "uuid": "b9207ccb-1a54-44cb-9c36-d340087769e3", "comment": "Malware payload", "value": "73470ef8a743da8440887c58efd85abc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299959, "uuid": "04f940da-7576-42f7-89b4-60d8d78ef2b7", "comment": "Malware payload", "value": "56dae858c9b96a7b761f7c4c6ef498c7899f2480f1fbbbdadcf3df4bf52173d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299959, "uuid": "bc429d81-df99-4711-b149-82acc09cbc5a", "comment": "Malware payload", "value": "5288ff0e5975ecb4977c5ceb36d23a0182426989", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299959, "uuid": "fe0db447-fe7e-4aca-a61c-41a631608c93", "comment": "Malware payload", "value": "67ea9718b4ec53b50e528776b9967cdb4f51b2f24f551860e004b841c781d87df6e271aa45dc79344c36948776ac1d59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299959, "uuid": "b25ab1c0-d83c-436a-baae-3e085a5d1041", "value": "T185533B9AF801CE7DF85BD77B4457090AB632B3D102821B3627A7B997BC731991D23E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299959, "uuid": "bd613fac-e0b9-4660-9adb-c88679896d67", "value": "1536:K04gnXHYK+T3mg8TD6vy+DG5T7D/juN6gayX8Yde:K01nolT3mFoDsTfurX8Yde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299959, "uuid": "ef061b94-f21f-4320-9978-23bde8fb41b6", "value": 61704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299959, "uuid": "40a6b186-9d7d-437e-9013-b1486bc28eea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299959, "uuid": "91ef3dbc-228c-448c-856a-fec3b84e387f", "value": "73470ef8a743da8440887c58efd85abc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117ec86e-fcf0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1685234353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234353, "uuid": "53feb70c-fe23-45a2-8e3c-499529fc7281", "comment": "Malware payload (DCRat)", "value": "ecee2ebd3ec0c0d36f88475532eddbef", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234353, "uuid": "fd0847af-6cab-483a-8dea-e17fe82aba85", "comment": "Malware payload (DCRat)", "value": "5a5e3d70cd466c1fd8b96432c3e547d1219f87562450259393b51780b65a201d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234353, "uuid": "b40366c9-2717-4a55-8c84-2253f7968da3", "comment": "Malware payload (DCRat)", "value": "c68350688ae49166da20529076bc6e09ece54972", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234353, "uuid": "292f1c5a-d5bb-4340-9e91-68c4122e51a5", "comment": "Malware payload (DCRat)", "value": "16d57d4369f2cc2a3160d91531eec130049e1881372c66b2fb1672899d5ef8bc65f4dbbe6d500d42d20f85df26df6fa5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234353, "uuid": "e604d82b-152e-4ddb-86ff-c75e55a2e6c0", "value": "T191650200B1C2C032E43705354AE0D7B55E3EBD700BA29EEF67A51F7E8F253E18966966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234353, "uuid": "9b6a003d-1208-4922-bdd4-8a29e66c9408", "value": "104b87c3fef9c18dcad72b41783c28ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234353, "uuid": "3f476fb7-4555-4fa6-a79c-0c320b72b90d", "value": "12288:RajiyzjakY85lAi78xkprnzbBxo0O57I3WkctrO73yvKbXRXy2/xcehJNHtIEwyk:RhmYpiwC7BxLOyWj2F/jzNIEF30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685234353, "uuid": "f25f7832-f0f0-4b2e-a0e1-21fa8a626ac4", "value": 1529856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685234353, "uuid": "494220df-53e9-4b94-8b40-200ec535f64b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234353, "uuid": "5f88a86a-a1de-468b-ab99-c90f6c5c4dcd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a4bede-fd77-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685292693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685292693, "uuid": "8eaf792a-ff13-468d-b5b7-ccded06f49e2", "comment": "Malware payload (Gafgyt)", "value": "33b201698aaa2e8bdd7f54f0e09dfad8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685292693, "uuid": "35cacbfc-777c-4b27-8575-8c8cde4c461c", "comment": "Malware payload (Gafgyt)", "value": "5a88c770aef6ae42389637c81f10ab0c530195a247da3f4d50303d455040c0dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685292693, "uuid": "a8647a67-e2fc-49f8-bc59-2b43b65d3e26", "comment": "Malware payload (Gafgyt)", "value": "0f7c121b5e066d87b4def25b34631ae1facf6ed8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685292693, "uuid": "cfe6a6d1-71b8-4c96-9615-665bd1b190d0", "comment": "Malware payload (Gafgyt)", "value": "267d631b5362baa6593ac62d4b0a03deacae8204de5633167fc11e116546cba80f4a0a317f5b1daeb26ac62137810859", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685292693, "uuid": "23f5f2b8-e4fb-4f4e-930d-abd6afca544d", "value": "T1CD34940671E09EFBC9858373B2D355B46012F8B84673E1ABBB9B6F503D8DB507B28650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685292693, "uuid": "b104b19a-9dbe-4f96-99b2-9876a2adf197", "value": "6144:VfO6Zac36N5a322jAfutJ8ayQeNNSLWJeILh/dmMNGKVlKUjnD:1O6ZgPaG2mutJ8aleNmMNGKVlKUjnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685292693, "uuid": "0b0db35e-03d3-4f22-a3b5-48d52fa6c44b", "value": 231647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685292693, "uuid": "cb16f9cb-1742-4f6a-b99c-0f62ef5778a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685292693, "uuid": "439460a4-1753-47d0-8e56-502c716e41df", "value": "SSP.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab4bcf2-fd82-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685297263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297263, "uuid": "41ce44b8-d017-4c3b-8304-2b7b3678273b", "comment": "Malware payload", "value": "64cd727ae583ab12798bf6ffbb4789d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297263, "uuid": "1c2ea735-bed9-47b1-8a82-190a53d9b77a", "comment": "Malware payload", "value": "5b0754362b1e0f5cc840c0a61334b54d09096ef7094762bd0dde426f2cb49b1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297263, "uuid": "17ac0e54-677c-4f8c-909c-319f921733fe", "comment": "Malware payload", "value": "43ef7033bc09aa8f2c65a06ffbac7cabc24f0e7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297263, "uuid": "fa77f94b-7ccc-49cd-bdeb-da931329f524", "comment": "Malware payload", "value": "32537b9a7e791b027bae491b7a606a0964e88b7a7512cc0e3d98e39c846f988b003385deed377463d4662446787dc9d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297263, "uuid": "d2528875-39fc-4afc-b3a4-ee9f9c8d8a5d", "value": "T15F433BC4F647E8F5DC5706751036FB378B32F5EA2258D743D3A99A32AC92601E613A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297263, "uuid": "a44afae2-ed7e-4786-abdc-7bac0628a4e2", "value": "1536:ka4CVvtTO8yJT/0fSGUPk+nsvNz6V/Ps06r6MX:d4CxtTO8yd/0KGUs+nKN29k0JI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685297263, "uuid": "2414b02d-d04e-451b-88dc-5dddbab43ddd", "value": 58448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685297263, "uuid": "fa2656c7-6ec4-4407-8188-5eb4d35d8f2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297263, "uuid": "a30bdc64-8191-4327-bec4-44867efecb93", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ce41e1-fd62-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685283616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685283616, "uuid": "185b8b80-e76b-4e2e-b4c5-d7c6350070b8", "comment": "Malware payload (RedLineStealer)", "value": "c8970026ae34fa6c5d5250260193ce73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685283616, "uuid": "68ede0d1-2f13-4f4c-a6f4-d070133feb08", "comment": "Malware payload (RedLineStealer)", "value": "5c2fc8fabdd8d998a50ff25bf8b27b625d50d50a406175844a5426ff4b519c27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685283616, "uuid": "ccbb6f8f-c781-4f33-8cec-6de2daebfe3d", "comment": "Malware payload (RedLineStealer)", "value": "139e3e64a07d572c030ddb4f00ba6f00d3470c4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685283616, "uuid": "91c9ad5c-613d-4ada-859b-84087b91666e", "comment": "Malware payload (RedLineStealer)", "value": "43ac865a3e0eae1522aa2f4792a0d3aebb0aa155ff17a5b2a2b25f6ecb1c6de7d4e7bc29f15ea37ca50704d47b51495f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685283616, "uuid": "8d6b4a8e-4c6d-4137-b25f-37fa5af9dbd5", "value": "T1F0052323A6D94473C9B52B3048F713C70A3A3DB5EE78472B2A4D296D19723C06935B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685283616, "uuid": "53543edf-7ad4-4ad4-81c3-bda530993654", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685283616, "uuid": "9e6ebdab-aad7-44e2-b264-680d6cc93807", "value": "24576:jyWaaR0a4xXWds/KYJfJHX8+k3KRs1Q0:2WaA46s/Kyfy+vRkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685283616, "uuid": "29612b44-c313-42d8-a3d5-6b87189e19c6", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685283616, "uuid": "a3f08448-bb2a-43b4-8c4a-8fa5dff93c20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685283616, "uuid": "c6284ae7-1235-4508-a9ad-c9e01758a325", "value": "c8970026ae34fa6c5d5250260193ce73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5d4a4a-fd8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685302846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302846, "uuid": "d3abc290-7cde-4563-903d-c00b8388cf33", "comment": "Malware payload", "value": "2ed7f061b60056ccb3e3c226ea548a81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302846, "uuid": "babbb266-8859-4792-bc91-23dbd87e38ef", "comment": "Malware payload", "value": "5cc6f3bde0c4d897334688d14cff8e98455a51532058a075db461cd31851bbd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302846, "uuid": "a7c5a8d3-50e9-4c51-9346-93f5eab6ec63", "comment": "Malware payload", "value": "e7ce9760cda7b35f36bf78b1c8bd6f4ed8569ebb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302846, "uuid": "31007b0a-fe3b-45ab-8b06-a90697991d13", "comment": "Malware payload", "value": "14406b8ca286ecac45ba1af7899a49920f16bf7ab235fa43a9eeeb829d0bf73664fe925269b399970b7a2d8491933660", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302846, "uuid": "e7fe0af2-5ff4-4566-9004-d4c40770ac77", "value": "T1E3E38366BB619EB7D80FCE7309A64501218CDD4642D93FAFB2A0E51CE76B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302846, "uuid": "5661ce09-93e4-43c1-bc37-63af349ce958", "value": "1536:bVeTpqCVvWRYx0O9vPBysZgvsgxqAz/0ufMytVYpLtaoLAImlP+s4zWfOodW:byvWmBx+sK/PflWgImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685302846, "uuid": "28d390f3-8d0c-4be1-8325-80ad804ba625", "value": 152201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685302846, "uuid": "59f7e840-9dda-4991-ae48-82f6a600f583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302846, "uuid": "d2869414-ef93-45c7-98e5-1723e2039702", "value": "2ed7f061b60056ccb3e3c226ea548a81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d78af36-fd28-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685258425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258425, "uuid": "ab991ed2-6895-4802-a203-7b4812493853", "comment": "Malware payload (Stealc)", "value": "8113e042e55fee14f263269105994b03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258425, "uuid": "145be7e6-dc56-4b5b-837e-d7176acc499d", "comment": "Malware payload (Stealc)", "value": "5da7c2a4b3b0cb14cccd91ab7d3495945204eb705664dc764a54f23717e87b6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258425, "uuid": "7524bd86-4542-4e7c-bf5c-c5e3d92d83cf", "comment": "Malware payload (Stealc)", "value": "41d956f4940ae35958dec91f50de9ac5e8daa2af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258425, "uuid": "043210e1-7ad9-4f9f-81d9-08b9ba8152cd", "comment": "Malware payload (Stealc)", "value": "12c3ddd6d43daaa73f950491263aa1678b7f2f25d6db18f5cca6407e21700cd655cf3056d240c1716c51f89244d621c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258425, "uuid": "4e767e8a-d518-40e7-a6eb-0c1efe6a07af", "value": "T180543B0396E2FC54ED668A729F2FC6EC761DF5508F19376A22186E1F05702B2E173722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258425, "uuid": "a59be9b6-55fc-4a60-a2be-79a170d772a4", "value": "82b2bd7dc938b719df57a6b2df186152", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258425, "uuid": "7224ef36-6507-432c-82e6-143734a560f7", "value": "3072:Nd92d0h6e7ARdcdUBiL39RGcK6XtK+zzXRZNIbt5QtGvAkqY:NL2d474c53GcK6XtK+fRZNrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685258425, "uuid": "cd3aaa61-9ab9-449a-89df-47803ffbb5b5", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685258425, "uuid": "c3d72911-7c90-4598-ab0d-4a22243d6a59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258425, "uuid": "b397578a-47a1-4dec-977d-0018dfea2078", "value": "8113e042e55fee14f263269105994b03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e3fc0c-fd26-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685257681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685257681, "uuid": "a4d132bd-4d38-49e0-a0bf-73a3be61d2f0", "comment": "Malware payload (Smoke Loader)", "value": "d50382b0d5ff88b7970fbd5a45efd65e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685257681, "uuid": "2b100472-2a35-4126-b4ef-b7bed8d4659d", "comment": "Malware payload (Smoke Loader)", "value": "5f428b2b1406374ebf442b695dd4c5ae14d68d58a4946092100a0471e3c6cf3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685257681, "uuid": "21fec4ec-62ff-4445-a45e-5e2b95cd5868", "comment": "Malware payload (Smoke Loader)", "value": "e11d17ecebf10d911699d70b8d1cb733ffe84bf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685257681, "uuid": "5ffb23b5-4fab-4169-88f3-d91b04656ad5", "comment": "Malware payload (Smoke Loader)", "value": "0bf8b04264db6828e4f4f4109ab6220bc4408c8ee07433526a7b1a53aeeabc6de51768a5cbd22eb67215e8c451e7ed86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685257681, "uuid": "7ec86770-ec14-49ae-a18b-cdeb3c9fd2a5", "value": "T1E5543C03D6E2BD54ED678A729E2FCAEC761EF2508F59776922189A1F04702B2C173713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685257681, "uuid": "9d1b01ec-b5d6-4f7f-861f-694809fd5175", "value": "d302e4ac3406067f8ed838633897aebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685257681, "uuid": "bf4270c1-8900-4ca7-8cf1-01690c6e2661", "value": "3072:XJGethqewnqoYMtP2O6GNIe54K7HTv7tY1CTLPd5gG+cGvABN:ZGezwnqJa96GGcHb7G5G59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685257681, "uuid": "1c9e64fa-d53a-4aba-be85-b3ead9f69b4b", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685257681, "uuid": "1935cb82-72f5-4a88-867d-2aeb66a8c8ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685257681, "uuid": "770d89ae-d3f5-419e-a8ec-12cf2ef14fe6", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb7d7a8-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685300276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300276, "uuid": "10045b6d-283b-4be3-937a-e83df3878e31", "comment": "Malware payload (Mirai)", "value": "83985ec4282317ef767f8f89e4e0402c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300276, "uuid": "3d68a7a6-d08a-4ee6-a29e-a60322dc4f4a", "comment": "Malware payload (Mirai)", "value": "60a7051334bc6cc842fb8a883b211e82ed29ec5ef0b92b7323ee79c2b6e43b83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300276, "uuid": "58bb86c1-c3ba-4569-8abb-62261d1b66e5", "comment": "Malware payload (Mirai)", "value": "0bea1df8d77697832156b3ec10fc0f7ce2228b96", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300276, "uuid": "1ddcbd2c-0389-44db-8269-06b7b80da453", "comment": "Malware payload (Mirai)", "value": "836e0dd7c26966536659ce76566660b8b1597a5f02c56f73e7f0fa002b8b1071ce00411bbdcbf1170a27df8162f49e69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300276, "uuid": "37c9cf12-54fd-4a9c-b855-1db7789eca48", "value": "T1EFE32B46EA814B13C4D61775B6EF42453323ABA493DB730699287FB43F8279F0E23A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300276, "uuid": "0e6d229f-89b0-4d1e-8fb5-6f88c598664b", "value": "3072:+QnbjiqCysE8Soayvzj4d3MDhddQ9ldJjXE8oM/9jy6mB:+Qnb3HsGoayvzj4dcDhG/JjXEXM/9/mB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300276, "uuid": "4e7c1e3e-b4d9-4e4e-99f0-f50f80196d0f", "value": 155518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300276, "uuid": "a9668709-d49c-4f36-bc59-7a9b0e18925b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300276, "uuid": "1f2df711-cf89-415b-bc2d-3a38e4d476f4", "value": "83985ec4282317ef767f8f89e4e0402c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f4d1b7-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685300421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300421, "uuid": "c109ca4a-7bd6-4278-bc4d-9e51ba075e85", "comment": "Malware payload (Mirai)", "value": "f71be8093e09a6703d637193cc3c7053", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300421, "uuid": "2353d254-7017-43a4-b20b-f034f4ae7c95", "comment": "Malware payload (Mirai)", "value": "60ca205e919729da3b2a470ba0a868f4ed71cf34e6c0eae769cb70bae91f0b13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300421, "uuid": "f23d4685-2204-4137-aeeb-d14ea518eb3c", "comment": "Malware payload (Mirai)", "value": "1cc36704f85986d508d2cd64cb069da871935a60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300421, "uuid": "f0124abe-d80c-445c-941d-809622190c97", "comment": "Malware payload (Mirai)", "value": "6690f95ebc0c9ffcf3cc52fcc5f56f5edb802a3bc1097e879a69c779716e791793a6d3277b1886e144075cc863057181", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300421, "uuid": "8b7083ac-dbce-49ea-ac9a-44be83578c74", "value": "T116630956F8814B22C5C6027AF92E118E332357FCE3DEB2229D206F2077C696B0E76D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300421, "uuid": "a3a924a2-8374-45e9-bc54-8ccbdd474d88", "value": "1536:dpnqh/sOR5YbAP+uppI46Eoq1aHg1zGI7ic8I2+lhCS5bYong:a/9R5ME2MaG8I2+lhCSRBng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300421, "uuid": "66445d89-c996-4f88-a87f-bb1567aa2a41", "value": 70964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300421, "uuid": "68ff748b-3b78-43dd-ab87-027e7acb9f72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300421, "uuid": "7f3546b3-da51-4ee6-87ea-4afec8b4980d", "value": "f71be8093e09a6703d637193cc3c7053", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7415fa04-fd38-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1685265442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685265442, "uuid": "4a522cf4-4602-4946-8798-981c5930135a", "comment": "Malware payload (Glupteba)", "value": "01fe6ba28d82175d35665b3eb6ed8cea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685265442, "uuid": "3a75ced7-61a7-423c-a83f-99affe982d08", "comment": "Malware payload (Glupteba)", "value": "626df082c2624d9530794881921094aa100fa0a805b1544112d5a07dbe12cbc2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685265442, "uuid": "87b99655-0627-4e77-aa89-15f54c9d5872", "comment": "Malware payload (Glupteba)", "value": "45748a6d6474f470d44e848596e0e08bce674996", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685265442, "uuid": "d8f9c686-3999-4ab1-8603-8d27f1a2ce89", "comment": "Malware payload (Glupteba)", "value": "69e7c5ae455633703f39cffd8f1ba7dcd680d9be9a9c44d3b9152dc265b9d59cae9d30d7aaff95168b91716ba99e08ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685265442, "uuid": "dd782fbb-23f5-4676-9307-fed41f8cef52", "value": "T1BB162313A3A1BD54E9564BB39F2F92F8776EB6708F143755311DBA1B08B02B2C263B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685265442, "uuid": "d12b1168-91eb-4f49-bc5a-0df5fd49abce", "value": "2d9ed3462f8a74bfd1231e2e9de56b43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685265442, "uuid": "7a4e45c5-c670-4a13-9d70-9c0900cb8ae2", "value": "98304:/RKU80KHe0iz3Dt6Ds6DV8G66EjKN69i5SvbFOqRrLfO2FnC86:/4e0i7Dt6XDGG/EjKN6LjxdFnC86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685265442, "uuid": "393bf01a-a70f-410a-9388-2ae0bc13bea9", "value": 4379008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685265442, "uuid": "65e3081b-b9d0-41ed-89e4-b7997a80586f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685265442, "uuid": "004f926a-b349-4d84-a7ba-dcda5a5c7fd7", "value": "01fe6ba28d82175d35665b3eb6ed8cea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce892f8-fda7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685313051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685313051, "uuid": "24f4281e-c94c-49c4-994b-d5cf7f53a433", "comment": "Malware payload", "value": "73ccfc795f9c5e2bc4d8706ab367a43e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685313051, "uuid": "93fd803d-338d-452a-a38d-1427a52e932e", "comment": "Malware payload", "value": "64d09f88ddddc0fdd0c7ff45acc9418b110b25a99a5a8ec08668a6144c73bc86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685313051, "uuid": "f7ebf8bd-964c-4058-ad29-0ffc5b005a5a", "comment": "Malware payload", "value": "e5edf33a0db24a2dfad352508b920660b8754978", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685313051, "uuid": "3ce2308a-bf1d-4a66-a7f0-ae12cc7820a7", "comment": "Malware payload", "value": "225191b25d064d1c40f3e354971d1b57687adc89580da07f14285711bc0ae6119fdab4ed26e950408164783bc0eb1ef2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685313051, "uuid": "3da54fbb-e7ee-4539-842e-baa545a662b1", "value": "T18354081382E13D45F96A9B729E2F87F87A1EF6508F5977A912189E2F04B03B2C173711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685313051, "uuid": "72033f4a-5cc4-47bb-9d3b-781f4ab2a049", "value": "8e382607a3e33198b48c3f30434124bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685313051, "uuid": "b8195879-0623-45b0-9a53-ca9548d9b2dd", "value": "3072:TBWn/DdHA3T/xoxOtE/05yXF04ubot2sK85HqH5Ztw+ShQ:VWn/DcM/0oZC80y/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685313051, "uuid": "621f1b3f-57a6-4284-8592-17003d17ea4c", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685313051, "uuid": "53ae98c7-a60d-4201-be7d-aa9f1c7f90b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685313051, "uuid": "3c7555d8-53ae-4180-9ad9-459284a04319", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8b2305-fda9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685313988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685313988, "uuid": "987e132f-e310-4f21-b031-b08a35104868", "comment": "Malware payload", "value": "9e8fd9b52cc7c49d4d6f4b06871d4ac3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685313988, "uuid": "aaf63172-3b56-421a-814c-67353d2ef3fc", "comment": "Malware payload", "value": "689468657a6a412107280d600296af39e1a25c439ad8f838d02dd0de3196bde0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685313988, "uuid": "12e8e833-0a6f-43f0-990a-e8d6dff896ad", "comment": "Malware payload", "value": "f8fda1b7940328c06fc0624410683379afa0e683", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685313988, "uuid": "c44bbd6f-8ea4-48f4-bb5b-8387c08acebd", "comment": "Malware payload", "value": "3d26e75268a9f4cb05332deced7e6545451f3f2ded78f018b93961e0c5cffceece6845f6077a3eef3f00c486d2b67db2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685313988, "uuid": "42b2a5e5-21aa-470a-ba70-fa3e65b51615", "value": "T1F054091392E23D54F9668B729E2F87F87A1EF6508F597BA912189E1F04B03B2C173711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685313988, "uuid": "c8eab704-88c3-4b17-b8bb-4b4094b41b6d", "value": "8e382607a3e33198b48c3f30434124bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685313988, "uuid": "e14ca594-49d8-4bf6-bcb4-7988d64b0bbc", "value": "3072:kEJ3SeUHEbUg295fWPlejybLCuyJAbn1EtGqxqH5Z5w9udc4JQ:pJ3Se1Ug2LWPlJLCuiAb1urMGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685313988, "uuid": "e74460dc-bc05-4463-9d9b-684b43d5a9d5", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685313988, "uuid": "6fe1e6fb-f832-4457-b7cd-661c1cf12353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685313988, "uuid": "28759148-2411-41a6-bead-1cecb69c063d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3c2358-fd74-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685291419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685291419, "uuid": "e0b3c0a4-f7c9-4e77-963b-d0c967e5a565", "comment": "Malware payload (RedLineStealer)", "value": "40bc6fb18a518a65421cc78c46c98c49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685291419, "uuid": "d1630349-5523-43cb-817a-6794a469cc47", "comment": "Malware payload (RedLineStealer)", "value": "68ec61b76e385c4c35e40da65491e97d41eae46abc4049533773b922c65b868c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685291419, "uuid": "e7cee048-406f-4c3a-b720-d526bb7dc17e", "comment": "Malware payload (RedLineStealer)", "value": "80756062de29ecee6d7b38e671f21340838781d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685291419, "uuid": "c149a245-48a8-418f-a3f6-95f0f3788111", "comment": "Malware payload (RedLineStealer)", "value": "18405f1328a9cdcd4f46c837207d138ebf2b84666469791e850158b97c50016b17be466e2af42afec48b2c30458ea8d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685291419, "uuid": "c729fa6f-5575-47ba-a117-c002d0124c66", "value": "T1BAF6D01DB6C99DA3C351587A609219905730ECB9BD87F31F24CDB3BA883A7D6010DE6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685291419, "uuid": "d28e7a2a-78b4-4431-b08f-ebcdb2cfab46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685291419, "uuid": "ca2c147b-578f-4fa4-97be-026e7e9638b1", "value": "3072:HYlntyRIVW8X1aq/4bwKZ6IwjqQiQejCMz6FFzINsmO+OF61aTo6oyTcbNYFEBP/:HA7lXwclICliQeuMKzIKmx1MTcxKirh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685291419, "uuid": "e4d46245-78a4-4435-8a0a-5c20742b8f62", "value": 15981568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685291419, "uuid": "060e2e8e-9f13-4645-b7d5-2eb895902cd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685291419, "uuid": "14a3ac9f-9b06-4fed-bb76-561aa0725916", "value": "68EC61B76E385C4C35E40DA65491E97D41EAE46ABC404.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a5dcba6-fd7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685294283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294283, "uuid": "482cc254-a5cb-4d91-9037-48e08b9da256", "comment": "Malware payload (Mirai)", "value": "167f9f9fd5286a293e08515a4bcbb69b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294283, "uuid": "e704b421-458d-422e-aa04-b75e69a085e3", "comment": "Malware payload (Mirai)", "value": "697d90feb2c09182221db082956d09011799e9d36f4554415cb791ba1e9332b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294283, "uuid": "b7e01848-9351-48b3-a738-d8e1616dcd9e", "comment": "Malware payload (Mirai)", "value": "91adbdaa3b0aaa4d5b4ac63862c6b8a5201b0735", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294283, "uuid": "c5cb9092-5b06-44a6-aa82-5c80ddaae06a", "comment": "Malware payload (Mirai)", "value": "2faae2d0f767d90752107cd4d55645e501b3964c4b6e6c0166e0339b568c46e713fa0816244fd1b5f3ae9078ab17c767", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294283, "uuid": "7d5788cf-ed1d-4519-8266-bb5ef25447e2", "value": "T174A3B41D3E218F7DF7AD82384BB78A25925833D636A1C585D25CEE011E7038E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294283, "uuid": "9e13c6b7-5cb7-4ccb-87a0-e1be49a2c179", "value": "1536:vNtcY+IiX4Wb7Z/hf+LEmJw/M99737Ir0wQ4iQlenCxYqo3RSPX51t5332e:VaH7Zhf+Lj33NQ0OY3hk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685294283, "uuid": "5c77931b-8139-46e1-a0e1-52458566f735", "value": 98408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685294283, "uuid": "2aa6cf6a-181a-48d5-8417-293a5efcd420", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294283, "uuid": "b985ac5d-e1c8-476e-b348-f92444de96be", "value": "167f9f9fd5286a293e08515a4bcbb69b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e5624a-fd78-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685292794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685292794, "uuid": "1d6248d3-5861-4931-b766-6975fde40281", "comment": "Malware payload", "value": "dffd1e8edb7e8ccdf67151829dbf640d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PUP", "colour": "#82B746", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "themida/winlicense", "colour": "#63A0A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685292794, "uuid": "efd48d87-df3f-4e03-ba96-d662fbab8bb7", "comment": "Malware payload", "value": "6c7b762db04c70d286c9fba229383ca55818c09e70dd53ff8174570214a772de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PUP", "colour": "#82B746", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "themida/winlicense", "colour": "#63A0A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685292794, "uuid": "5cab5fc8-9b1d-47f0-b6a1-8e84500ac880", "comment": "Malware payload", "value": "c235689a1e69349fee9d76f4f3df047253e223c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PUP", "colour": "#82B746", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "themida/winlicense", "colour": "#63A0A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685292794, "uuid": "63428b1e-222c-442d-92e1-0279074be6bd", "comment": "Malware payload", "value": "bc9222f3764567250cf9b59e289b7dd23899394f8b704dbdadebdacf6be1e19a56cecd04abf712fd5ab7cc31e43f0658", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PUP", "colour": "#82B746", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "themida/winlicense", "colour": "#63A0A6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685292794, "uuid": "696992ee-b69d-4eef-b327-8eb64fc3575a", "value": "T1D9C633B285416FC3E761A57F5D23D5418C0ABE30A7032624A46F5FDA43AE49D8BF0FA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685292794, "uuid": "04627e11-fca6-4ae8-8250-5ead593251ef", "value": "f0c87ccce93eeb0966d6aac1a8c30ac2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685292794, "uuid": "ff7ad5dd-ffcb-4f67-a5f1-4f103cb9d892", "value": "196608:4zEbIZBdr3NNcOHCmYp17mU56AgHstcVUaNlrkns/X99B7s0c:4gOxyG+mHsCa6l4s/XhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685292794, "uuid": "626409a2-2b8d-4faf-81ba-44a8e3918f4d", "value": 11535536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685292794, "uuid": "ff89fa4a-a9cf-4396-a545-3af1a6b64fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685292794, "uuid": "696fa6c2-aeb7-4a0f-b04e-b313f63221d3", "value": "service.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5487c2e0-fcef-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1685234036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234036, "uuid": "4e120785-ed08-4069-9638-4e558689303a", "comment": "Malware payload (Tofsee)", "value": "2f77f1e54c07ab0c6de596e5d2f2752a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234036, "uuid": "af65bc76-0d74-40bb-b596-4f6fd657545b", "comment": "Malware payload (Tofsee)", "value": "6cbb3fe987652c86b25b99d155e18d4880bc4d542b7d1007f1f3dc85342d8403", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234036, "uuid": "f89acd76-05dd-4cb0-8eaf-7116b2c5795d", "comment": "Malware payload (Tofsee)", "value": "bca1fb0b3c0dc75674e2e890b158f4d190779517", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234036, "uuid": "9df7ae1c-7d56-4679-88b0-5198e960df75", "comment": "Malware payload (Tofsee)", "value": "3d7523ef140f1631b4047ddfcd1d559b19505b9636a36718124365edec4318cfd143a22920ba1f65689006a860b97490", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234036, "uuid": "ee7998d6-ff3b-42bf-b4f1-24cf412fb2f1", "value": "T1B6543B1397E2BD50ED669B728E3FCAEC761EF1508E19776922189A1F04702B2E173713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234036, "uuid": "223008f2-d612-4267-8ed2-f8517f0379e4", "value": "d302e4ac3406067f8ed838633897aebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234036, "uuid": "3091c80c-188c-4be9-a048-92526194e927", "value": "3072:f/qKydBOTQx6OiPuloRN4vAHHMoPd5gG+/GvA26/:3qKy6Qx6BPueRN4oMnGCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685234036, "uuid": "6bb92216-40b9-4f82-b2ef-aaebc17e0fcb", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685234036, "uuid": "ca8f9ec7-6d26-454f-8c5c-d8e6e0e137ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234036, "uuid": "8047af19-88cb-4794-ad56-c9cee3b5783c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3fbe238-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685300312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300312, "uuid": "7b6c26a0-c3cc-4521-9443-796b6d7d3a24", "comment": "Malware payload (Gafgyt)", "value": "46c64846aa0f10d24b85453031e84866", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300312, "uuid": "e4e3461f-035f-4dae-896b-6053e48c5c4c", "comment": "Malware payload (Gafgyt)", "value": "6f21020e4bb2a01a38a06308bd361bc90dab6ae4091a1efc47e2e30517e4fac5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300312, "uuid": "6b9a19f4-35fa-4656-ad6e-d64c7602f499", "comment": "Malware payload (Gafgyt)", "value": "62a160b784df21d55efa3d4b2679ce2c7a702884", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300312, "uuid": "22c599bf-37ac-409b-b051-1bcab76f056b", "comment": "Malware payload (Gafgyt)", "value": "7921325f50db233adfb52b7b2dade2d86e6feb3cd2ff223fab260080c28fb84474be82035dfdc13a3b388e018ed1d04a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300312, "uuid": "04c78c81-0303-44bb-b39b-e5536d1e0b29", "value": "T171E38366BB619EB7D80FCE7309A64501118CDD4642D93FAFB2A0E51CE76B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300312, "uuid": "cd4a6101-8b52-4a60-b035-22f4b6fd46a3", "value": "1536:bVeTpqCVvWRYx0O9vPBysZgvsgxqAz/0ufMytVOpLtaoLAImlP+s4zWfOodW:byvWmBx+sK/PflEgImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300312, "uuid": "b4aba3fb-e86f-459b-8cf5-9b7a3c637882", "value": 152201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300312, "uuid": "355bd641-ced6-4061-bf68-03b19c521128", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300312, "uuid": "16c15dc9-3810-4e4c-ac7e-6ca4454cc368", "value": "46c64846aa0f10d24b85453031e84866", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3fdae67-fd7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685294299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294299, "uuid": "070f5497-a9fc-4b67-b0dd-3a1b4f401014", "comment": "Malware payload", "value": "13f74c5fdafb6b03cb10732b2716c7cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294299, "uuid": "6a8ac6de-32d8-4a06-ad0e-82649c358441", "comment": "Malware payload", "value": "6f70b1c7e85b881fbf63dde10ee4d77ba22e2f038f600ca31d84478491e801d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294299, "uuid": "70c15377-8a70-4f85-99e3-a446846897fc", "comment": "Malware payload", "value": "bac1ffa91e85d7949a9e59f0673ac30a67d9e5cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294299, "uuid": "2111cca4-e852-4ff8-8d1c-299adc67adbe", "comment": "Malware payload", "value": "cdda2936f6ef9c41a3b0eaba6dccfeed3ae23e03fcb29af1b2aaebcb393b444a5b4809da7c56a9912f509a5a107fa2a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294299, "uuid": "3ccb0076-95f3-4b48-9d98-c503a1af6153", "value": "T1EB24B80679244F76C98682B77D632FF01785BBF01263C9E6AB4B99403962672372CF53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294299, "uuid": "a20e599c-1b9c-45d4-b407-5857fd05e62f", "value": "6144:2xfAeMeR1wcbAdetJ8ajANEVd1nz4vNmUK9hNVIIPlD:iFrAdetJ8ajAQ8vNmUK9hNVIIPlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685294299, "uuid": "c57feb81-9a2e-4b12-8371-f2c6f3627047", "value": 221042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685294299, "uuid": "84c5a4ce-f5fd-4518-938e-cbf0d6e33d65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294299, "uuid": "60b7c99f-2ff0-4fa9-bb2d-ee0d02d33e49", "value": "13f74c5fdafb6b03cb10732b2716c7cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ed8e01-fceb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685232460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685232460, "uuid": "63f06fcf-402a-4573-b399-76ec837b08ae", "comment": "Malware payload (GCleaner)", "value": "073e9528d78a9776c2e0efe05bc42cfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685232460, "uuid": "2dcd7c39-3e9b-4540-aebf-65d15933a68a", "comment": "Malware payload (GCleaner)", "value": "707b0327124d25b828dc2ac17325da53332fbd11876bfc9bd8c2552a8cfcd6a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685232460, "uuid": "fb3ab9e0-9c60-42b1-9b1b-0d46625190ec", "comment": "Malware payload (GCleaner)", "value": "5048466756842311abf0e14e4eb2a31d36d9e4a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685232460, "uuid": "a001bc0f-a5d1-488a-86e5-7ae02d6fa980", "comment": "Malware payload (GCleaner)", "value": "15c7a06e234dfeda39729e6a69da33e068f6d9528e670a9365398b27d84d3cc04a675e3c87af09672e148b951cd11486", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685232460, "uuid": "484f779f-3bc4-4170-b762-3d45167cd5da", "value": "T1DFA533329BDE44F9E4338F755D2B8922D0737523202D5928BE083FEB6A23345D46976B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685232460, "uuid": "69f52930-d0d9-4c16-8e7c-69902391ed8e", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685232460, "uuid": "f047ead5-6aef-44b8-81db-df67417cc324", "value": "49152:iiFlhf5F0qWZbMCV18LI6KWtdtWZS6dH/ws8wuC:iiFklZDjCVES6dH/r/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685232460, "uuid": "845c4a81-9f89-4d56-b3f7-6fb257c34c57", "value": 2137931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685232460, "uuid": "0a16d591-1eae-4582-ba14-cab1d33907d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685232460, "uuid": "59e7b44f-e714-40af-9eb5-9ddadb025093", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f57fb5-fd56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685278216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685278216, "uuid": "b63666d7-c156-463b-84f8-e0d99aa0f764", "comment": "Malware payload (RedLineStealer)", "value": "2d0d9f29bca70bdde306f8b5188117ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685278216, "uuid": "6594423b-7c36-4cee-98da-50abdc2b20cc", "comment": "Malware payload (RedLineStealer)", "value": "71bcea62630cac801c7e2b3ddd9fc7d6bf20490c44630a86fa8dba75f3bebc87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685278216, "uuid": "fad31e5b-1b0e-4c78-a3a6-a42761fd6ef4", "comment": "Malware payload (RedLineStealer)", "value": "a4a04353801aee05a4e90dd1ddbd395c2830ea3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685278216, "uuid": "3f969b0a-af6a-4bc5-8ae2-783fb34f7809", "comment": "Malware payload (RedLineStealer)", "value": "d964022760f3031115132d9e37cad1aab6530e5958bbd9c25feec14f1977a582c8d7e5e97302c63f181f2fd4a9123b7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685278216, "uuid": "032e4a6b-2591-48d6-b82a-b4f5e5bf451f", "value": "T138E3E628279F8930D6BB4D3D6CB19CD076BCAC126552D70A5ECCF1593A73B80EB116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685278216, "uuid": "0c3d6cee-2dfd-4a6f-bba8-7a3ed5ffc7e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685278216, "uuid": "8bcc32bb-720c-4257-b09a-429829e14ffc", "value": "3072:HV+m5cbQmRSNR0GdR2vtqrBhEZV8e8hg:HjSM3fBhE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685278216, "uuid": "3a8b063b-f32f-483c-9b6a-d41f44a7bdec", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685278216, "uuid": "2d2da528-dffa-4215-b4c4-d149a690b8cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685278216, "uuid": "6b7c1a08-eabb-4e13-b699-40485fed325e", "value": "2d0d9f29bca70bdde306f8b5188117ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8649d1d-fd67-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685285716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685285716, "uuid": "2c39eb3a-f773-4ed9-ae4b-f4c473ca8fe0", "comment": "Malware payload (RedLineStealer)", "value": "150545403b0f1b97cb88ddb53eef5fbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685285716, "uuid": "10923639-a720-48aa-83e3-6cf250c15516", "comment": "Malware payload (RedLineStealer)", "value": "7511967abce5ea0d072a7b2bafdc16faf5aa7d9f6e8280723b77369c3f7cae46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685285716, "uuid": "4469af2a-66c4-4407-b167-be717ea7f4c9", "comment": "Malware payload (RedLineStealer)", "value": "53b58bf95b94cbf4c0e4d88d026631e747526537", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685285716, "uuid": "c63d736c-077e-4978-af2c-db51817d4ddb", "comment": "Malware payload (RedLineStealer)", "value": "4ac6bfa4411a37bd48a17b03f63d6d1b49aa30001fddc7efde8858a8c775a81b914bd83eae9f27b1d8c19fbd4b945445", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685285716, "uuid": "ff51d691-eb58-4d9a-a787-c2582bb130ab", "value": "T1AE052253B6F84822ED7507B218F65A830B327CA24D31C7AB2341F85E2E726E5A531777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685285716, "uuid": "71f2f545-d9c2-4855-877a-5825de007bd4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685285716, "uuid": "ad9118a3-e63b-4943-850a-7361cfddd0f5", "value": "24576:ry3Kip8qmLlC/TAJ0ZuYkezNx4MVSyL04X:e3Km8qeYo6kezDYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685285716, "uuid": "50b1248d-eb0b-4c74-b1ea-d32dbee809c1", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685285716, "uuid": "2b9f9e3f-48a8-44c9-b106-e85542818b48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685285716, "uuid": "dd933b9d-757e-45db-bfc6-1e3a19141dd8", "value": "150545403b0f1b97cb88ddb53eef5fbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1441a2-fd63-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685284115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284115, "uuid": "adf9a0fe-646f-4207-8b44-298caf54316f", "comment": "Malware payload", "value": "376d17ff341ffe013ecb82798685bbb8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284115, "uuid": "a52b27ea-49aa-4093-b346-f1ab6759abc7", "comment": "Malware payload", "value": "759fb57724e0a94fcdde87930c245916eeab53a6544ba8f6ef76c36c7ff61820", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284115, "uuid": "e2bd8225-b74e-431a-a5e1-98353c0a89c0", "comment": "Malware payload", "value": "e9a11ee767f30376fda212ce54073de27cc4bb72", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284115, "uuid": "195eed1a-9be5-405c-8732-1dd0e23f249b", "comment": "Malware payload", "value": "9003c177b1d310f80c595e4704a7c782f7d995fb7d423ee77ec39d89234cd998dda175932508a99b79ca52d6566c88ff", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284115, "uuid": "e316f882-48b3-43ac-a33e-88555449f343", "value": "T1C285E00794049F87D11983F8BE6339982B0E7F19A6C129DB354E3F4B6F31A6659CE24C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284115, "uuid": "6cf86e0d-bb66-4132-9695-b1e55ce810b9", "value": "49152:TLKbQmmQ30UQmmQ30kDp+MXn+MX6jT5VsIC83LQ:X0pmQkUpmQkPE+E6j9C83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685284115, "uuid": "813ced71-b0fb-4f3d-b61d-6c014f8489d1", "value": 1751552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685284115, "uuid": "58f3d93b-726e-4102-b0d4-791da4e881b2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284115, "uuid": "a65bad3f-660c-4f19-937e-31058b230276", "value": "MWTT_5623773823.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c39b9fc-fd82-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685297051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297051, "uuid": "44c8a963-e51d-4bc8-acfd-31f6471745ea", "comment": "Malware payload (Mirai)", "value": "8986bf585a870ef02c1e1b5dfd7f85aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297051, "uuid": "350e31f1-b2b1-436d-aee0-bf9b27fa7772", "comment": "Malware payload (Mirai)", "value": "75aaaab71ebdedcef4dd628321595a92c7e031f20650f3af2ad3ab3660300afa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297051, "uuid": "d25c81ef-d954-4552-bf4b-2b2dd686101e", "comment": "Malware payload (Mirai)", "value": "dfeff96a5feecebab469afdde769235349225d51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297051, "uuid": "3e5d1c40-b32e-43e4-aba6-7c00905a7c49", "comment": "Malware payload (Mirai)", "value": "0d5c09292607ace143ded9abe69c837affbdf7b1615ab3c6faa61b5a0efa68d2a9aac2d8e167e3eeedf8c4ec3ac557d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297051, "uuid": "dbe338a4-5b4e-4b03-8f4c-18b2c3caff3e", "value": "T101531846B8818A12C5D417BAFD2D018D731263ECE2DEB212DD145FB477C692F0E7BA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297051, "uuid": "c6f28584-cd35-4c55-b9de-ab415c0c2690", "value": "1536:QdnO1YaLG6KBJGaOQXH7OhJOkphJPLFIsi1qTPKWiL1:5fGx7G9QXqhUkgqTPKWiL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685297051, "uuid": "1de7d31d-d17d-4297-8e8f-15bf2614813e", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685297051, "uuid": "138d555a-3652-42e9-b40e-5609ba824804", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297051, "uuid": "cfbc321e-f224-4e4a-b56d-aea21e196e09", "value": "8986bf585a870ef02c1e1b5dfd7f85aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f444eec-fd80-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685296304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296304, "uuid": "c186e472-9f44-41df-8ca9-f06ff48cf0ad", "comment": "Malware payload", "value": "d8afdfa708f3ea7bbfa5ceda10c1deeb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296304, "uuid": "7cd95ed8-9ba4-483c-b0d6-18eca7152027", "comment": "Malware payload", "value": "761e1722ff47b0745ca290d43864cbeeda9ec2ff223c7e001b592c25aa66513f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296304, "uuid": "f4ea8e86-16ee-43ac-a307-4377be35ee45", "comment": "Malware payload", "value": "1215bf56057129697b71ae5c462a1de9e85b036d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296304, "uuid": "ec61773e-a4db-4393-b84f-d590c27cdbaf", "comment": "Malware payload", "value": "ff9a94ec4c841b6d4c509c3959eebf2b940c1347433a28ac055959458c4ecd98d4cfb26f4042d10c2c0e2e4b8c785c1c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296304, "uuid": "f6845141-6bf7-46a0-bb19-9f08c2d26e64", "value": "T1B3636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568120F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296304, "uuid": "f5b9fac4-fb83-4635-9c18-eb3e9a97b079", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296304, "uuid": "04b50647-888d-44a4-a27a-0046aad60917", "value": "1536:eZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:9d5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685296304, "uuid": "4fdcc94e-980b-4eb5-81be-72ab27bfc1e9", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685296304, "uuid": "452f2704-1b5b-44af-a942-81a7d1b88351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296304, "uuid": "031610b1-4c6e-4c3b-a0af-007293bc7bb9", "value": "04335299.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af12f2de-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685299901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299901, "uuid": "cb4cb7b3-6625-40dd-8022-d6fa7863a058", "comment": "Malware payload", "value": "6370e226bfa28807c6f095899167c081", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299901, "uuid": "69dfb4b1-bcfc-4e70-95a2-25b47c9580db", "comment": "Malware payload", "value": "76d7457d922c2b35249750d375cf322550694c472374d539f8d4d038fe181a97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299901, "uuid": "c14f052a-a671-4950-a2c2-ec77b9d94ebc", "comment": "Malware payload", "value": "f0d6a26f59d32c2b504a522f9e18cced21d78dfb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299901, "uuid": "6b649632-4174-4da6-892f-6cc9c689eb6d", "comment": "Malware payload", "value": "ae3d0900f7a9a786af5afae9e43a31609debb03ee619d44df655e778159bfef4392c7836483f62d8ed0f0775152c2d67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299901, "uuid": "a4932d5b-b158-462a-a246-4bd069de7989", "value": "T177533C9AF801CE7DF85BD77B4457090AB632B3D102821B3627A7B997BC731991D23E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299901, "uuid": "54780f9a-fbf2-421a-b413-3e6b65321977", "value": "1536:K04gnXHYK+T3mg8TD6vy+DG5T7D/juN6gayX8YFe:K01nolT3mFoDsTfurX8YFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299901, "uuid": "305313c1-8a46-4065-a82f-2d9240288717", "value": 61704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299901, "uuid": "8e22215a-c400-45e8-a519-fddc952ff491", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299901, "uuid": "56047183-62bf-4201-bb99-dbd9c417cea1", "value": "6370e226bfa28807c6f095899167c081", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdeb70c4-fd81-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685297027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297027, "uuid": "f45ec77a-b43d-4221-acbf-71d3221c8d00", "comment": "Malware payload (Mirai)", "value": "647ab74653f1edd4ec19b5c062b8361e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297027, "uuid": "1ba2724f-18b2-4b82-bb08-68705d6840e7", "comment": "Malware payload (Mirai)", "value": "77cb59e07c1455a254df4365e9a9380d43f89d92ed4605f1355adca75b267a6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297027, "uuid": "0ff0adf7-479b-4e08-a27d-bd104ad23cb6", "comment": "Malware payload (Mirai)", "value": "7868aff8a5c776ce175822f985f53ae717b18863", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297027, "uuid": "1048e625-61f5-4ec9-9e8a-6b7b13d89d27", "comment": "Malware payload (Mirai)", "value": "29195e8139f00acddaf64db6804f5f80ed3770b367d870212a4feb3f8a00be2d7d1a401e88d7e62684dabfd5835d0e09", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297027, "uuid": "6f3b2612-1044-482a-9d7c-ecce05d8be60", "value": "T15743382579BA3E13C0D4A4BE16B34F15B2E0377E30A4C62EBC721F9DEB50950664B6B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297027, "uuid": "c32afdd1-2c19-4b28-b3d0-dea2b3b220fa", "value": "768:BZoDGT9zOq9yaf7luDysHqf4zB+g2J+7vlGvpO+PpBbA2y:BZ8GT9zOSyaf7luDBKf4H9gpnVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685297027, "uuid": "f841d31d-f6d2-462b-89f0-3b3b93f9fe33", "value": 58604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685297027, "uuid": "d069d12a-4018-46e0-9340-67db6ecb0f76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297027, "uuid": "6a561dc0-3566-4303-9a10-64a4f6efce65", "value": "647ab74653f1edd4ec19b5c062b8361e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ad1c9f-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685299905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299905, "uuid": "fc996282-8270-42f7-bfba-1230c0c17df8", "comment": "Malware payload", "value": "62db03caa22bfc55aadab8a1bbaabcb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299905, "uuid": "78e1a1e2-2585-44af-9a62-aee9256b4d07", "comment": "Malware payload", "value": "7c9f612c4f7cbcb63cd3f1fe6c55bed3bb77478e8b9738785affce872656612e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299905, "uuid": "2a6e2dff-63c9-4b92-829f-eecb2717ca33", "comment": "Malware payload", "value": "fcf54cfd3e95d402ff0a9f6d109a9998781b3287", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299905, "uuid": "03cbd0d3-fb6b-45e4-8220-5c4c69a384dd", "comment": "Malware payload", "value": "d712825fcac035ef6ccb1bb2755af78544b96f0bf91b0549b2bc073e7b26b3137da3c387ba3540633b2dec0a9f286f72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299905, "uuid": "6902361a-cd9c-40b5-9564-ab20b91e71b0", "value": "T1E0436BC4F643D8F5EC8705712077FB379B72E1E922A8D643D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299905, "uuid": "794b877b-c940-43f0-8e6d-aeaf8d6d0312", "value": "1536:JeESt/basV2rcZhG6+KN7TqO9lSR9zWOIaEjrqMcs:JeESt/basVTgW7TqO9QRVtXESP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299905, "uuid": "e9e4b0b2-947b-4e08-9102-2a9226caef0c", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299905, "uuid": "9a6218c5-514f-498e-b35f-4005f6f8610a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299905, "uuid": "f6cd47a3-e106-40c3-b96c-2fb59044b5d7", "value": "62db03caa22bfc55aadab8a1bbaabcb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cebf9c5-fd8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685302850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302850, "uuid": "1fd6a5ee-92aa-412a-aec8-1cae006bd738", "comment": "Malware payload (Gafgyt)", "value": "d27290ab623efcaa5d3522250b99d47e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302850, "uuid": "09e6d38d-f4c8-4d35-9ee5-22e9762f0a57", "comment": "Malware payload (Gafgyt)", "value": "7dea00d12e92552d62f4a373bd1feaa6f3ccfe0667ab1afbef09625e5594df1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302850, "uuid": "c5c9fa27-3eda-4472-9220-a2b8827479b8", "comment": "Malware payload (Gafgyt)", "value": "f91b3cc39554d0b6408fc7428de15efb05726dfc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302850, "uuid": "85335666-82e6-4b79-9446-173284e2019e", "comment": "Malware payload (Gafgyt)", "value": "5d2fa2d58118ea8bc7f859ffb796338099763c888ed8983b55b0efebf8a097932ae7fd4dad1f932b54e1a9836b015fb3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302850, "uuid": "1907cc45-2ee2-4f7b-b3ce-db5869291052", "value": "T125B328436B1C0B87C49B9AB01DA737F18B69BD7112A351C9A90BFEC04733AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302850, "uuid": "3839c50c-f63c-413a-adb2-3d6932028565", "value": "3072:WD3l+XQzPeV91310pWudAKakpNDtm2pgYMidIP1W:WD3l+XQzPe713CpWCAypxtm2pgYMidIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685302850, "uuid": "f2c69c05-dcd5-4558-9557-0446493795a6", "value": 113194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685302850, "uuid": "c5906353-dc4a-4249-acf2-b786a935c777", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302850, "uuid": "db781630-af9a-4bf4-b73b-98888f014841", "value": "d27290ab623efcaa5d3522250b99d47e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d362a5a7-fd7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685293949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293949, "uuid": "fd394e4a-0c8e-41c4-8cba-5af51c866da5", "comment": "Malware payload", "value": "814704a0b9ab78d030b188534da5be8c", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293949, "uuid": "919afc83-ba54-4ae2-9685-1ed052ec42ec", "comment": "Malware payload", "value": "7e4b5b0d5a87a4afd54fb2269d879747e960847f10a7977376033d0169f579b3", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293949, "uuid": "8970a879-917e-40c1-bea0-2e1a5f4303ee", "comment": "Malware payload", "value": "8b35cba42985b6ebd745aabba75ac112cb1053d0", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293949, "uuid": "c2d51d2e-4cb6-46bd-9f9f-be8b00c39c06", "comment": "Malware payload", "value": "ab6c6ce39e5f118e503f3de8c3b60fbc80e0646faaff64c4ac834c21cdb5bb6d7a521fd0fd79cb7306d536145b64dc3b", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293949, "uuid": "049e0e87-ed1f-427c-b117-d1d04aebe567", "value": "T111C24B46A6B801C1E6BAD93492BAFA237C34F687571182DF51D1DA320D63BC1EE3472D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293949, "uuid": "c268e9fe-3c4f-4d4c-ba46-fbe68f18a1fa", "value": "011980004222433c10e6a951c8d7683b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293949, "uuid": "ebfcc9c1-00c3-435e-995b-f5afc6db5d8c", "value": "384:3UV4OTkguJLMm1fqHtEOcUkictoPBLyYh3wEOFsWAR9zWzc:c4MmW6fdtiBLym3wEOiL9zd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685293949, "uuid": "8cc5dfbe-10fb-4ec8-b481-680b7412a5ca", "value": 27912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685293949, "uuid": "ef032552-322b-4f68-a524-e1aa1b319f0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293949, "uuid": "d8c7f5dd-7052-4f77-99bb-5b85feb66a92", "value": "AccPtFlt.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89ee0c2-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685300373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300373, "uuid": "e627be3c-d9b9-4c67-964e-debf744ff226", "comment": "Malware payload (Mirai)", "value": "9fdd99ed366c191b4d02910397c945b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300373, "uuid": "bcd77b64-4610-44f1-b6b6-34ecd62736ca", "comment": "Malware payload (Mirai)", "value": "7e583ccf3f29ef5d6bfb353b2615ea6768f02527ed8fcf9f248b33ac8f668d49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300373, "uuid": "80c48dfa-ae45-4afb-8e65-3c3df888b53f", "comment": "Malware payload (Mirai)", "value": "78d8375bca48f46c51cc3116bb2d533e4389a007", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300373, "uuid": "6b68f550-2d36-4661-a9f9-dd27edaade64", "comment": "Malware payload (Mirai)", "value": "7828256ccfed713aa99556a617e9b4e0a41d45054b5b8a4e99839aba4e0e346e779e88ed192e871822d40772330b2b56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300373, "uuid": "50b42daa-0306-4652-8b51-23d132411af0", "value": "T1BCD32A56E7408B13C4D61775B6EF42453323ABA4A3DB73069928AFF43F8279B0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300373, "uuid": "d4fc0093-1458-4466-b87a-d9d72d951802", "value": "3072:lS6VGvE5uazAFEsHYw3NK8YwxGnxp+SQkM/9CH:lS6VHuazAFEs4iNNgnxp+SDM/9CH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300373, "uuid": "d8013a56-0321-4654-9e34-de87dab9d214", "value": 140758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300373, "uuid": "21733aa1-0a9d-4b67-b730-fad33cc98c87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300373, "uuid": "8c0a01d5-5b72-4f84-9d79-26ab1a3226f7", "value": "9fdd99ed366c191b4d02910397c945b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c0a1591-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685300272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300272, "uuid": "b0a05e3d-1fa4-4b97-9eec-65eede64cfb1", "comment": "Malware payload", "value": "b283143a1eb6e91558c3dd3bef57768d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300272, "uuid": "4da2cb4c-5189-4433-9c13-e988893753ca", "comment": "Malware payload", "value": "7f23813b95437282ffa1b6afa5cc89ba66becfc4a4127d8fdc08f7132b98d171", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300272, "uuid": "e86b9868-c32b-49e1-85e6-a34f030bb422", "comment": "Malware payload", "value": "d26ac3b5f5bbe886dfbe39735e75a4307c889592", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300272, "uuid": "4b40de2c-8907-4aa2-97f3-9f3868d92f43", "comment": "Malware payload", "value": "6bbffa758795349f999dddce786c70ffe6dce3a36482202dad5d96043645237bf510829e690abbaab69af2512e9f17fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300272, "uuid": "50edd32e-4c44-4de2-83eb-d33e1c1bcb1b", "value": "T125633A21B9761E17C0C1987A21F74B25B2F147CE26E8CA0A3E720D9EFF719806553AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300272, "uuid": "c071e737-d22a-43e1-8786-3221c343525c", "value": "1536:JCuILrehr9AaFkx9mSjNdYQnvK75opKtzxtsQ:XjiDR1vKV7xaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300272, "uuid": "2b373805-8c06-4533-9637-cfb72c3489fa", "value": 71768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300272, "uuid": "b2cfff85-8210-4268-9e29-ed4e21639e6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300272, "uuid": "3613d522-1975-4265-bd2a-b46da60059ab", "value": "b283143a1eb6e91558c3dd3bef57768d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ad0848-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685299858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299858, "uuid": "a5dbce97-8335-4fc2-a3ae-2d5ecd6dfd27", "comment": "Malware payload (Mirai)", "value": "3eeea565ae0cf7d0f44573357ed82db7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299858, "uuid": "d110f9d0-0a46-482a-a414-6ac4f54175b6", "comment": "Malware payload (Mirai)", "value": "7f6046ca79d3259c0f1fc9f960c01ae1c22005bdbc86a8d4ab5d6dc213b16988", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299858, "uuid": "ef93d47f-3603-46b7-af24-c7eec1b4fc97", "comment": "Malware payload (Mirai)", "value": "667a16c6dea71e2761c6b3c3f964f5d9425c6cee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299858, "uuid": "bf41764d-7604-4b87-b0d4-4bf5f6fc2a63", "comment": "Malware payload (Mirai)", "value": "744970b13f57701b240bd862b8eec746effe2c6c40462eec8195097f5318d06dee93bebb22f3a8391cf1f784ca00bb51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299858, "uuid": "55ce7168-5f92-4199-84ee-78e8aae57273", "value": "T18623E952BC819A27C2E0237AB67E5A8D332077E9D2CF721BDC211B607A8551F0D63F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299858, "uuid": "eb42c6e8-86dc-4185-964d-352ea508ba46", "value": "768:XgfmUMOHbXCnK/aChEwKymI9ErHrM9O1BYdla3tP5JHbueiFamLQxoFQ/N+wWrR:XjUtbSnKdhERNMWwla97HbD+fQrJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299858, "uuid": "01b05c71-f0c9-47cc-9690-596198bc694c", "value": 46324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299858, "uuid": "f42d0dbd-e23b-4119-801b-42817c414218", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299858, "uuid": "0ae7b8ea-4fea-4098-a342-b35745591a4d", "value": "3eeea565ae0cf7d0f44573357ed82db7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc29bbde-fda8-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685313667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685313667, "uuid": "938e3058-923f-4fda-9362-ba4d996bc536", "comment": "Malware payload", "value": "e9eeaf828f5f78576359d41a8906cc87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685313667, "uuid": "6f0b33bd-6c1d-4902-b59b-6d0596978307", "comment": "Malware payload", "value": "7fda535e57d4fb87f4bfb17ed6305f1c9992c0c44341729a5b19c0eafb7e48d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685313667, "uuid": "d6fae44e-2482-49f3-a19f-72951d9bdfa5", "comment": "Malware payload", "value": "c2aaa842e934c37abf7acb5773153a2b4fc11676", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685313667, "uuid": "60b2524d-e78e-4875-9f2d-544d7c03ba61", "comment": "Malware payload", "value": "9670517d34d138111294f98abafd6b3684a7a67263f7e0fb9568bfb8f320337712cc4effd347f3f762ff607285720312", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685313667, "uuid": "3428a06d-af60-4685-9c0d-ec960f8e8e23", "value": "T185540B1392E13D50E5668B729E2FD7F87A1EF9508F5A77A91218AE1F04B03B2C173711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685313667, "uuid": "cd766d40-52b1-4bd9-a372-a7fe374ab216", "value": "8e382607a3e33198b48c3f30434124bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685313667, "uuid": "c101386a-36c4-4d2d-9b3c-54cea09cea1e", "value": "3072:DQIY6FnuBRFdwxI5T+2NzkfNGWRDrr44tcqH5ZBpwilh9nQ:8IY6gR8IZdtuD443oiD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685313667, "uuid": "6998736e-4758-461c-a482-295d5d8f7703", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685313667, "uuid": "6cbf4b0f-3986-46b1-86fc-d6b4047cfd15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685313667, "uuid": "1934e9b0-129b-454c-a0dd-71769927383f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c680de-fd4b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685273659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685273659, "uuid": "6e16a2ed-87da-4f1f-8a4c-77f1bb8d6313", "comment": "Malware payload (RedLineStealer)", "value": "3694c18f01430f213aced163c75788a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685273659, "uuid": "a5c4ab24-6766-48d2-b4cc-9813834f6262", "comment": "Malware payload (RedLineStealer)", "value": "7fdba125f3d682ea8b84cdc805f574789ebc8aecca3c5e20d20c8a8cd22e2bdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685273659, "uuid": "669caa0d-49bb-46bc-b988-63d8283f6d40", "comment": "Malware payload (RedLineStealer)", "value": "25a1c807d62f211e6adb38ed07e96e6bd309f8b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685273659, "uuid": "02823d56-7e5e-484f-9d90-b62f3487b44e", "comment": "Malware payload (RedLineStealer)", "value": "60e921eac8bbc035e2de53aa2ed2493be2cfd82a3abeabf2327e97ecf950d055336adf52d61c8443fcb66531ce393bda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685273659, "uuid": "147efe78-9aab-4bca-836b-cc3ab60d58dd", "value": "T10374E1113248C13AF4AB347189E9DA79A6B9B5701B6F60DBFBC41A6D4F313D17A3021B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685273659, "uuid": "12df4def-0e86-41df-9f63-92cc11b52110", "value": "ccf3d145fef27c23a1356d2673054011", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685273659, "uuid": "d53c3774-eede-4c7c-a7ab-6b8b5ed5503b", "value": "6144:yBmM2uzmMmVvV2KtLMMeWj286qoOEStQZ4lol3+uOD:KlzmRRYKtLMMx96NOESlK4zD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685273659, "uuid": "6647c3cb-7358-44c0-941b-1c0fd7431f96", "value": 359160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685273659, "uuid": "057ea78a-175d-465d-aa2e-6521248f07a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685273659, "uuid": "b69d7778-10ec-47da-be60-8f2e7322caa5", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0411ce2b-fd82-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685297037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297037, "uuid": "c0f84044-42e2-4d2b-a2b8-8f553c636694", "comment": "Malware payload (Mirai)", "value": "c7e8f912da3cace9e5fd37e8b0cd8c57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297037, "uuid": "dddb9537-a500-4d48-a849-dd3d230d2256", "comment": "Malware payload (Mirai)", "value": "80202fb8c9bf8793002a62f96b0c969926cc3f1788793fa27f0af3e3143f9406", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297037, "uuid": "0370a235-113d-41c6-8823-3119f837a442", "comment": "Malware payload (Mirai)", "value": "f6f18112d450376543d5ead913468032adcb05a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297037, "uuid": "3e21a4ed-2ca7-4c10-bea1-6ed1fd9d3e96", "comment": "Malware payload (Mirai)", "value": "88f76e0076c911dec995cc09dde7e821f9be3bfb687a0c3f1c9dcb137fe24c4f3d1656f6177e727d950d4ba37da5aed7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297037, "uuid": "01dea358-0518-4914-ae7e-87b25b63a0c8", "value": "T108331A9AA800BD2CFD5AE6FA81160F1CF5307B2410634737A6A6FC979D723A45D1EF81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297037, "uuid": "e5c24d12-869a-4efc-a794-bb6d59f3ef1b", "value": "768:jreOjp9lwpL8a2pPvk6/fo6JOw4ZR8p/u5WeMEvpaqMJT6Na4H86fS:XNjpspQ1G6p4Z+p25ptaqMJmNaG82S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685297037, "uuid": "66129338-8891-45cf-a9b2-a0e9ddeaa955", "value": 54632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685297037, "uuid": "73011fa6-5316-46d2-b4ae-aecb7f96c33a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297037, "uuid": "fc2393d0-671e-486a-baa5-13210a45651c", "value": "c7e8f912da3cace9e5fd37e8b0cd8c57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a944e8e5-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685300321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300321, "uuid": "6523cbab-fa18-43ff-bc72-e21be5b8ed40", "comment": "Malware payload", "value": "da791b566633cf4baea906c4adbb0203", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300321, "uuid": "d8c045a8-851b-42d8-80b5-9d15e5bb125f", "comment": "Malware payload", "value": "8162bb8e0f5c213910fc1b05f0a5ce2fc1779284d2659ce22689cbbc28fb676b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300321, "uuid": "c848e2f7-5d78-4f1e-b1dd-02637283a8d3", "comment": "Malware payload", "value": "67e9409054647a1b830e874d7450ec72d512464e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300321, "uuid": "50c877ca-a70d-4c22-a675-a86410587683", "comment": "Malware payload", "value": "ebd9cc6332114a85ba2c4f10e601bfe8ad207b7be1bb593727fb45382abbf018b0ec8650171150ee75932efb85dcefb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300321, "uuid": "eefd0916-d8fc-4d24-bd66-0a079816b99c", "value": "T11E434A02B31C0E47C0A31A70263F5BD097BEEAD022E4F689711E979A9671E375586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300321, "uuid": "35e9b74f-08a3-43cc-8a32-852d79ec9b1e", "value": "768:EbpJYxjEJf68CRZGRloQUEqde5POkdUUF9umfSmi1j5GMI4gJGcFRxtafS+wnVIK:q/mqzqQPJ2GuSfi+MI4gcAxgfGnV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300321, "uuid": "8ddee300-8003-4135-9b02-094b6e96b166", "value": 55160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300321, "uuid": "a72b455d-3a6e-4fad-94c9-50825595d4aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300321, "uuid": "a049015e-87ef-4c9f-ba49-472cb2a1f7a3", "value": "da791b566633cf4baea906c4adbb0203", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0369a859-fd77-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685292311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685292311, "uuid": "cc031a84-699f-4833-bf8a-16af26d050aa", "comment": "Malware payload (Mirai)", "value": "e992994b96b0bc723bfd8fa26c196a6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685292311, "uuid": "168bcbc9-1539-4914-a826-6eaf48ad8145", "comment": "Malware payload (Mirai)", "value": "818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685292311, "uuid": "6e385a3c-7de1-41d7-b94e-e390ff6e66ef", "comment": "Malware payload (Mirai)", "value": "2a90eb2727d9706afa67dda1d0f3070cefc99751", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685292311, "uuid": "f3c9e6d4-c93d-482c-ab1c-ac6fdbdcc3b6", "comment": "Malware payload (Mirai)", "value": "404c8bd104237e54c465e3a08ade9be5c902fa8b8d19d4829a33e8345aa1f4e5f4d44fc8eb2fabd38c44293629607ebc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685292311, "uuid": "b2115d1d-f1c3-4f4b-960d-fad41b111a9d", "value": "T12B732A0779C4C9FCC088D13446AB7576C422F43D127AB69B23C5BF262C4EE605EAE95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685292311, "uuid": "787ac3da-b4b2-48da-8cc0-b5cd7185d784", "value": "1536:O4gW3OzxXhczl/CsLdezHPx0BTjEKlrr8hMbS321:O493OdXWzl/C/zHPx0B8Klrr8a71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685292311, "uuid": "1df85cca-00a0-4290-8cef-1e5f8fb4e3ac", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685292311, "uuid": "1ffa3975-58c9-45d3-ba81-62ddbc56ef46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685292311, "uuid": "cc0cb033-9032-4687-93ae-350a8e267f46", "value": "cutie.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acaf144a-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685300326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300326, "uuid": "e51c6406-4dbc-4826-9bfb-37649ef0276c", "comment": "Malware payload (Gafgyt)", "value": "feea65d8a46e3d82771367d76bc8f716", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300326, "uuid": "bcb9b679-9040-4970-9ae3-15dad1376a96", "comment": "Malware payload (Gafgyt)", "value": "824ade649ee7d728639d8cdf4924da22a00b61c425d9262ca24a09225f706c44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300326, "uuid": "c707b3ed-d42d-4809-80ac-b6a8d4c1f943", "comment": "Malware payload (Gafgyt)", "value": "7f81145ea078db16882f5ac29d5051490a362ca2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300326, "uuid": "99848fe0-ef41-4a94-8c4f-a8ae59845e61", "comment": "Malware payload (Gafgyt)", "value": "ab55cc0d37fcc3f7768c4122d8e0c6ec44a4b589eb4fff351cc840d8bee4832539f92e9f1d0269a6603d30baf8ffe2f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300326, "uuid": "f791706f-a52a-407f-9400-6fa41ebeed85", "value": "T1CBB33B4795A89EB3C086BAB525EB59300722ED120F2F1A9621387BF4437F5CD741EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300326, "uuid": "5d69f2bf-4e29-4a82-889f-93bfbd960f3f", "value": "1536:Aq/W65rWXAiP5dfK4EBbkb25lyDQnAjC7B5+TjgkHmmycgYVLu1IPYC:R/vp+9C4xb2MjE0j/HmDcgYVy1IPYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300326, "uuid": "3fb4347f-4daf-4802-bca3-f95dcf6422bb", "value": 108486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300326, "uuid": "4c083d43-99f8-437b-b124-f23297221736", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300326, "uuid": "d119d9a7-562b-4314-bc35-086f4adec75c", "value": "feea65d8a46e3d82771367d76bc8f716", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be7085ea-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685300356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300356, "uuid": "e64eb3fd-70ca-489a-93a7-d9d49f1e07f4", "comment": "Malware payload", "value": "1a4498412e6f0158883462566d1a95bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300356, "uuid": "c545d247-5126-4580-9dc7-ebd02d0890a7", "comment": "Malware payload", "value": "8304b3da4db4300b8374b82ee0f43d32b4241df69fce390cda877f25123ffc1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300356, "uuid": "54607c54-863a-43ab-a384-0813247ac387", "comment": "Malware payload", "value": "8ea1253f6ab4ca8d5270b064cfb083be16a75ba6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300356, "uuid": "dd7e3d5f-c9a6-42f3-abc4-97db865cafd5", "comment": "Malware payload", "value": "acbe9e035932023e8d39b3129588431d66c45ae77a7d17f5a0695d7d7c5d1c517d73af26d2f6f1f7f0c0b6abf837c980", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300356, "uuid": "ecce8f19-e0d9-43c8-a9bd-8d3fb07e2af4", "value": "T18A337B77E46A5E84C086857075249F351F23F1C893932EBB16EAC2B95483DACF509FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300356, "uuid": "47b3e3fb-e57a-41c5-be43-0c0b15d1f382", "value": "1536:oaini/krGATCWDMKwlGWE81CCVghNnFLT:oVniaGA1Twe81ChNnFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300356, "uuid": "89a0e35e-41c1-40df-b0f7-9651cbe059e1", "value": 50580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300356, "uuid": "b2aa2bf4-8c98-475c-8c1b-42718ecdd87c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300356, "uuid": "0ffe21e5-b9ef-4cee-9840-d761a2bae09b", "value": "1a4498412e6f0158883462566d1a95bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f086fbf7-fcea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685232150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685232150, "uuid": "e5c83c5c-39c5-4577-b593-0d8617cb5de5", "comment": "Malware payload (RedLineStealer)", "value": "8a5a374784b0c255fcbcd8c5ddc580df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685232150, "uuid": "3d019605-20f2-4eb3-baae-ad19022c9a54", "comment": "Malware payload (RedLineStealer)", "value": "830fc1e7d9d94d0f39954ee49c4e20564e52c1d8920f57694a5810da868e9e05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685232150, "uuid": "288c1126-4bad-44f5-90df-f871921ea617", "comment": "Malware payload (RedLineStealer)", "value": "bda3999a4912dfb9607af896305c15e47139281e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685232150, "uuid": "08c52ed7-d351-49b0-aa27-2653e0a601ab", "comment": "Malware payload (RedLineStealer)", "value": "9ee5466693a2975628d2841997a5a9bbf9c00192cf6de33ccf2c284cf9366ca39ad7690c1c4ac8270142e3640267cf98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685232150, "uuid": "1c27befe-f79c-4240-9e30-440ed342e1c5", "value": "T13664D020764CC07AE55724718AE9CE76AAB9B831171F64D7FBC05A6D1F323D2AB34306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685232150, "uuid": "544b6de5-95b9-4987-a4e4-7886b754dcd0", "value": "85900470d04da9b14c3b0900f7ae6bb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685232150, "uuid": "c00eff6a-23b5-4189-a017-1903fb84f3ef", "value": "6144:d/1OiR0J9Vv/3VQL41cWYT5M+a57EOD8IE+3l7v0PMD:JtR0J9RtQL41B/r5AOfE+3ZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685232150, "uuid": "6f3b890a-15f7-4c02-b034-0e9010032c56", "value": 319224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685232150, "uuid": "5dde2193-0ebd-49eb-a787-e739141a2b76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685232150, "uuid": "c4cdf13c-7d51-4123-bf41-60a495c87064", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9060c8e2-fd8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685302856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302856, "uuid": "aa65d95b-22ee-4b2e-aafd-e5f2b83455e0", "comment": "Malware payload (RedLineStealer)", "value": "6be3c3dba55c1ad380c5d297e6935c57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302856, "uuid": "3dbfe080-1dcd-4b2e-aa6d-904427bf1d1a", "comment": "Malware payload (RedLineStealer)", "value": "835c06d3710a51048d4911a2f312704e654701c12174a3337ab4ab27de8aa46a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302856, "uuid": "d44ba717-e96b-4dc1-95ba-49712b4f96dc", "comment": "Malware payload (RedLineStealer)", "value": "4ced69c99a1cd3dcf7ff3e28d52a13f679b21c6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302856, "uuid": "bce5137f-9c59-452f-94e1-cbbacc262dac", "comment": "Malware payload (RedLineStealer)", "value": "c09b0043d85e4da3b419af91f1ae7a7e5f1cb06234348af58379b44f496e2f8b27a8da30aa8ff5f533d4491810f66abb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302856, "uuid": "7d2d2fa2-947e-4dc2-a274-0622e9d2df05", "value": "T17E744B5392E13D54F9664B729E2FC7F8BA1EF2108E5977E522189E2F04B13B2C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302856, "uuid": "018f7a72-c588-4d00-bcf2-d2f1b12361a6", "value": "96475f7ea3cc105ae1bb971e987af868", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302856, "uuid": "50d67292-ddf4-4bfd-bd18-644da4cb08e7", "value": "3072:lzmcikxATwMO4PcBi0dUD8DocGjEHobRoYJcduh9xUYvNOfC+l2Xb085Txw3Q:ZnxDp80d1Doko1ogbNORyhug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685302856, "uuid": "388eeb3d-db84-49fe-ba24-a592878012b0", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685302856, "uuid": "0c74aac3-e213-4385-8a8e-5ff62bfda9e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302856, "uuid": "9dce9c68-83e1-49b0-859c-50f57d580c71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74f044b-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685299888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299888, "uuid": "5ee28c04-745a-4514-8656-c96ac7616507", "comment": "Malware payload", "value": "d41c601ba360e23a7ca6b8cf741963da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299888, "uuid": "24063687-6db1-4c59-83fe-38b60b140ea5", "comment": "Malware payload", "value": "84e893a49cbdf74fcdaa7ad1ca686e3a4d223fc068faf7347ff86bab9ffa1d0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299888, "uuid": "a24d00dc-882f-4958-9b91-7f9811c4c3aa", "comment": "Malware payload", "value": "febb24a69ce586ddceb526751978657d3e2560d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299888, "uuid": "12de4fe9-7e78-48d8-8139-a92b6317e09f", "comment": "Malware payload", "value": "d6e02ccfc3a210acd1ee0377658052784abbc0c5d89b8f6e8ce03daf01aeec1c773a687dc1c83d802f265ff9626cb5af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299888, "uuid": "eb930f72-c6d6-4b1b-81e9-b0bc3e671a92", "value": "T119632BDAF801DD7DF81BD77A4453090AB530B3D542831B3B6397B9A7BC721A81D12E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299888, "uuid": "cb3966ff-e8f0-4770-a991-4320c1eb9556", "value": "1536:fAgVFBxENs8DYrly8VhyCO1sxyWbxdJiLU11i+VQMK:fAQFBONJErlWCO1GySx/o+VBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299888, "uuid": "c31c5f10-ba44-47e6-a25e-affe5a3371c7", "value": 69636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299888, "uuid": "36ced25f-d59e-435e-8805-869b01b3e82b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299888, "uuid": "37feecbd-85fc-4c99-91fb-0dc8a4d037d9", "value": "d41c601ba360e23a7ca6b8cf741963da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938c0454-fd8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685302861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302861, "uuid": "10777ea9-a3aa-45a6-b606-8754a0588e28", "comment": "Malware payload (Gafgyt)", "value": "6b25b9988c61f39f6f8c5bb1fdfb9236", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302861, "uuid": "3d0032d7-209e-4eac-866d-191763718755", "comment": "Malware payload (Gafgyt)", "value": "862eb66b2f4aa0ca6751c77572d433aa7044ce9465e4c2dc4794d0a80ba8214d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302861, "uuid": "1d3dfea1-a90d-4ce9-b87a-e62bb04852f2", "comment": "Malware payload (Gafgyt)", "value": "710fd65dc02fa391299164387a5bd6b7491068ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302861, "uuid": "9b444708-1118-4743-958d-5daa733dcd8c", "comment": "Malware payload (Gafgyt)", "value": "e8418aad56a6484b671f10fa1cc0d3517cedd5417c2b6238f55b7001ff08313435c3bd15f39ad2074aad28b6459fcde7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302861, "uuid": "eb3b898f-52aa-4078-b8c2-09cf876ef790", "value": "T124C3093B7B270A23C0D9507102E31332B9B9DE5938BA43D7A9D07D9C6F3A58834567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302861, "uuid": "029a1cc2-6806-4efb-8433-40bcac687279", "value": "1536:ctrv5GE2dFg8aI0DN95P8tf7PJtAgRdc0sfm7ypwYujl3IdnuW:ZP0DNPAJ5sfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685302861, "uuid": "b098cd9c-9c66-4884-b434-03edf4cbd324", "value": 126446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685302861, "uuid": "02942a19-c14b-4f2a-8267-dd969735e00d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302861, "uuid": "c749df1b-7676-463c-90f8-44928205805c", "value": "6b25b9988c61f39f6f8c5bb1fdfb9236", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d266804-fd7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685294260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294260, "uuid": "7756fef1-bda8-43de-ae06-80734e237456", "comment": "Malware payload (Mirai)", "value": "0d6dd09b7228e54718b024dd86a39369", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294260, "uuid": "347e5b6f-fe41-4c5f-a034-4345c014c7d8", "comment": "Malware payload (Mirai)", "value": "86b39b8b74d083decafb6180e9f82536f22f6eda98fe943891cf92c9e4e23dc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294260, "uuid": "31423b66-7aa0-4e47-bc19-5be9046a5c5c", "comment": "Malware payload (Mirai)", "value": "04465fe43fb205738261cdeaf3c704fb9e3050dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294260, "uuid": "2efbf9dc-8871-45bb-b486-d5f7b3b03ebf", "comment": "Malware payload (Mirai)", "value": "6936e4cc21d6460f0f0ec130228c107344e3b0f0d4e153ca36451acf52d4b7c63b97e0f25706d5a18b5f402a91bb7093", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294260, "uuid": "c62bbb40-10fb-44fe-a3b7-181aa1952cf2", "value": "T10E834B21BD792A27C5D4B03B21F78225F6E6670E25B4C61EBC720F8EBF2564035076B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294260, "uuid": "70d1322f-aac4-4a92-a65c-40fe380bc25f", "value": "1536:zg/vj1dVSAkleTXAflIQNVMe9uNAHXha9Ht4TPGCM51tLc32:zCjE4UdVMe9uNMXY9Hm8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685294260, "uuid": "0cb5c6d1-4a7e-43c9-935b-6a594a326d15", "value": 83264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685294260, "uuid": "de37330c-59c8-4677-9a76-54fb8d7496af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294260, "uuid": "16401b87-e3de-464b-a7d9-a98a8cddab34", "value": "0d6dd09b7228e54718b024dd86a39369", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce15b54-fcf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685237110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685237110, "uuid": "74500936-386e-45ab-956a-57718fa4a030", "comment": "Malware payload", "value": "63d2ab075242a38f5c6240cb7eafbd35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685237110, "uuid": "61e3aab5-0cb8-424d-9e26-f8d8080fe388", "comment": "Malware payload", "value": "87513157828305d4d09ff58df2a39eb9e2bdcaa72bd01f11bb86dc56dc164fb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685237110, "uuid": "f77c15bd-bc2b-409d-a778-3d65e4dddddb", "comment": "Malware payload", "value": "36621dbe302900010d8dc1916f0fa022885d4d59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685237110, "uuid": "25f5090e-689c-409f-8061-0a699c67612e", "comment": "Malware payload", "value": "e9b5fce6c5fef0159a10835ef79fdbb6a61dd79b551b2daf8163305a7d15d5751d17b274591c396d5ca633b3a0761e25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685237110, "uuid": "021c80ea-d2e0-4319-ab7f-917aa1ab6bb0", "value": "T198D401207244C133F4A7247548FA9AB996B9BC74176F22E7FBC4066C8B257E17A3530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685237110, "uuid": "da3b9d69-ed2a-4b10-9212-6d805db0f456", "value": "f785b0c64982fe4ad638456ea1aec30d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685237110, "uuid": "fb637513-5dd8-4180-ac1f-635f3fa7c908", "value": "12288:vV38R0oK/pYZ5ptdxOSGd4+A9UfzAddKwlyrq+tZ5mX6h:vV38R0c5HCSGd4+iUfzKsLT5mKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685237110, "uuid": "107d7b0f-76bf-45fb-a664-db957edb9e50", "value": 638244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685237110, "uuid": "3e0d6273-232d-475a-837d-fe8d49e6278d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685237110, "uuid": "f6306583-199a-4da4-ad3a-894740df9fc8", "value": "63d2ab075242a38f5c6240cb7eafbd35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "954d5327-fd7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685294274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294274, "uuid": "84e5f186-a2fa-4836-b43e-e34522c1dacc", "comment": "Malware payload", "value": "c7ff921059df74656ad8eaf18cb7f16b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294274, "uuid": "6f12d6c9-b716-415e-a41e-549d179e2fc2", "comment": "Malware payload", "value": "8879f1d0fd8dc0ae0e32da8b99a7a33741aefaecc5eee6ddd39bccce6163ebe8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294274, "uuid": "0f76ebf2-b2b8-4fb4-99e9-6f433edf13a5", "comment": "Malware payload", "value": "d91d9715b89c8f54ba5e3fbe36ebce8c7c3565f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294274, "uuid": "f25d3ef3-ae23-4a24-81c3-9e0e6de9df80", "comment": "Malware payload", "value": "64b80ac824499da8fb6dbdeca754a9a91e828818c93729eaadcb0a90dc4613d4d51e3c8e78f8fd9167236448cdcffa71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294274, "uuid": "c29d1478-fda5-4da4-9c35-085f4af7969e", "value": "T1F724D642B420DEB9E949B337B15309742121FEE11673D2F6BB9B7D917CA53803B39A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294274, "uuid": "e63b3752-8b48-4425-879b-a7e0d0336952", "value": "6144:Y5p1+B1ycAPQ8e+DGRZgqetUX+k1amJK9hNyyIPdD:Y5peCDGRZgqeS+k8mJK9hNyyIPdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685294274, "uuid": "b2d4dedd-9af4-48ef-a15a-d6e52a18a6c3", "value": 218157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685294274, "uuid": "e49cfb98-e4b0-46f5-9506-73a008b94d50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294274, "uuid": "bf22d945-2f0f-4425-ab76-ce4952e696a0", "value": "c7ff921059df74656ad8eaf18cb7f16b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8c0d53-fd03-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685242617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685242617, "uuid": "1278453e-0eff-4a37-8d53-9b83bdd943d8", "comment": "Malware payload (Mirai)", "value": "8f8ee6295cae637b502d0973160f76ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685242617, "uuid": "037e3923-a8bd-463c-bdee-5cc9eb0bbaa7", "comment": "Malware payload (Mirai)", "value": "8a06f154cdae176c91cac159e2483b5d1bd75327a96e6c1412eec728afd351c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685242617, "uuid": "33bc6e54-17c8-420a-b708-432512271dde", "comment": "Malware payload (Mirai)", "value": "bf803da6ddaa94b26cb198050772e863374ca493", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685242617, "uuid": "4c1e4158-6c1e-44bf-ae07-d5c33f350a01", "comment": "Malware payload (Mirai)", "value": "715b7250102413837840cd64f3d216a7f9f3ee2e65fc090f093ba67ad42a79d56b9b48d7b8e0d42d4f9445448b6b022b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685242617, "uuid": "7f90b7bb-16b1-4028-ae42-a24c3871e388", "value": "T14EF3A41A77618FB7E81EDE33069A4602108CE55A02E97F6FB6B4C55CE78B94F08E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685242617, "uuid": "fc6e92cd-4d7d-45ce-a767-bfb46d03b328", "value": "3072:v1ILG+3o2k4YMx5hKAD7EznHURxuZF+1uWNd5R:v1ILG+lkLMx5hKADoURxuZF+1uWNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685242617, "uuid": "7616b7fb-2898-4561-8974-ded95f35fce2", "value": 158692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685242617, "uuid": "1b4fa590-a741-4333-b939-73fe88cdb514", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685242617, "uuid": "f73025d5-657c-46a5-9d35-925aa1b4bbc6", "value": "8f8ee6295cae637b502d0973160f76ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25fe724b-fd28-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685258439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258439, "uuid": "696a427e-0ee0-41dc-927a-d38c1895ac3d", "comment": "Malware payload (GCleaner)", "value": "db73d01714612784385aafa04c3d09fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258439, "uuid": "0435fd6a-05ec-4552-acef-db7b329567bc", "comment": "Malware payload (GCleaner)", "value": "8af287653c37de588ac68fe37f30c0564b03983a7d1ea2657d4e8ef82ad962eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258439, "uuid": "8f949ca2-988e-4b29-8c8a-d68247750304", "comment": "Malware payload (GCleaner)", "value": "2696697ae7f61044eb911bb0fe461cc6eea21aa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258439, "uuid": "ffe06d3e-3eef-4c7f-9bb3-90998fe29261", "comment": "Malware payload (GCleaner)", "value": "8b9de8a669e7664e04b330c289aebeb1d07ffccbff9294a2bad6004b0ae3bc28e58594d1ba8ec66d68a02582471e540d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258439, "uuid": "5211f709-062c-4a6c-a05b-7f08be464e13", "value": "T12C747D53D6E2BC54ED695B728E2FCAEC765EF1108E19776922289A2F04702B3C173713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258439, "uuid": "dff2a3d6-4f7a-4e94-af96-a8d2ce3de62e", "value": "d302e4ac3406067f8ed838633897aebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258439, "uuid": "9f5f14a0-36e7-42c7-9a13-7e4eb3d08970", "value": "6144:Q+g0e9K8l6RrTQsWCfBz38LrSM0ldFpnpG1:QL0x8UXQsWABz3DL1s1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685258439, "uuid": "13360cae-7310-4990-ba32-57c0b2e281c5", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685258439, "uuid": "694038c7-3265-4f3f-a81a-b9c9aab150c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258439, "uuid": "976605c7-adf1-412f-8908-89a5b985751b", "value": "db73d01714612784385aafa04c3d09fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67a4682-fd63-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685284076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284076, "uuid": "c2c95036-1ac3-4427-92e1-18574736d9ac", "comment": "Malware payload (GCleaner)", "value": "9162a407d6c083d340df9ca6f0bca1bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284076, "uuid": "8efd15ed-0f2a-4dd0-b2d7-83a885a8091d", "comment": "Malware payload (GCleaner)", "value": "8c52b7aff318185c82a7c08e6f662d9fe223b016d1c01b16b92c2f83fc712fb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284076, "uuid": "8f831422-4f39-4c18-836e-8fe7e335e3e3", "comment": "Malware payload (GCleaner)", "value": "3e772e7c73468d23f441a84bc0900d900465e510", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284076, "uuid": "07a1d8de-a89c-418c-b38d-ce4101c66dbf", "comment": "Malware payload (GCleaner)", "value": "7f19394f1289ecba1e36716a6bb70e2ec564645b24489efd6ef77822f33a7e27aad0a49be50f57f091cffc6ff37ed83f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284076, "uuid": "e4c45d64-fdf6-4b43-a7e0-9a2d9a1a589c", "value": "T1E6746D5392E13D54E9655A72CE2FC7F87B5EF6208E593BA912289E1F04B13B2C273701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284076, "uuid": "810e7046-0e20-4917-812a-fa152886d444", "value": "937554e81340ac479b370382e43a74d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284076, "uuid": "899d2769-6027-4f37-9cbd-53a1c73d8e70", "value": "6144:YAEIPC75oori0wYGn8y5PjdUEPCjtDSkB3dk61oPj:YpiGXi0m8ythnCjJh3dEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685284076, "uuid": "3fb07662-e588-45d6-a692-066b516196a9", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685284076, "uuid": "d0b0f983-8191-4425-89f3-69d557c72fa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284076, "uuid": "548c15a6-4eb2-4dc3-9c43-a2e0128b3a5d", "value": "9162a407d6c083d340df9ca6f0bca1bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debb1589-fd75-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685291820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685291820, "uuid": "36e86223-07bd-40c2-af0a-aabd57d23823", "comment": "Malware payload (RedLineStealer)", "value": "bd7dd4b9d81c6ae9ce4b963975963d11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685291820, "uuid": "0afa6fc2-1204-4dfb-9eaf-e2ab45612ef7", "comment": "Malware payload (RedLineStealer)", "value": "8c58c19d6ec42968818f53cd20d76d06ae9896c05bbe56fbfba670c252631369", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685291820, "uuid": "0a7266f5-1bda-4ff6-86fe-e3c56394a0e6", "comment": "Malware payload (RedLineStealer)", "value": "edbfc7a7fcd4d5af4c283e95a7b0c2188c376620", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685291820, "uuid": "22782984-658e-407c-b710-480e6783b34e", "comment": "Malware payload (RedLineStealer)", "value": "cfb49c83b9177d9822416cb17e39975658d6720b6e743e30f4332826c0d4358b60440bafd3537a0472ba59e3746a6544", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685291820, "uuid": "b0b6349e-110d-4490-8690-ff0e988d9e77", "value": "T1D8746C5392E13D54E9268B728E2FC7FC7A1EF550CE9977A922189E1F04B03B2E163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685291820, "uuid": "36d2e0b0-8ad8-422a-ab4a-e141239a8b9c", "value": "937554e81340ac479b370382e43a74d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685291820, "uuid": "ef6e6cab-3161-4ce7-a6aa-0ed539f779b6", "value": "6144:7mkrNkg5bL2qrDQgGVEFl4OkkbGOyiALf2k:XukeqrEFEzXhbTyic1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685291820, "uuid": "74f89fdd-acc0-4f64-8e9f-ec9aa03113ee", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685291820, "uuid": "00453139-8be2-4277-aeb0-fc8840165f4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685291820, "uuid": "a27c115c-1e3a-48f6-9609-1414ec97ba1a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c47c8ee-fd28-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685258423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258423, "uuid": "bbfc854a-06c6-4da2-aeb9-db2a86cf5e0c", "comment": "Malware payload (Stealc)", "value": "8f4a94508a6226681396100f182aafa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258423, "uuid": "cb158198-609c-4cc0-ad98-8de45a3d558f", "comment": "Malware payload (Stealc)", "value": "8cd748b1cc76a501254b9b130c4193efc7882493b750a5ee07a50b2443b6383c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258423, "uuid": "19262943-8351-4041-8235-c707d10e4e5b", "comment": "Malware payload (Stealc)", "value": "0dfd509274f50c3a9bb19ec5b2586a46e82ec35b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258423, "uuid": "d8555866-da1c-4cf6-a486-08546f9c8316", "comment": "Malware payload (Stealc)", "value": "50db3ebc0a29e24d0b9ceea82bc513009ad7b3348d5cffb9635b7ddfad90a2b1ab1e3f95fec0054168d75cf9efe6f382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258423, "uuid": "ad897576-c942-423b-8a05-b84c2deda3a8", "value": "T1FC543B1396E2FC54ED668A729E2FC6EC761EF5508E0977692219BF1F04702B2C173722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258423, "uuid": "bbe1e4ba-63a7-4622-b488-c92140b53b2b", "value": "d683fcb523ac92743f5db043ced73806", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258423, "uuid": "10836be4-a729-4aa8-957c-31554e8df824", "value": "3072:hu2lqV8MwhszmuH43P17cHef1ZzBlHZeT51Ex5z/5QhGvAF:Q2lnMDmS4Ms13lIW2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685258423, "uuid": "ea05d39d-0d2a-4cc9-91a4-ca89657390ba", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685258423, "uuid": "502c5b36-dc5a-4da1-8335-8762f55118a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258423, "uuid": "7e21ea84-c3a5-41a8-a237-88110df476be", "value": "8f4a94508a6226681396100f182aafa1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a197b8a4-fd7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685294295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294295, "uuid": "a7479578-a95a-4885-b4cf-82a24f18add7", "comment": "Malware payload", "value": "b15039efdf1fda8b100c0084497a3db8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294295, "uuid": "8ed40b3b-a7d7-4479-a878-19bb964134eb", "comment": "Malware payload", "value": "8f69ab84282d1c70ea8d9bf3670e31a2e51c19793c9f0e96a29de6fe12013311", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294295, "uuid": "4f7a98da-887b-4acd-a566-88a8192eac75", "comment": "Malware payload", "value": "5cf77fb68dfb0ad4ea31508238103ffcf9cee34f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294295, "uuid": "bea7e984-c055-434b-863e-06accccc9f56", "comment": "Malware payload", "value": "0658a1025c6cb940105466bc55bad54c490ce29b258ddd5fd1466fb62224d031b213a69827b8d30f8c376c114e43da56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294295, "uuid": "e15a1ae9-e5c0-4c59-9a7f-541c66301685", "value": "T19724B70679244B76C98682B77D631FF01385BBF011A3C9E6AB4B9D4039A2672372DF53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294295, "uuid": "eb4aa86c-c0c1-41d6-a48a-a6bff76be8e0", "value": "6144:uqxK7RrYykhanesetJ8ajANEVd11lT+NmUK9hNVIIPlD:1TaesetJ8ajACN+NmUK9hNVIIPlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685294295, "uuid": "de4d3639-53eb-43ea-9096-b96715d23912", "value": 221058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685294295, "uuid": "a6b25227-2ae0-4f8f-8341-fc7d21f8d78f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294295, "uuid": "86ad79a4-3ed3-4f05-8482-b5ff53ea2a62", "value": "b15039efdf1fda8b100c0084497a3db8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71abd925-fd27-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685258137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258137, "uuid": "f5485240-5e48-4180-935c-ec66f097a02a", "comment": "Malware payload", "value": "5dc2dc5761d7b3944b218ee5316dd9a5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258137, "uuid": "30a13343-c483-4985-afb1-2f50e5b5fb84", "comment": "Malware payload", "value": "94c15dd72b5b419c0d2d793e821937716a130802a0ff08f0fca98ea9f14fd0f0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258137, "uuid": "5293d652-91c1-4d66-ba33-390de90a20ac", "comment": "Malware payload", "value": "91dd6dc8e47304eab8559fe454406ef7e4aac4a6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258137, "uuid": "f796f53d-9dbb-4566-92d5-c3497fb8b130", "comment": "Malware payload", "value": "eacecc356f357cbe348d984387ad02a33d45cd63ad86fc4a76ed96f3d14cca69a06b5f1df90d43770b0953d82744ef01", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258137, "uuid": "f156b2ea-de14-497d-a26e-583fdda2228e", "value": "T1D075DF0784149F8BD11983F8BE6338981B0E7F1AB1C469DB355D3B4B7B31A66698F24C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258137, "uuid": "1d9e2dd4-0b1e-4da7-b19d-8432871a77cf", "value": "49152:KLKdQmmQ303QmmQ30UDp+MX5+MXpjTVVswCeX:iapmQk3pmQk/E0EpjJCeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685258137, "uuid": "937f6b64-8eff-47d2-bf7a-bdb0f26eeac3", "value": 1658368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685258137, "uuid": "db8c8f26-53eb-4668-98df-855087c41ad4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258137, "uuid": "4f7e00ba-6ffd-4ad6-8894-fd3afa4b0606", "value": "RIF NDC Oman ORDER.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c46acc-fdac-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685315461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685315461, "uuid": "30c5ffb8-7242-4b26-b096-67ae61f74070", "comment": "Malware payload", "value": "6abcb6f8eab74a4bea0e3ad6d129b8a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685315461, "uuid": "0845b21d-f42f-4428-98a2-9a1c9d35d4bb", "comment": "Malware payload", "value": "95bc49bce5bd6a87f8cc60547fa9b35128feac60257345ea9956cfe3efaf6aa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685315461, "uuid": "7c409040-0528-4f8f-afb7-8a9de4e97106", "comment": "Malware payload", "value": "17c3de35881b7857400370e647cba8668de32dd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685315461, "uuid": "99f48c11-ffa6-4345-ae53-3ee12910bb66", "comment": "Malware payload", "value": "0e134627c4d6b3a93254cc0301a3d77905984e3140bac6acb8ffc12aa282a199c1dfebf0c12b885002625b1a4b2aeeae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685315461, "uuid": "7764bc5b-2b61-4ccb-a6f6-d3733f590f40", "value": "T1E164D0113648C13AF59724B188FDDA7AA6B9B831176F20D7F7C45A5D4F217E2AA3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685315461, "uuid": "e0784824-6834-4826-a11f-fbaf7626defc", "value": "ccf3d145fef27c23a1356d2673054011", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685315461, "uuid": "78fb650b-4ca4-494c-8489-3ce7d4f8bcc0", "value": "6144:R+SLxcMVVvpoKdhGudEkBS6RlUvkBV3MwmD:vdciRCKdhGuW/iyvkBVOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685315461, "uuid": "6914add4-8fba-4a74-bc6f-d9ea59817f9a", "value": 325880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685315461, "uuid": "981c126f-ffcd-4f9e-9807-a4546b2de632", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685315461, "uuid": "15fe2506-b4c4-44c8-ad43-a4b43772e5cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76a1d07-fd0a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1685245825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685245825, "uuid": "4f5a4e86-8984-41e9-9a65-787778e2d64f", "comment": "Malware payload (RemcosRAT)", "value": "baa64f2dfff3bf348703d6b4b2e40efa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685245825, "uuid": "9ae7aa84-7d96-4804-b0ba-6a077638e726", "comment": "Malware payload (RemcosRAT)", "value": "9731cacd93412267f91c55d5568576372f46f7efef2033af038a8397f8fd33ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685245825, "uuid": "8483ba83-b098-48ba-9030-85e10684908a", "comment": "Malware payload (RemcosRAT)", "value": "b0887c42e1e1760dc6f5037c4c1fbf95fb7cd94d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685245825, "uuid": "91f783b5-77f6-4afc-952a-60567dce5f6a", "comment": "Malware payload (RemcosRAT)", "value": "fa3b120e217e591bc7a723bc3634ec9cc7de2ce38b96b8754dc50271f5d83674ebefe00b5e5e1828ee6fbe8c4cd2abc4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685245825, "uuid": "6f2f4317-ce68-42ec-bafb-85a6850d574a", "value": "T100152CA3705A8561D0B11E3241FAE2E887233D7E5E0341A961F4BF5BB83BF53921B917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685245825, "uuid": "b9adcf02-ce98-4307-9fa7-1d41b8c8d71d", "value": "adbaea04a89bab1ef84ae98157c2f6a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685245825, "uuid": "4bb8291a-a445-41c8-98d9-9dcb6dd889b2", "value": "6144:Eg6z3W6RrMpZfS+3AOlr1IHjRXOIOcSqBrB8YB38DamXGRKP6lIGfy+k8vbLqye6:OzVYs+3VOl5nyPSCYPW7Vk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685245825, "uuid": "18d18285-dae6-44fd-a6a2-f4df051ec7bd", "value": 890816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685245825, "uuid": "d9cd4c2e-cfd1-44a1-aba5-f079b1884253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685245825, "uuid": "993dd0d8-864e-4145-b0ef-ec927a2714e3", "value": "baa64f2dfff3bf348703d6b4b2e40efa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689dc192-fd83-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685297635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297635, "uuid": "f3c03416-b6a8-4554-ba76-2d9ca1fc6584", "comment": "Malware payload", "value": "2db9e3504b351631897dca2d62bb1c76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297635, "uuid": "16f6a8c3-0f39-4796-84cf-7230296c7d97", "comment": "Malware payload", "value": "97cf0e648a13a1c84f4364a7a379e85f7728e9358ddfe06687f6d1731f46374f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297635, "uuid": "44dce330-c3eb-44ce-9d66-2f263c975e4c", "comment": "Malware payload", "value": "813919e678c10252359bfa3b0cdc132e3dbdc3fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297635, "uuid": "1ca96a4c-f8da-4704-a552-7b98a6448b00", "comment": "Malware payload", "value": "3cd19742a782a3df605210948cefa8a9c850a1a255f92a3c7045645956335131e0ec66fb66dbb969ea047a6fe155864a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297635, "uuid": "5fd807ca-ac31-4635-b9d3-16081ee10392", "value": "T11AA5330FB1D5C6B1F0B2C9B21E1E8914C596B85208780B95F75C7FDDABA21D6EA0D323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297635, "uuid": "efbad271-143a-4012-b10a-07375e7bcc34", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297635, "uuid": "60da1900-f972-4797-b49b-bcf08317f192", "value": "49152:qixLPD0q103vh+KMSyB03A/DskyFBCX+6ERLme9UPnOs8wua:qix0fIxSsLsNBCXDEBmeqZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685297635, "uuid": "c57800c5-4ff3-4c38-9892-10a305505222", "value": 2167997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685297635, "uuid": "808210bf-ac7b-469b-8069-a683456c0085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297635, "uuid": "5d33f18b-52db-41aa-af5c-c95040278652", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c3a7a6-fd8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685302570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302570, "uuid": "421db426-a69a-4af2-b5c0-ab29b9009a26", "comment": "Malware payload (Gafgyt)", "value": "9c89b8e4d0df28d39eece2a0abb0d33c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302570, "uuid": "33b6da37-9844-44a8-885a-07e147cc321e", "comment": "Malware payload (Gafgyt)", "value": "97f8f2a4a68f9ef4d970066bfa7f12ada7e069f098879dea634c975b5fc1ab20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302570, "uuid": "682f7ae4-68c3-4da5-a95d-91a323c5aa67", "comment": "Malware payload (Gafgyt)", "value": "3f83a44e897e333b063771ec0dfa79161b018bbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302570, "uuid": "2645471b-fa25-45fd-9e21-9f8cedb5adc7", "comment": "Malware payload (Gafgyt)", "value": "7fce22a3c59f8aa0b6c1f09f6c5f2e23826ab1b7e7279159e78644dfcbeb03417cd30a6732175ac2a6879780ba13660f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302570, "uuid": "5751cce1-bef4-4ea6-b28f-13ea94880326", "value": "T190933B56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F390987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302570, "uuid": "651825ff-ff4e-4825-b3bc-c7848ef5f288", "value": "1536:myqmiTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2emVGMUNLe5um7WAgcVjmZIcBI:myg2UVUtBUI8GwPfHkk8rTeLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685302570, "uuid": "aaa2a1bd-c3d7-49d3-ad35-432d10f64b95", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685302570, "uuid": "c86973a2-6b95-4401-9762-451b96583414", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302570, "uuid": "9c16ab64-1a73-48dc-baed-b7870bd29b05", "value": "9c89b8e4d0df28d39eece2a0abb0d33c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8df7ae1-fcf0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685234687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234687, "uuid": "0cb7a7ad-8d26-49b6-91ac-ec600f616c89", "comment": "Malware payload (RedLineStealer)", "value": "cc8a36fa82dde547a2824e0266b64c17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234687, "uuid": "38670fde-9d25-4627-9bf5-ddaef6f0a13e", "comment": "Malware payload (RedLineStealer)", "value": "985a808d3ed5bfbaf83079c207a1840ce62027c844d0f0f948e4529bf7e7b163", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234687, "uuid": "07c037b5-815d-4d94-a539-fd3be1dbdc29", "comment": "Malware payload (RedLineStealer)", "value": "721127f6aae7ff95bce6dcb60770c6117dc2fc05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234687, "uuid": "fe1f98e7-153e-4dc9-aa5a-c80d4354debb", "comment": "Malware payload (RedLineStealer)", "value": "efea5f864c5f7f705a92797f572245e82436dcfe320b3384a946318eaa6f39a1fa05a619e6d7fe500f62473dda0e6674", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234687, "uuid": "c170cb86-2271-4638-9390-389e1d754da4", "value": "T1C074D011324CC43BF4AB247189E9CE359AB9B971172F61DBBBC05A690F313D2AA34357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234687, "uuid": "a9b75c0b-e44c-41b0-bbd0-c6278b04ab4d", "value": "85900470d04da9b14c3b0900f7ae6bb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234687, "uuid": "153dc2c1-b59e-4fbd-809d-f7b887f152ee", "value": "6144:XneIxJV5VvzSG8k3//82fs2KgIqlsBb3i0zUjD:vJV5R+G8kPE202KgDlcby0kD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685234687, "uuid": "6817d534-d014-47f7-a7a1-4b9fdc1ac7f6", "value": 342776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685234687, "uuid": "67a74cbf-a7fd-466a-93bb-d969cddfb266", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234687, "uuid": "a0f571f1-fece-4082-a4c1-32d8eb405af0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dfb3b28-fd81-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685296866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296866, "uuid": "7d540da3-babd-4257-a893-fe99ac7b4bb1", "comment": "Malware payload", "value": "425b1565a27ed9eca7c71bc86a74be4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296866, "uuid": "97a36c09-b523-4101-9943-74d1aea7ff82", "comment": "Malware payload", "value": "988a2a4388b54f8e8b620f316ec0e11ddc6014d264fc375b7b9afec2e9742df3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296866, "uuid": "9e4b9cf2-dff5-4531-80c0-6754446c6ef8", "comment": "Malware payload", "value": "e18c24cfea28fc548bbed550ba2317350943e40d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296866, "uuid": "6e85272a-2a5a-47a8-85e5-b6529f17128d", "comment": "Malware payload", "value": "c63791826ca9267cd908a9b3621efd60af9e91f16b45228e476f8d9fcd466c68263363ca8e4962efee021f6e55ffe28a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296866, "uuid": "f1dec15e-34ed-434c-b000-c231b3e2c1bb", "value": "T1E4436DC1F643D8F5EC5705702137EB329F32F4F91218D683E7759A32AC95A01E906A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296866, "uuid": "db267c9c-657d-4f73-8a01-68dffc7de75b", "value": "1536:EnRWJCoaQbphatKlJ3OSIbzxeu7AvbX8AoriME:EnRWJHaaphaMr37Ib9edTMA7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685296866, "uuid": "680378c3-9c74-433b-83ec-9f2e21bd7e00", "value": 59568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685296866, "uuid": "60bb00ec-8ce3-4d2f-9cfe-6b72446276cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296866, "uuid": "8f43d7db-fa94-43b9-9f30-0c051d708c10", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c28a06-fd82-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685297033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297033, "uuid": "56a62db2-c6bb-40c1-8866-6b78193d129d", "comment": "Malware payload (Mirai)", "value": "3c1564dd3192155768aa4bf59cd98a5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297033, "uuid": "5d16d945-7829-46e7-8fe5-4fc74c46e480", "comment": "Malware payload (Mirai)", "value": "9a040563d5bb063cd9d982b51193baafda1189ad4af8f6ad51b4bb8c3f6182f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297033, "uuid": "fdfc8961-58ac-4af1-89f5-6194246f29f0", "comment": "Malware payload (Mirai)", "value": "a746b93cc20ef2c2374bccad422ceeeec7aea5e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297033, "uuid": "e8f394ea-cfd3-4dd8-aeb2-9699d6e64257", "comment": "Malware payload (Mirai)", "value": "86c1d646517b5d072c4c9c9ad9997116340197062fd26909a53180f9141802a39d5f64ec0ab321cb37c8ba577b1690ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297033, "uuid": "5f34d363-a813-48a7-b194-8c08c5481414", "value": "T103431854BC919A26C6E4277BFA2E418C731563ECD1EE3202DC292FF4768582F0D6B751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297033, "uuid": "884f1a69-a8a1-4f95-a2fa-8a321df71ff1", "value": "1536:wXe9WaJ9833g2c90d9IcjNI62xPYB71/5sl1:wXYWyCc90TIQp2xyR6l1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685297033, "uuid": "4f5d05ff-3346-4282-8b2e-3876f2633fa6", "value": 56144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685297033, "uuid": "d50db4c8-c272-4ab5-90f1-332c22336112", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297033, "uuid": "e881c8f2-6371-4d36-b1b6-6e620dcaf392", "value": "3c1564dd3192155768aa4bf59cd98a5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65f1d13-fd7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685294303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294303, "uuid": "a7f40025-e427-43e5-9a29-adc38fa0ace4", "comment": "Malware payload (Mirai)", "value": "2cd5d5a393400114d06bab0f201071a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294303, "uuid": "e4fbb5de-a6cb-422a-bd08-ad9d040c49f5", "comment": "Malware payload (Mirai)", "value": "9a7092696d829478fdd589fce8c98231a768943c261e5a93777bc0f3b41024c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294303, "uuid": "4628dc74-b1f0-4b4a-aaef-1620af3d2239", "comment": "Malware payload (Mirai)", "value": "027a88b86a2265d0704390b737cb8b1d459c78f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294303, "uuid": "4a5770f5-4488-405b-abc4-138eac909b84", "comment": "Malware payload (Mirai)", "value": "619ad6f237abe0803cc7c3c71f11fd41fd62506785a58fd5b696dff756b4f92d64915c382d4199f318926da12960c646", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294303, "uuid": "6f347458-817b-420f-b605-d6d1f666d36e", "value": "T165735B96B0118DBDFC4BAA7A44120A0DB63073450E531F27B757FEA37D321A5BC62E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294303, "uuid": "aca0f350-caaf-4efd-86bb-eed73b0cfdda", "value": "1536:nQMRwNPwmxjnFx0hP6RdVG0PS3Jr3rm28zMtwMSyyiRs3lphMbOvo:rITFxt6lbmC/Mi+3lpaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685294303, "uuid": "4dae290c-fc28-47a9-b9a9-017ba429de3f", "value": 77028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685294303, "uuid": "830151b5-14eb-4ee7-b93d-7d0f648e3dec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294303, "uuid": "eb4e55bf-44c2-4bea-b04b-07937d9e4c16", "value": "2cd5d5a393400114d06bab0f201071a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c3f8bb-fd7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685293975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293975, "uuid": "3f168d77-b9bb-4e89-9969-ad8e4564c408", "comment": "Malware payload (Mirai)", "value": "0440062b8551c02e44070e7796171b6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293975, "uuid": "0f156158-9996-4fcb-a8c2-e53e04d52f5b", "comment": "Malware payload (Mirai)", "value": "9ae1f592016d17b11e8a212f9f462d437827a764be6a686ff61dd6b79acbff68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293975, "uuid": "3025cc35-b6e5-49d7-94e8-8e16ed3485a2", "comment": "Malware payload (Mirai)", "value": "5c97633f092bbb710fcf0d3a207969f051530de6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293975, "uuid": "a691b33b-47d0-43d5-88ef-78217be0ad1d", "comment": "Malware payload (Mirai)", "value": "3f154bcaa6f0d6b0597378c06598334f44948f6828e59c3611e4079c18001afb4d0ce81141bcd1e43c91b622aa9ab59f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293975, "uuid": "28bf9351-de20-444b-8a76-967b2efdee84", "value": "T138E34C46FA418A13C0D517B7FA9F41493322DBA4D3DB330689185FF83F86A9E4E63616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293975, "uuid": "74008404-f733-4746-be6c-4411648d2395", "value": "3072:ReUkL0fm/6yaykI8Th5oJI82p06jXiM/9B5ep:ReNCEkI8Th5QIv06jyM/9fep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685293975, "uuid": "4701ed30-5838-44b7-8332-f0d71e7ec1f2", "value": 150774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685293975, "uuid": "85d76f8a-9af0-467f-898b-2bcf00167842", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293975, "uuid": "414bc9e4-0cf2-4589-a11b-75ca249acb58", "value": "0440062b8551c02e44070e7796171b6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4747371-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685300339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300339, "uuid": "993cdeb1-b29c-4953-8d4d-e51d9ec0c191", "comment": "Malware payload (Mirai)", "value": "44d2b0dcc485ae06985ed5474e31cb62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300339, "uuid": "67b6aeb4-8a12-4383-837c-30aacf79e3b6", "comment": "Malware payload (Mirai)", "value": "9c1bf8ce01b5abaff5faac246200749e08ba8fc18ccd36b3ee183368442dd22c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300339, "uuid": "3173b1e9-cb26-4848-93b6-e75a1cbe8b3f", "comment": "Malware payload (Mirai)", "value": "7160d8fefb90b5117ac3851951477caa8e443d11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300339, "uuid": "18691ba1-4654-4b6b-a8c4-bd6163767c12", "comment": "Malware payload (Mirai)", "value": "5e189b808e97291d6b98880c60963871410448163361e87cca736d0982633306226e697adb3a1fe2114cc53370070577", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300339, "uuid": "362509f3-6aa9-4c31-b8f9-af10c700d9c0", "value": "T1F2637EC8D287D8F2EC0B0570507EE73BAE72E06A2119EA97D768C571FC96641B113ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300339, "uuid": "98f17232-72cf-428b-b4fb-7ee200f26971", "value": "1536:6XIyXKN5fRp79j8iQNsVmJVQsY0aAtxSqdhqd1aG0CRrWlnNw:64yXKXfRt9j81NsVYVQsVaAtxSChskCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300339, "uuid": "7920088a-ef3a-469f-9695-d387098629c4", "value": 72112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300339, "uuid": "806d0902-37cd-4147-b8e7-01ee710b4133", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300339, "uuid": "46fb4b0f-9c84-4740-9803-efc58b7bb150", "value": "44d2b0dcc485ae06985ed5474e31cb62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2c1874-fd7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685293960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293960, "uuid": "45f3331c-a0bb-410c-a089-f07cbd57ee06", "comment": "Malware payload (Mirai)", "value": "8e004edbef1d73a46965e37d019fb1b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293960, "uuid": "e071a4d5-a651-4285-a1b0-598a27b44499", "comment": "Malware payload (Mirai)", "value": "9cacb01dddb80815b299929a9288ae6f8a8c3bb6c44401e72dee5ba5b881f8e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293960, "uuid": "99d91bcb-6fab-4b0d-b668-813b2c022b8f", "comment": "Malware payload (Mirai)", "value": "d90e7e69193de33372d1f86e262c8f53d57dfb4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293960, "uuid": "28e0d47f-83b6-41a0-a40f-de0bd7ddbf6f", "comment": "Malware payload (Mirai)", "value": "fb7605f876263fbe9b8171b3e89eeb48300842f289d992c1f5c31d259b6c97cda27af3eabcdbb7e54c606bfb93ed0738", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293960, "uuid": "190f19da-48a3-4b4f-b7b7-041754af5801", "value": "T18FA3D606AF610FF7ECAFDC3389A91B4529CC551A21A97B767930D818F24B24F49E34B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293960, "uuid": "e0fc4627-125d-4086-a562-fc1f446b7f43", "value": "1536:SRMOvU1DM4nHekHSyWcVCoYuF3bFY7xQhybqwvAqFlZctbvWEvxPX51tu33+6TfZ:cMOvU1Dxn+kHLdjY+3RCAOlznTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685293960, "uuid": "925f6708-8acb-4e33-8634-14b40c296a6c", "value": 100376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685293960, "uuid": "982b7c15-4f84-410a-8141-f9f825594efa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293960, "uuid": "c93ec43a-2f8d-48ca-91b3-fd2e41104b1f", "value": "8e004edbef1d73a46965e37d019fb1b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd712b9f-fd90-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685303415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685303415, "uuid": "11fad8ef-6baa-47c9-81c0-79cc5cfcf71d", "comment": "Malware payload (RedLineStealer)", "value": "8bfe52e5cb5f3e282795bf116633ac35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685303415, "uuid": "ed53f31e-4656-40ae-b70d-3eb985eb644c", "comment": "Malware payload (RedLineStealer)", "value": "9d8b27beac75c83b81370d2b26d023e2bfcb4a6b385a477dc84edd548bf490cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685303415, "uuid": "2d95cab7-7723-4e42-adc7-d9ecd81c57c2", "comment": "Malware payload (RedLineStealer)", "value": "f4ff2f72ff42b384c974b1974b69e85f68f0da0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685303415, "uuid": "90158692-280c-41a2-a907-63304709fddc", "comment": "Malware payload (RedLineStealer)", "value": "68e3d07200fd7e9fb1b5c73dc68a87aa0e56fcfbadc3454631e12c8c6738ddce741995836bf91d2735636c1ab1b434e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685303415, "uuid": "4cb6e102-33fe-4cb6-8d84-f89a6d36101c", "value": "T1D2051211FED85536CCF21F7058F613830B35BCA399B887AB67449C9A2CB22D4A935736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685303415, "uuid": "508ea54e-1918-414e-a229-7ef30b519cd5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685303415, "uuid": "e1801ec8-306e-4796-82b0-b880180f60b8", "value": "24576:cySzjCiYPC0LxldTeiuBZbJBEgpY7BB3MOOxA:LSzjCdPWBbBpYjcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685303415, "uuid": "95a83e33-98e3-4618-abc3-7271ad5778e2", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685303415, "uuid": "3992f6bc-a0a3-4c71-860d-bc0c1838286c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685303415, "uuid": "4f3edca8-4b9f-44b3-8319-162a26d1f7d7", "value": "8bfe52e5cb5f3e282795bf116633ac35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77dc9741-fd63-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685283917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685283917, "uuid": "bf0fbdc1-0e80-4cd5-8439-91d8b33873c2", "comment": "Malware payload (RedLineStealer)", "value": "3ca28bcc9582c00b1d01489af7c51332", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685283917, "uuid": "9677c73c-2161-4c58-976e-ce5fad4c48d8", "comment": "Malware payload (RedLineStealer)", "value": "9e02ab372234d69280e27189aca3f27b5d0312be25ee5423cb728ddd21a7aa88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685283917, "uuid": "68a72119-ff1f-412f-b0ce-4f99e2005525", "comment": "Malware payload (RedLineStealer)", "value": "9655901298a7012786c7efa6b069bc366ace1368", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685283917, "uuid": "7eadf952-c989-46dd-aef4-ae8298724db1", "comment": "Malware payload (RedLineStealer)", "value": "21d77573410f74d6c413f5f1f8a3e54e6c41ff2bfc500d6940b78eb2b1c9f88e70d5f4921a22e16b42c38c0e8d5876ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685283917, "uuid": "c64a0aec-4025-4c52-8b04-87083bbd0952", "value": "T1F5052362ABF85032CDB23B7148F60A572E31BCA2D634436B22559D1F4DF2284E9717B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685283917, "uuid": "0b21b40a-10ee-4040-a932-ee051a9d302d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685283917, "uuid": "e8af3c26-e88e-4a15-890d-753dd2d31fae", "value": "12288:9Mr9y90fnN73Jy1KKJNW0ukNFUbASJKxqmPGbEFMGpXBJPj4ehjnk:kyqrJy1J8RG6bXKrPGYMGpXBdj4enk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685283917, "uuid": "98502151-f364-41b2-af4d-852485b6104a", "value": 822784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685283917, "uuid": "595d5ebc-389a-434a-9b0d-90cf45e13f51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685283917, "uuid": "547e80bc-a1ab-4ede-a534-cd0d6673c51a", "value": "9e02ab372234d69280e27189aca3f27b5d0312be25ee5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae8006f-fd33-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1685263494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685263494, "uuid": "22724e44-fdc5-4cba-a1bb-09c5c80a0d4e", "comment": "Malware payload (ArkeiStealer)", "value": "22cd094d925fb41f446ed4db24cc8c35", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685263494, "uuid": "7becb5cd-0ce3-4753-bbd0-caa9570ac42c", "comment": "Malware payload (ArkeiStealer)", "value": "9edb64bf310212bffcc2fa176b22b570d071fb38873292a1a1ada19f8536231c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685263494, "uuid": "9893eee3-2dde-4efe-a4a1-520e12288ccc", "comment": "Malware payload (ArkeiStealer)", "value": "c316b3fa0e1357ed5815002b0354e8503d5ee038", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685263494, "uuid": "55a751cc-26c1-4314-8bf1-c34a8f7c6260", "comment": "Malware payload (ArkeiStealer)", "value": "67bbffc24f52721569adbc271072ca79234a97db5b2f85b831f59cbabef373dd7d235b73a481901e55b853cbf0e34d14", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685263494, "uuid": "3693106e-83ec-4c4e-944b-267df50da086", "value": "T140847D1392A1BD40E9664F769E1FC6E8761EF5708F593B69322CBA1F48700F2D263B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685263494, "uuid": "e8b331a7-1b67-4c80-97e2-48f22d7ee197", "value": "2d9ed3462f8a74bfd1231e2e9de56b43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685263494, "uuid": "d11d3f9f-27ea-45f3-a498-191656803ca1", "value": "6144:QY/jZT7vRNMKOO3PFmc7rPZWM5khCVYPnZe+QSdixrmwVUTtiKG:Qq5hOOMc7fLVYPnZ3QSd8yFTtib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685263494, "uuid": "dc5f3809-6170-49ce-9bdb-6f76c894a9ae", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685263494, "uuid": "e5d5ca63-9029-427f-aa05-95ec852197fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685263494, "uuid": "c1569b7e-9d4c-4952-b49f-16dbb3f5844a", "value": "06625899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6afef91-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685299914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299914, "uuid": "b880fc0f-8e46-433b-a1ad-d7ec17933c63", "comment": "Malware payload", "value": "aacca25494046fdb24e48a9da2d9621a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299914, "uuid": "ae816814-85a6-4598-938a-86a02a73ce8d", "comment": "Malware payload", "value": "9fa4472c499a40d014d9467c43805fe75dac24aab903c60c11a3a80101695a53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299914, "uuid": "62fba8e1-3e5c-4615-8a78-dd1c974cb9d4", "comment": "Malware payload", "value": "87705530a79d11690498302622c5a0751c1ffa7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299914, "uuid": "618a7a4a-d285-40ba-9b81-4f8f8420c417", "comment": "Malware payload", "value": "20a597cc51f338478920be1fc9ec13358f9ea8ad09c4e35dd2380db4516ad2f0660a5f06e600fc24ce5075e52d75c545", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299914, "uuid": "94d79d27-d614-4193-90cb-0569d95e0aa9", "value": "T163534B02B31C0A07D1A31AB0253F5BD197BBEAD022F4F684751F979A96B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299914, "uuid": "c212a7be-c209-4814-b7bb-106dd6671e24", "value": "768:qkaZjEoakZNRGHRnDmX7Xm+t/MyV8SpXCpEM4u/J9KCrMvuBxANUr6FV+tMiwWbd:MvolWm+l1pXgdJKCAWBxANee++bWbvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299914, "uuid": "342214ba-ba1e-4a5e-afb4-da908f7dae0f", "value": 62988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299914, "uuid": "1b4c4b29-1705-4643-b796-f3f994599d53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299914, "uuid": "ce4dce2d-bcc9-4618-9065-a0204d25a28c", "value": "aacca25494046fdb24e48a9da2d9621a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b081bb0d-fcf1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685235049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685235049, "uuid": "5de09518-1c60-4e08-b1d3-00258f7ed5ca", "comment": "Malware payload (Stealc)", "value": "a68a853fdb8d2d5ed774bb57a5511984", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685235049, "uuid": "b4bc8eb9-10a1-41da-b058-341b1be43ece", "comment": "Malware payload (Stealc)", "value": "a1422d78eccbfe84a145cce093bfacf4b5e0e5cf81f1ce82a94c35ffa4172ecd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685235049, "uuid": "7adb7965-7acd-4e07-b30e-249b1f6f048c", "comment": "Malware payload (Stealc)", "value": "4a0290dd5d4b5611a098f58cfc2bb0b3dab878a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685235049, "uuid": "47f713cc-2fc7-41bc-b25a-2e234fd7b587", "comment": "Malware payload (Stealc)", "value": "ce275d98352954778a74803c9ec7d1d5ad37d969e45e6476dda440c6135822c7825119c79a55a5ac4757c3db32db1e67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685235049, "uuid": "5ddbc427-f2e2-4cf9-a298-907e73437859", "value": "T13F83F72EE36661F7E8918E7C260C22DAD13949763645C1A2EF716F05A8F00C29CD5FDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685235049, "uuid": "d62ec64e-768d-45e7-bc53-026ef1433331", "value": "c2e4487f461edff82f81a902e3e4f0b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685235049, "uuid": "0499159c-cfdb-4632-b53e-6cfc7230ec1b", "value": "1536:IAbFlbgwBPLqmQIsUDQvPp6CtZEhG6SufhiciljtIu3Li6TdY:IAbF9gwBPLzwsQHp6CHEhzSuJxizI0e6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685235049, "uuid": "0b69151b-1c27-4179-8540-bc30614db61d", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685235049, "uuid": "9fc30660-58fc-41fc-a36f-5286d703cfaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685235049, "uuid": "b58ebe6c-1c96-4837-84de-b6516dc94d18", "value": "a68a853fdb8d2d5ed774bb57a5511984.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb457900-fd7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685293989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293989, "uuid": "4caa4268-fa16-41f5-8f48-850d5ce97c58", "comment": "Malware payload", "value": "5fb1a5a51ff0067779ed9691463e28cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293989, "uuid": "697447b2-15db-4770-953e-890fdb3e58f1", "comment": "Malware payload", "value": "a40fec7100ac7b71414df6a6e133cbf1a71fb89e0e18e874ee11af004f2ca5ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293989, "uuid": "90b08e27-7527-412f-801f-a7a8bd78005b", "comment": "Malware payload", "value": "73ff9f87ba22750eb4fd88105c89a2606c081e64", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293989, "uuid": "d1ec9003-0980-4ba8-b2a6-de8999eada69", "comment": "Malware payload", "value": "0fa457dba120133fae7f4c247abf0aaeaa3f2f4fac0824c0f703a36fdd82ea1c9a55d9bfe9debbc2e729f935105f493d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293989, "uuid": "29875c24-5aea-461b-916f-a6e24a57495f", "value": "T1924462197D21AF7DD5548233B3F31FB0529566E12263CBB2E39FC9102DA126D3A1EB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293989, "uuid": "6f0c8b85-dffb-4579-a852-5d789dc5d00c", "value": "6144:ZerciBXXZyfniHJ8ANxXetJ8ajANEVd1S7dmS/QN8jdOCZD:uwiVetJ8ajAV7dmS/QN8jdOCZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685293989, "uuid": "467615ea-e8b5-4b17-8fb3-d7ef91a4dba3", "value": 266413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685293989, "uuid": "04463a79-e94c-42a3-9eea-ef54c0dc03e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293989, "uuid": "d6e555e6-f4ed-499b-8ed3-99e7d475c596", "value": "5fb1a5a51ff0067779ed9691463e28cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9912f17-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685299892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299892, "uuid": "5d8f7b27-082f-4c55-8b57-085b234bdc30", "comment": "Malware payload", "value": "69e85ad39a37085c7a1d8be10cff0bfb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299892, "uuid": "91f34f90-1353-4d8b-b49d-a57b6aedcdfc", "comment": "Malware payload", "value": "a42374f9d82cff8b81d00d24f241dfca2bb4ee1638f9af070b89bdd768fd2f91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299892, "uuid": "f572880c-0397-4dac-a399-ef40033a1b7f", "comment": "Malware payload", "value": "fb76b436e354f51922630173fa0344d6381ecec4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299892, "uuid": "3ea10e71-3892-4815-84e5-0241ed02dbb6", "comment": "Malware payload", "value": "fd79f88c545c97216bbf3d5729a760c0df59ab618c256a318afc94e79e747994ebead96d33346acb7813d08578a4ec52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299892, "uuid": "6be4aa0f-2efb-49b8-9736-975ef9cf8795", "value": "T168633A21BA761E1BC0C1947661F74B25B2F143CA26ECCA0A3DB20D9EFF71A446543AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299892, "uuid": "a1347d49-f7aa-45ad-92ae-fda40b20a027", "value": "1536:lGBVg7AOotXhGIAsQ/VJAcQpQm75YH/tatoV:lSCz5LSQmVNCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299892, "uuid": "fe385c2e-66db-4f85-b308-cc26cce7d95e", "value": 67312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299892, "uuid": "7c1dd93b-73bd-4048-b39e-cc20f95d3d5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299892, "uuid": "ecb57b3d-6e51-43d4-a5e8-65b03cb14dcc", "value": "69e85ad39a37085c7a1d8be10cff0bfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fdf0a25-fd27-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685258134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258134, "uuid": "b0722daf-a8b0-460e-8abe-05290d49f1bb", "comment": "Malware payload (GCleaner)", "value": "2d58aba96e7cc72f85180ccd432e7ed4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258134, "uuid": "c3f276f1-6fea-43de-bc09-f84032e2c574", "comment": "Malware payload (GCleaner)", "value": "a448532111acb71c08bac8801260a014b7c0c0f53a0d8f91e90ab5e34e764e56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258134, "uuid": "372cf70a-62e5-42cc-9e2a-4e788dd5b7a5", "comment": "Malware payload (GCleaner)", "value": "34353f35d9b9d1f82ec7f45752ffaf3343599fb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258134, "uuid": "15c598c2-c2a4-43dc-b9c6-8b7501df5b66", "comment": "Malware payload (GCleaner)", "value": "1522b4a6f8b0cb58b4297c6d5b3628b97080909ebdd786f6a1a63e023831da2d304e925cf59e4d0bac8d024fae61c7d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258134, "uuid": "d31de71f-9b55-4d08-9154-75ba39643407", "value": "T19D747B5392E17D90EA664A739E2FC6E8731EF3554E093B556228AEDF08F00B2D173781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258134, "uuid": "68a9e0f6-c4f0-4f26-b7fe-56f168064abe", "value": "5ea1866af0e097b7b73a6d1cadb8810b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258134, "uuid": "4c87b3af-0e8f-44b2-bdda-bf9bd1b36836", "value": "3072:q1oTsxcJtIOfOH+vyGs5rK7hF1USMDxJ66FgWOoQyc1DobbMrpCI/iHWiTbJPWeQ:quMNevyGtUVrvW7cIwWiPJN0GvEX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685258134, "uuid": "d6afc379-b732-4ce2-a5b7-4059d4bed722", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685258134, "uuid": "eec9838e-e945-40e4-8bc5-148e7da69ff7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258134, "uuid": "136ee4e3-3baa-4ca1-834d-5462840ae81c", "value": "2d58aba96e7cc72f85180ccd432e7ed4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eeefe23-fcec-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685232765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685232765, "uuid": "322121e5-9dba-40a8-9050-7053afb5c42b", "comment": "Malware payload (RedLineStealer)", "value": "21b385a7d4718bde937e24506d0bdbee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685232765, "uuid": "5a063f60-4878-4b9f-99cf-dbb9a219895d", "comment": "Malware payload (RedLineStealer)", "value": "a4bb9762185f053519b66a792b63b2d207c8861facbfdb8b3d25b051367eed97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685232765, "uuid": "34edff0d-e436-4cb4-a4a0-c9913ebf918e", "comment": "Malware payload (RedLineStealer)", "value": "92e3c266d2c41ea94b7ca2acdf5d96953f323605", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685232765, "uuid": "1081066c-be60-45be-b941-ded47dc898ea", "comment": "Malware payload (RedLineStealer)", "value": "7377482a9f5bc52e19a0e679015896554c33f8c6414650bd2f93fc8b1fe8580cc96bc5f4d2456db2b08b5194b5c4d200", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685232765, "uuid": "317d8784-59c4-413b-aa64-b974172ada9d", "value": "T15B745C1397E2FC54ED668A729E2FCEEC761EF5508E19777922189A1F04702B2C163723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685232765, "uuid": "3b4be5cb-ff45-4571-a1d8-0d5aaa1e6767", "value": "d302e4ac3406067f8ed838633897aebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685232765, "uuid": "cc3a826f-e065-4e94-81a1-cf47f527ebfd", "value": "6144:FurvL0HW5pM23X13fFpXx9Malz6ZtatG+C2q:An025pM2nlfFBPlz6a4+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685232765, "uuid": "cd7f5a36-07b9-4794-908c-7d9b42d007dc", "value": 350208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685232765, "uuid": "97c18c37-3276-4522-ac32-3b821b8efa06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685232765, "uuid": "1b822669-79db-4700-bd43-757c92457ad8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9069090-fd7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685294307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294307, "uuid": "a74ef81b-1859-4895-8a37-8a99c6d174b1", "comment": "Malware payload", "value": "9f422aa593174d0dafa007267bd73d15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294307, "uuid": "d781d718-d1b6-4f70-9d10-d529966febc6", "comment": "Malware payload", "value": "a7f6fab5cdc4423f8ecaab5d3b6e07effedc18d0e8ee05ff0f9bf19cafb2021f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294307, "uuid": "a27ed3e9-d43f-4196-bcc7-52ce28c15336", "comment": "Malware payload", "value": "789a7432351b8b3d6aeb84416042b81cf5275958", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294307, "uuid": "40ae28a1-2949-42e1-8859-0b94ce72f4af", "comment": "Malware payload", "value": "f49277eea54512700993e96f7a6ef14b64550e0d92248e8bc097ca8db83ab650d0b5b36268c97c321a8e90dbffaaab85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294307, "uuid": "963786e8-8001-4181-b7f0-a861e7f21ffd", "value": "T1DD54E800A9108E76CAC3437BF2570EA83252AFF453A3EA769B575E703EC17663B39514", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294307, "uuid": "0438f53f-a1a3-4cc6-97f6-5ea4ddef3d5d", "value": "6144:ixic7akoYs4vTNVddhW9/7odetJ8ajANEVd1Putf5SF0M/9PimHwqdyCF+:ixic7akoWvTNVd4/7aetJ8ajAQupyl/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685294307, "uuid": "419816dc-0748-40ce-949f-5f436ced08b2", "value": 291277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685294307, "uuid": "11fb732f-fe1f-44da-953b-8e5daa701426", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294307, "uuid": "7f382119-aab9-4017-be1a-2efbda6d18b3", "value": "9f422aa593174d0dafa007267bd73d15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24ff469-fda2-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685311100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685311100, "uuid": "743e6875-8f46-434f-8d75-20edbed698cd", "comment": "Malware payload", "value": "ea9775eca677ed8dea5646a7aa6b750e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685311100, "uuid": "402b41c4-2cf1-42c8-9841-efce3e2c289e", "comment": "Malware payload", "value": "a7fccc560bbac61bfc74829d2d4af7fbe362fc988192352a6ee90f8a651f3d06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685311100, "uuid": "54950d60-db81-4e94-862f-c2ff0a5a45ce", "comment": "Malware payload", "value": "9429b4fa7b57f05099361862c4070f4533ba96bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685311100, "uuid": "ba22d30d-1238-4826-956f-871367ee6ef7", "comment": "Malware payload", "value": "b9f3aceb14359bbc46bf916d1c65fc5d3460c90e0ad8ce04756d4fa97bfe2e08ba5eabb5543b3bc023bea5838174deb3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685311100, "uuid": "1c983ca4-87b5-4680-819c-b17d55d46ba7", "value": "T11BC42392C7E243F7E5AB82B5539FF72BD6342397A9C0D9B6EB72D4213242D3054290A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685311100, "uuid": "52762591-5809-42a4-95c2-61655b0b9cda", "value": "12288:0tztfERIhRkcItwaKXJoqg+bZjrAR4b22A1Bii4jSfUKdzf:Kz9ERkItBKXf5NXAqA7id9Kdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685311100, "uuid": "5f2b4efb-b3b8-4f58-b26c-77f53c30de73", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685311100, "uuid": "2776037b-0453-48e6-af1d-cd12b81307c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685311100, "uuid": "1a8cd03b-46b7-436f-84aa-5c6f2a128215", "value": "ea9775eca677ed8dea5646a7aa6b750e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d8e23a0-fd80-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685296274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296274, "uuid": "56919509-2f35-42b0-89e0-808a80037000", "comment": "Malware payload", "value": "006bc5ab53845fd29871478e0b0cf5e3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296274, "uuid": "dba552e0-81dd-46d5-863f-6e55c3a45c85", "comment": "Malware payload", "value": "ab4dec17f1d02f305ce4a605879407e6f59f1e238930e3fb70e7f783f862dbdb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296274, "uuid": "89ebc6e6-5960-4e43-8e5e-7db19c646818", "comment": "Malware payload", "value": "03b4b4dc2bb1ec8d5538381e50c9046a6a4fcfe3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296274, "uuid": "9cb44365-ba62-4a30-a72a-dfbe211d061f", "comment": "Malware payload", "value": "03f74adb643ac12e8d756d4e0cc89d61f6e0d7978b820ebd482b816f15681b992fe95158c6a2baa6e073405a15c23ee2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296274, "uuid": "128325da-d1df-4bac-acb0-e73324632c5a", "value": "T1DA64BB382EEAA029B373AE799BE4759FDA5F7B633703844D1091038A4623A41DDD173D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296274, "uuid": "317cc916-4a72-4e6d-a9fd-6d499cc0836c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296274, "uuid": "c6b11f9a-c613-4317-b857-691da9376708", "value": "6144:O6r9j6gZbVRVfZOxNo+1phJcBeYeG3n4cRcI4X2K7h:ggZbVRFWS+1ph8eYv3n4cWI4GK7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685296274, "uuid": "1668c440-529b-455d-87d6-43b0e6257493", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685296274, "uuid": "e29d0b38-0b82-482e-943d-9b0cb24cb91c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296274, "uuid": "ea15d8e7-959a-4846-b32e-fcd131a38ea4", "value": "03416699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d4bdfc-fd11-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1685248579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685248579, "uuid": "eae39f59-13f3-467d-a6ba-77ea0c0fc103", "comment": "Malware payload (Glupteba)", "value": "9a06ebe2fc44a98b56a30cda95733653", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685248579, "uuid": "6c4122b7-8126-4026-acf2-d214c3383f20", "comment": "Malware payload (Glupteba)", "value": "ac346298ad2b0864e4fdf0037c644c677e0a47126bd14e05b5771fe880b127f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685248579, "uuid": "262bafcd-4343-4698-a3b3-76b7d60f04ad", "comment": "Malware payload (Glupteba)", "value": "bb26d32feaf245a84c86c1e1ea87dea4d0ed2b3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685248579, "uuid": "0d3d9a31-d07f-431d-974e-0a9aca95621a", "comment": "Malware payload (Glupteba)", "value": "c623033c76801a5b9826bf03599b90f8e65986676e8f1f7c31503eae2596c261d075091b84e842f9036769ecd9a4bf41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685248579, "uuid": "11667476-940c-4898-917e-412f6ae89bcb", "value": "T1AD16234396A3FD44EDAE8772DF2F9E9CBA4DF1508E196B7611148A1F00B02B3C52375A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685248579, "uuid": "cca53625-aa06-45d5-bb57-9d0f7d13dae4", "value": "d302e4ac3406067f8ed838633897aebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685248579, "uuid": "ce611eb1-a43c-49e9-80d2-db83de5f9294", "value": "98304:2LdEAtCskksXMx/oJuuZNyBrdmQWAVLvt/uBKWAbqJ4H:2TfkkLVxuZYhTZVu+bqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685248579, "uuid": "206e2b79-27f6-4828-bec9-4510af9ebf36", "value": 4371824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685248579, "uuid": "a0993fcb-de76-46a3-9442-a4c6e8a8ad2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685248579, "uuid": "ee4cab8a-82ae-4afa-9572-fe64a4100670", "value": "9a06ebe2fc44a98b56a30cda95733653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b814f8-fd28-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685258403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258403, "uuid": "43881415-8956-48e5-99d5-21196eaea7f9", "comment": "Malware payload (AgentTesla)", "value": "942a1420b3a4684fc08935db9e29c4a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258403, "uuid": "6e353555-b8e5-42d1-b803-eea6ca2c2577", "comment": "Malware payload (AgentTesla)", "value": "aca520ab30a0d4615d12830ed8633aa83595fd6eb3bfccafa9ddbbc2dd4db547", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258403, "uuid": "767003f4-7025-40a8-940a-a2a1fc90595c", "comment": "Malware payload (AgentTesla)", "value": "35c8b99eb2c4f2a7083f6f08bb636689dbd550e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258403, "uuid": "ef2b8095-8fd5-4ddc-ab86-c38bcf647a68", "comment": "Malware payload (AgentTesla)", "value": "c500df3ba0ffc0bc077b4840110fe599e9eb1b03cb5907a67ae8156cdb2926c0839ea761d197b1dae6954585e409b8ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258403, "uuid": "7c5e9d54-84d3-488c-a3ee-03a288c6dae7", "value": "T1CC05A57C5BB686E780B3CB5887CC58E7F1855F7734908F6588E2832712869497AC327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258403, "uuid": "75996565-287b-49f1-86a2-d30e9a831f65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258403, "uuid": "b5867111-8bc6-4c8e-b910-d1c385800dbf", "value": "12288:8xV3p7k08l09QuHVOGN3n8tQf2AiBzB2K5fN88bwWsj:8xV3p78l8VHVdN3IQfiMGRtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685258403, "uuid": "98247029-5b9c-4063-8ae9-dfe816384a4b", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685258403, "uuid": "01451362-5889-4c65-9785-ddec3757a677", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258403, "uuid": "30c06bec-5fa5-420c-9644-72c01321d52a", "value": "Statement of account DHL.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ceb352-fd82-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685297228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297228, "uuid": "bf25fbea-e23d-4f9b-870b-46efa3b2dbd2", "comment": "Malware payload", "value": "35d57b6756b2983a613cb8125d7ce6c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297228, "uuid": "d084b16d-8180-4882-ad40-0207c93fa0cd", "comment": "Malware payload", "value": "acb2a6a73aa1632cc34bc0119b34ca5c7d35b617fa45659cb2880740e9308905", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297228, "uuid": "25fe516c-da12-4f63-917b-e942c6005e0d", "comment": "Malware payload", "value": "048f39a7953bb4e09d9cd81e0a6e21d8ee296849", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297228, "uuid": "4ea8c0c8-8076-4a6a-abe1-883e558b0615", "comment": "Malware payload", "value": "6b61de3c6da29325a284d30fda7d52f117d3937ff28f6ae9e92cc615a532910322d652ab950cafedd367accf13348368", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297228, "uuid": "62a27fc5-1ed8-47f5-916e-0ef996a49abd", "value": "T1A8334AC4F643DAF9EC4705701177FB339A32F5E51229E743C3A99A32AC52602A906EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297228, "uuid": "5acf733b-25a9-4588-9074-df949561fe11", "value": "1536:GWa2d5sf1Gg+ya+nlQyF2zjHDffwVsp3MSfCYN:Gt2d5sf1GCammo2PjnMW3dCYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685297228, "uuid": "66b10cd4-1e45-46ef-a69d-d80b0b4f63e7", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685297228, "uuid": "ba03effa-d16c-4781-a66e-8174e8c792c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297228, "uuid": "7bb450fa-9505-4278-81c7-304264458bb1", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd78d4c-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685299875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299875, "uuid": "9a29509c-f8bf-4de5-acdd-d71d2e856a51", "comment": "Malware payload (Gafgyt)", "value": "3f56fa6d589e9dd043918ee1da73c68c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299875, "uuid": "99763f10-a3fa-4334-84ce-4dfb6adf41c7", "comment": "Malware payload (Gafgyt)", "value": "acb60f6353be216ca4322f493bc7cddb0a9251431f97cea64b9fa0bed552dca9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299875, "uuid": "b2776028-22a8-4473-a60a-1596c14d6c9e", "comment": "Malware payload (Gafgyt)", "value": "803b77415710611f5ad494471bc5652aded3ca94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299875, "uuid": "bb1c0ed5-b440-4b98-aa09-bb7292794166", "comment": "Malware payload (Gafgyt)", "value": "07cc9495a5f28a484e053844d7e742e5a3eadf07cb76ee2c6ba366b98441a8ddde691148c6c42d0d4585efa170a3de65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299875, "uuid": "798bbe26-24e7-476a-9e3c-154be7d882d2", "value": "T13EB30692F900DFF2F40AE67604C34B2566B0BF660F536A66B21739A79E721C43867F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299875, "uuid": "25250f82-ebbf-444d-9ecf-bd979f496c69", "value": "3072:gLWUEK1FSHGfs1QbEE6QyPwLs/avcWVRm2pgYMx3IPtW:gDsGfs1QHyPYsSc2Rm2pgYMx3IPtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299875, "uuid": "4353d1a0-846d-4195-bcec-351136e7e034", "value": 113759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299875, "uuid": "93dc6413-5fb1-493f-89a4-10c9eca89638", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299875, "uuid": "6fe8c823-c1b4-4afa-9569-797b6c052385", "value": "3f56fa6d589e9dd043918ee1da73c68c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5076ab0-fd52-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1685276718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685276718, "uuid": "2f135e58-311f-44d0-b06d-04fd6a8da8d9", "comment": "Malware payload (RecordBreaker)", "value": "a15368816de1f0ed8b7bb687f8ef54a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685276718, "uuid": "628eb168-265a-4d40-ade4-f65768841794", "comment": "Malware payload (RecordBreaker)", "value": "ad357adba4c2b2a46057c65dc06fcba8e2ccb41d157a88cb31dc29db43cecf36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685276718, "uuid": "68ffa5bc-c890-4e82-b440-a1a5273ffc5c", "comment": "Malware payload (RecordBreaker)", "value": "6323221495834dc42128b64e07881913a62cd71a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685276718, "uuid": "74a93994-f3b2-4b12-9046-3a58e5359644", "comment": "Malware payload (RecordBreaker)", "value": "81f5f57399901b0a0215215bea0110650f99d2d393d0bcfe8150008106d9c9e8ed1d864e82ecce8f850a4c562b7c67bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685276718, "uuid": "9b699507-2f3d-48bb-8ff2-f29881625f19", "value": "T19A543A8396E2FC54ED678A729E2FC6E8761EF2508F59776922189A1F04703B2C173713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685276718, "uuid": "1c8392c1-8cb7-478c-b94e-037933c1ed67", "value": "d302e4ac3406067f8ed838633897aebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685276718, "uuid": "64e0114b-ba35-40d0-8c1d-8d719d7dfe9e", "value": "3072:MgzVrh9zwm5ZisWcVtnQTbwOw7bsDYR6Pd5gG+ZGvAgi:jzVbwiZL9VtQTb7w7IDu1GQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685276718, "uuid": "f3139e16-16f9-4a9b-8d41-76849e3222be", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685276718, "uuid": "66b6dc87-5703-4276-89ac-79f6ae83f29a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685276718, "uuid": "4c7e8dae-cf67-4439-aa78-f21f81c1d2a2", "value": "a15368816de1f0ed8b7bb687f8ef54a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784f31f5-fcf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1685237102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685237102, "uuid": "fe795a03-8399-44bc-8637-e4825c425452", "comment": "Malware payload (Glupteba)", "value": "17eddbd3808d21f93502d56c25688750", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685237102, "uuid": "d23f9a04-7238-4c7f-8743-a978a5c4c05b", "comment": "Malware payload (Glupteba)", "value": "b21aa2e7a110fd18095a02a6ab53c1d13b0dbcd258ee9330690911393fd332da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685237102, "uuid": "9dba8f52-2722-4f52-9a76-90cb4fadfeae", "comment": "Malware payload (Glupteba)", "value": "1aed137357289ec774b66b385ee6872ad41f3e54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685237102, "uuid": "235b89f1-0339-454d-abdd-f453126d900a", "comment": "Malware payload (Glupteba)", "value": "66edde718084d96764906b63c6f163a2bf80610d26646bbe4ff69977ded60684b38e0c0c609f5cdcbc0418757fd4a975", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685237102, "uuid": "8db99f10-187b-418a-8b74-4b63d8d89fc9", "value": "T1781623439AA3FD44EDAE8772DF2F9E9CBA4DF1508E196B7611144A1F00B02B3C52375A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685237102, "uuid": "93997b0a-9f5c-4efb-bf78-7f4d3b8e49b5", "value": "d302e4ac3406067f8ed838633897aebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685237102, "uuid": "dd8e3e67-97bb-4422-9367-0eb76f03ce2b", "value": "98304:WLdEAtCskksXMx/oJuuZNyBrdmQWAVLvt/uBKWAbqJ4T:WTfkkLVxuZYhTZVu+bqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685237102, "uuid": "4b1cb5dc-b6c4-4a11-b4ca-2bb928d50791", "value": 4371856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685237102, "uuid": "5692adbc-8bc7-44d7-a279-afce32454791", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685237102, "uuid": "fa7b929a-f07d-4e41-ad6d-76e46a715f0d", "value": "17eddbd3808d21f93502d56c25688750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8fc9e86-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685299944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299944, "uuid": "ae0d9bfe-4312-4283-88a0-ac07b678e7eb", "comment": "Malware payload (Mirai)", "value": "13aa1053e5cb9ddf1b23b648de37559b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299944, "uuid": "9d81c33c-ccca-4ada-85f3-ea822f4adc67", "comment": "Malware payload (Mirai)", "value": "b26ca6e5c34a3af80ba9a8e5d89b2f10624a1664b27acd26f6b46a850915d72b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299944, "uuid": "6439773c-77a5-4314-8fbf-1956c0555e1b", "comment": "Malware payload (Mirai)", "value": "1872d9c9eda68549650fb1ef2f7a4f6785af300a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299944, "uuid": "fb47caaa-ccac-407d-8f30-1b433b0427c7", "comment": "Malware payload (Mirai)", "value": "6efdba43cf70f8c362efe0acdd096ce5f47de553733b2b0f0c311e3c669bf4bde6dbfff19dadbc1455b76cbc9888d287", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299944, "uuid": "b636c855-407d-48e4-923f-8a46a65af059", "value": "T1C8632855B8819623C6D112BAF6AE02CD3B2527E8E3DF72179D225F2037C681F0E67E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299944, "uuid": "275256bf-1843-4a35-a82a-283f93d8ab46", "value": "1536:bIAuTY9QwktLADYNo/SXT/dWlZ24qYi+6wlX88NRuY54vpWH:bIwuADBwZjLYi+6wthfope", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299944, "uuid": "1ecae449-b798-4285-b922-8fd9dbdab01d", "value": 71804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299944, "uuid": "bb725173-ab55-4aac-9d92-92e6636cb2f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299944, "uuid": "c3f42b3b-79c0-488f-8ead-9d6c3a754761", "value": "13aa1053e5cb9ddf1b23b648de37559b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ccc9c0c-fd7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685294287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294287, "uuid": "c9797232-7c6e-4b38-996c-3dc78e0e09cc", "comment": "Malware payload (Mirai)", "value": "a8e5440d8ce80f8a26a47620e6ef7633", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294287, "uuid": "8d228b62-874a-4204-a9c5-7ff1def50de2", "comment": "Malware payload (Mirai)", "value": "b32f4b56d8f0cdcfaea94069195ecf9cdd73002f274e2bea00b2159da76c0fa8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294287, "uuid": "a162f7da-d9f9-4213-9d67-e31e5733a368", "comment": "Malware payload (Mirai)", "value": "13eda1b94d47810470efb4e10563f5d82279cb2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294287, "uuid": "140d8e51-446a-44ec-baf8-f5c0a0b29bb1", "comment": "Malware payload (Mirai)", "value": "756d9ae8e0376938ed3f9627bef2e8c37181c409ec067b71af92be267ede121a377685b98609222b64986e12eb72210f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294287, "uuid": "1b1fcc3d-2303-404d-82fe-05a7d8ab6036", "value": "T16453F881BC91A63EC6D023BBDE6F114D335197E8C1DA3613CC180BA5B78A81F4D57B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294287, "uuid": "95f41425-da24-4e66-a496-1767e697b659", "value": "1536:cYkzSB76QJ8ViG3+XzCoR+wXWHIVdhHz6u0DPX51ti33:cYkzSIQJ8ViGsAtHIVSub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685294287, "uuid": "61d71680-7fad-4348-80a2-90f899889b51", "value": 62820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685294287, "uuid": "2ab360ef-089d-4f53-9eed-9e7f99ddd234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294287, "uuid": "8ce6ea48-7f5a-4fa0-b37e-3f7729c9f332", "value": "a8e5440d8ce80f8a26a47620e6ef7633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8607643-fd8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685302547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302547, "uuid": "f21a8178-f536-4d36-8b0d-93e2483a4f9a", "comment": "Malware payload (Gafgyt)", "value": "93bd1e2c8e2057dd97045da48042cbf1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302547, "uuid": "a1f2c971-8052-47b7-ac07-e9d0af5b759d", "comment": "Malware payload (Gafgyt)", "value": "b332827189f9b687fc7a8bc2320c1f61f1098d36d2222be328f0d7df01f29f16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302547, "uuid": "d1462630-ca0d-4abb-b730-143c7f9838db", "comment": "Malware payload (Gafgyt)", "value": "f5750771dbab5881496844b332d1cc561f45904c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302547, "uuid": "04315e3f-51a4-40ea-a528-1c147f5c030f", "comment": "Malware payload (Gafgyt)", "value": "7f650504cc2a15a2804f99c3a578e60b178f886594a4d3e4c43843af9e8a57db1445832728a53ca0fc23c0f7de1dba90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302547, "uuid": "bd1f8618-a234-496f-bc51-12ad2b0aa05d", "value": "T165D31905F460875BC2D217BAB64A425D37231F7893CB33256A34BEB42FE1B981E79531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302547, "uuid": "dc9d3258-fc2e-4838-ada5-6047627cb797", "value": "3072:Sdf+fvEqa9FazYA7IboRhEe391CErktmCQA9FX9aH:ifWEqa9FaNhEe3DrktmCQA9Z9aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685302547, "uuid": "0547051c-3b19-4db8-a43e-b2c5e976e97b", "value": 139585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685302547, "uuid": "6a067d02-d3db-408e-9a4b-a6298797a078", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302547, "uuid": "ad45cc53-addf-4056-872e-98ac16200841", "value": "93bd1e2c8e2057dd97045da48042cbf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632c74b3-fd33-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685263266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685263266, "uuid": "03737144-4f62-4e23-8878-e3367a1e027e", "comment": "Malware payload (Smoke Loader)", "value": "a29c587c678826f4a44cf6a2a78599f1", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685263266, "uuid": "580fe0b9-6095-4f61-8725-aaddb9d8ab88", "comment": "Malware payload (Smoke Loader)", "value": "b3fbcfd775b7c9bfc5b58f5df13eb8fbeb4844d98756f8fca41b63f060ae5132", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685263266, "uuid": "ee3c6ae3-c3bf-470f-80e0-4a207b5e319b", "comment": "Malware payload (Smoke Loader)", "value": "92ea36730fa1f19300a27ebbb4d1359e7b8a16de", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685263266, "uuid": "d79805e9-a37a-4595-a7f0-7bb15d457d0d", "comment": "Malware payload (Smoke Loader)", "value": "146f9054754aeb03c38f1cf69fac03543f7feaf7d1728201f017f3f21814298e82567b988208c2521f420d0bf09ff4f3", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685263266, "uuid": "a6f76f01-94a7-44e2-be1d-1628719007de", "value": "T1F154185382A13C55EA668B768E1FC6F8761EB6718F5D3769321CBA1F08B00B2D173B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685263266, "uuid": "6e9b2159-648c-41d7-a5e2-0d28a4f45dfa", "value": "2d9ed3462f8a74bfd1231e2e9de56b43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685263266, "uuid": "5d2bb999-6f75-429e-b5f4-e2558afbc053", "value": "3072:X6JOiohJ19MbvuzdRE45nLtn5gFTti91:yOiY9T10FTti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685263266, "uuid": "bf0e8373-4e1e-40ff-9f91-c723b191e66d", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685263266, "uuid": "fbffe6f7-85b8-4cb5-b745-de879f2097ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685263266, "uuid": "8e62a95b-4df1-47e8-b6e2-e87ff5e1fb68", "value": "01885599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "230b3e29-fd72-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685290217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685290217, "uuid": "f4909b0c-56ba-438e-b121-2e21cc76477f", "comment": "Malware payload (Amadey)", "value": "7f7e209cd745eeb68056d108edffabca", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685290217, "uuid": "3532ca00-326d-4c3c-983b-ff064fdd2d2c", "comment": "Malware payload (Amadey)", "value": "b6ca2afb1befc7662c717f49f70856bc3b1ddb44304ff28ec90e0bbc298ed4a7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685290217, "uuid": "5a6ad392-78f5-4b5f-bdbb-ae273a653714", "comment": "Malware payload (Amadey)", "value": "af993fc614e670ecf3f47d93f217011810dd476b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685290217, "uuid": "78a5b05e-11e7-407b-8fd0-f9b6aa6477f9", "comment": "Malware payload (Amadey)", "value": "a28cfa664c77a084294db3ae90c4bb9a99f12fe4ef950a0ebf83f11120898c31d760a086b84d0108d7bb210c0ed371fc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685290217, "uuid": "af41dd9b-e800-463d-9c56-4fb3702f26bd", "value": "T10C05225BA7D84033E9B91BB015F203E31F767C600E764B2B678698491CB32E169B137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685290217, "uuid": "40208822-cd26-4550-80ca-5cace9e85259", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685290217, "uuid": "8227511e-20a3-4aa6-b5da-31d60595fa36", "value": "24576:Syy8rkMvs0y+RJZEVgPfUjhDF0/F3uMx:5Hkgs0y+RJ9PszyFeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685290217, "uuid": "2d39b9f7-568a-4e92-a844-6b3ec60ed518", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685290217, "uuid": "8b7cc57f-abe2-47d5-aa04-163747496024", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685290217, "uuid": "270d8e8e-6241-4734-a29e-32749ca03d74", "value": "7f7e209cd745eeb68056d108edffabca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e3dad3-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685300392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300392, "uuid": "d5ded7dc-ecae-42ab-a943-7fb3caf916db", "comment": "Malware payload", "value": "b6d6ce9ef1dbe9207ebe602326694452", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300392, "uuid": "9123bd9a-4b8f-4539-b913-b484da545e66", "comment": "Malware payload", "value": "b7beabdc515d5cbcfd135ca84262683eea4d76d9a1adb5f41721d84bded90355", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300392, "uuid": "10a9eab3-6deb-43f3-af9b-04000c8ddedc", "comment": "Malware payload", "value": "96511d150472dbe59355bbfb78099215cd791eaa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300392, "uuid": "669263b0-5371-43c8-876b-edd56c2b898c", "comment": "Malware payload", "value": "3894ce63bebff2715d9e410c815b275d9ed5bcafe3862275e1723bc112f7fc3a2fdb5b51162794c12f9b5c1dfb2ecf81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300392, "uuid": "de26ea8d-218a-4bd3-9f35-45cd2fbd5542", "value": "T11C337B77E46A5E84C086857075249F351F23F1C893932EBB16EAC2B95483DACF509FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300392, "uuid": "f74ac4ef-dfb7-4dc1-9e47-b6ddedf4ad24", "value": "1536:oaini/krGATCWDMKwlGWE81CCVghNn9LT:oVniaGA1Twe81ChNn9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300392, "uuid": "af6b0313-9794-451c-aa30-8a32246e2225", "value": 50580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300392, "uuid": "d7375937-54e1-4416-93eb-ae7a8ff3d502", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300392, "uuid": "3ebe6461-8979-498a-b26f-c24c178e2773", "value": "b6d6ce9ef1dbe9207ebe602326694452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f9565d-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685299966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299966, "uuid": "d62de4f6-55c9-4ace-939c-60bdf551287e", "comment": "Malware payload", "value": "17ae2d787c45a9ce710a08ad277f40c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299966, "uuid": "223f142d-7ac5-4ba6-97bb-6197e3e244ef", "comment": "Malware payload", "value": "b7f03ece01177c234c26c4071d7ed332d350433b1a9e40fea0b1de70162fd427", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299966, "uuid": "db379beb-3785-4514-85a3-6c9ee7cb2a0a", "comment": "Malware payload", "value": "753f26e7e9aa02d834c1e32e985bc63637b5061a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299966, "uuid": "5a795c85-d020-4b6e-8fc8-e6d00f571f31", "comment": "Malware payload", "value": "d10403f9670fc6f14c10499d1107ae7c2feeac5e8c3b0a79cc740beaf06244865a42b7693144583c4f7339c064fc846c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299966, "uuid": "817dc18c-26ce-4779-996a-46593d752c93", "value": "T10293D615BB550FF7DC5BCD370AE91B01348C964A22E8BB367934D828F64B24B49E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299966, "uuid": "7f2c2b83-cac5-4e79-950e-bc4ad4c9215c", "value": "1536:Wrbsboi+EJ8x62036FBdfbHbxEIZmVqGYc1QZ0W3b:WrbQPDL36FbbHqIMS0qb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299966, "uuid": "3697ccc6-833c-42fc-9f58-4da27473a0cf", "value": 88880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299966, "uuid": "8700226b-15f5-44c9-b703-c15898cfe804", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299966, "uuid": "99a14834-fefe-456e-b31d-1721c25a5779", "value": "17ae2d787c45a9ce710a08ad277f40c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066b3f38-fd82-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685297041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297041, "uuid": "6fc55237-987a-4cde-acfc-a2e746fd6fc6", "comment": "Malware payload (Mirai)", "value": "9551425e848d93d791b66a027ee3ee53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297041, "uuid": "2fcb28ef-0335-41e1-ba83-c451ddc3d2fb", "comment": "Malware payload (Mirai)", "value": "b85b81633e60d76dfa7cb8de2cc8372379aea609d25c19fd2269d9d1b67e4bc5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297041, "uuid": "3ad00eed-331f-4e88-b811-42d159e2edb7", "comment": "Malware payload (Mirai)", "value": "75cd23b46b1cba87348491089f2bc9408523d92f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297041, "uuid": "a507c22b-3b72-418c-97eb-0e141bc51366", "comment": "Malware payload (Mirai)", "value": "bae2f7628ffd58114d0a3069f39057efdf0c7e31c48af2843d2a4433f85899020c763511865be942fc3b98e86e1a43c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297041, "uuid": "4ceebd82-01ee-4608-b00f-d81d9a10536a", "value": "T1F1237CB298FAADD4D148C674A9248A780B53E402C6472EF95A4AC356504FFFCF62D3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297041, "uuid": "d89763de-e849-4b42-adc4-7bed2a0c741d", "value": "768:UaKtUwth8ANVYhxneqCBvV9grHnl/fLiMd7/qBDCIm4owE4JCr2Am:UaUUwtO1MErHlXB/qBDewBJCr21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685297041, "uuid": "1ca663c8-07ca-4d03-a02f-2562bf3bf13c", "value": 48784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685297041, "uuid": "a602700f-2bb7-4a1d-98bb-5b7ee24bac02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297041, "uuid": "5bb711b7-3ebd-4fc3-8249-de9de9b7472a", "value": "9551425e848d93d791b66a027ee3ee53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9dcaf1-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685300351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300351, "uuid": "3ac1cf93-57d9-4604-b48c-e698c5b9a3b3", "comment": "Malware payload (Mirai)", "value": "f5e56f8ed4b5cd04b5907c00913fc7ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300351, "uuid": "d989fa73-a272-4336-8ca5-6bb63e2d2a6c", "comment": "Malware payload (Mirai)", "value": "b8c33f10e796da59377f058edde77c1e17194f6b4e66fc71f279fc5634639007", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300351, "uuid": "186b96d9-f4af-4868-a936-0436d3d3190d", "comment": "Malware payload (Mirai)", "value": "3ac6dc0b6a007f37b38e7ee0c6e8cd195ab4e8b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300351, "uuid": "50326161-431b-4eda-94a6-5e0287f8be97", "comment": "Malware payload (Mirai)", "value": "749f23b044e8b432d960651069c7a469001e42621bb9cb1505c17994d9d505b855c0d6e5384621b62ae31caaff74c066", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300351, "uuid": "65f380b9-b75f-445b-a1ff-50a4552090da", "value": "T168632881BC815623C6D5127BF66E02CD372627E8D2DF72079E225F2037C681B0E37A96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300351, "uuid": "a7b31275-f4ee-4711-8619-82425bf56b35", "value": "1536:HeCaOmX5HOH7IBMnvLLWHwb/yAM8F1TgUeq1QMy96e4vQWz:+C86KwG+FgUeq1bW+QO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300351, "uuid": "85c52e3d-acb5-4b23-a993-a4df3252ce98", "value": 70972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300351, "uuid": "ecf4705c-f29d-4c39-9682-0d7affc30bc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300351, "uuid": "63e5b7fd-0dab-4897-ade2-8ef829152123", "value": "f5e56f8ed4b5cd04b5907c00913fc7ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db331417-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685300404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300404, "uuid": "5f8f609a-598b-4097-8878-506b514ee383", "comment": "Malware payload", "value": "3775794fb838f879e0f7f0328966fa15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300404, "uuid": "f15f58b4-e736-4009-898f-e63563d741c6", "comment": "Malware payload", "value": "b8d9b800e81acaaf9777cbb8eeef2c1457aa5f4cbe3f6d27865519bd9a6f2e44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300404, "uuid": "45dc942c-35e6-473b-8f40-db5060ba177f", "comment": "Malware payload", "value": "b9785a2b072d0c9386271a648c0b2cd6618d9f40", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300404, "uuid": "5a39010e-bbe0-4be9-8a7e-2bad6195e01e", "comment": "Malware payload", "value": "5fbaa5821d1df0a6a46a49f6745fa852f0190504f3dd69d05ad188cd83e1e0be912acf7e44d18a5d2a379f48be1f106e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300404, "uuid": "b33ae09d-50ce-4af9-8f59-cd7d4459ee7a", "value": "T14C434A02B31C0E47C0A31A70263F5BD097BEE9D022E4F689311E979A9671E375586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300404, "uuid": "0347b023-d0d6-4363-9c6e-e3f6b79ba97e", "value": "768:EbpJYxjEJf68CRZGRloQUEqde5POkdUUF9umfSmi1j5GMI4gJGcFRxtafS+wn9IK:q/mqzqQPJ2GuSfi+MI4gcAxgfGn99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300404, "uuid": "af0f2fe9-c9e1-44fc-8ced-66a4b58fb366", "value": 55160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300404, "uuid": "d30a8a20-fbda-4228-931c-ecb2e2d02340", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300404, "uuid": "b8ab9ce5-6108-4274-8e9a-a972b2d3831f", "value": "3775794fb838f879e0f7f0328966fa15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986c1e54-fd8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685302869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302869, "uuid": "2c529b7b-b860-41b1-8487-143651e99bd6", "comment": "Malware payload (Mirai)", "value": "16cda1b175013f0f920629f8b5182a2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302869, "uuid": "a943cc03-6fad-4c13-9f7f-6f037adbac54", "comment": "Malware payload (Mirai)", "value": "bbcc69a6b93928a3832ed2f9652cf67680a992a58ffaa3e04e87fd283126fed6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302869, "uuid": "f652a771-f969-4f18-a801-1e4c666e3204", "comment": "Malware payload (Mirai)", "value": "8bcb8e0d8eedf30ab7a02322b00be1693c00ea9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302869, "uuid": "af35f140-0ceb-45cc-984b-ca3d76a477b0", "comment": "Malware payload (Mirai)", "value": "be6ec3661460e5b8a3e71b9dbaea7db3515a3b4f8f201d14937510671673fa4239b31db099acff50e39bb9625e86614a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302869, "uuid": "0495f2cb-8b56-4460-b7b4-f7cf0677847e", "value": "T12164D08AFE01AF25E9C026BAFE5F034973634B6CD3DBB111E620972936CA55B4F76044", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302869, "uuid": "ac0007e0-3a71-408e-b136-ce16c66b4fd9", "value": "6144:p3lOYoaja8xzx/0wsxzSiG5wKSDP99zBa77oNsKqqfPqOJ:p1CG/jsxzXGDSDP99zBa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685302869, "uuid": "5b6fd926-ee8c-4816-b8d5-ca00fc272853", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685302869, "uuid": "69ac19e5-e7ef-40cb-acfd-b6bf74d0ef17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302869, "uuid": "2b396312-dd5d-4d0e-9558-adcb883f4bf1", "value": "16cda1b175013f0f920629f8b5182a2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2abb3fc-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685300417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300417, "uuid": "9ee90b5e-fb52-4eb5-9e25-7d3386d8a1e8", "comment": "Malware payload", "value": "9676edc38a208d20699b0e8b0e234fd9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300417, "uuid": "a711644f-a18a-49d0-b3ef-b52b0d2e0981", "comment": "Malware payload", "value": "bc1bc6682dafedec41a62e1bfb856e937649f28d31d40558889627aeb15ddde4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300417, "uuid": "8a379060-79aa-4824-949c-2b29b296975e", "comment": "Malware payload", "value": "02442fd39d5485a234c829ac15311dec2d8f291a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300417, "uuid": "6630cb5e-dfc1-46ee-8269-f39a32a739ef", "comment": "Malware payload", "value": "15c6481a72db9f9a99cf94247912af15ee2f4e3153dabb29b174aba8ad5cf7c37a7052c390717235e51c8acd3ca5d241", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300417, "uuid": "15e0f06f-9e54-45ed-9def-f40f60a0b10b", "value": "T1B0433A31BA760E27C0D1A8B661E74B25B6F543DE26E8CA0B3DB10D9EBF705406503AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300417, "uuid": "1ff93ef9-7b75-425c-b195-a25bc8a76ba6", "value": "1536:fvf20dYmgHg1We/mrYe6RQW+75MUtydNrA:f20K5G+VM1NrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300417, "uuid": "97fcfad7-0173-4e58-8529-5b47710d6aa9", "value": 59864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300417, "uuid": "6c5ad3df-ffc4-4985-851c-689721130010", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300417, "uuid": "518ce910-2bdf-43a1-ae9c-70ea668b9e34", "value": "9676edc38a208d20699b0e8b0e234fd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2340a281-fd28-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685258435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258435, "uuid": "f96624a0-d16f-4a0b-9d43-022b5df45e25", "comment": "Malware payload (GCleaner)", "value": "11b8d2f1c1da99d2eec370ecf4bca6fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258435, "uuid": "01b54dae-d576-46c8-b7cb-54bb30c8d705", "comment": "Malware payload (GCleaner)", "value": "bf9f1faeb5ffafd35851df4a42f7a486ad0b2eb3f77ccc943c4cd21d1a75e3c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258435, "uuid": "41a0f76e-a3be-4df9-8d1d-0d9c2f871f07", "comment": "Malware payload (GCleaner)", "value": "de11984271c74e9169237fa9d4391b17e871b23f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258435, "uuid": "cbc8178c-2056-45ae-ab2b-4f9c308f3727", "comment": "Malware payload (GCleaner)", "value": "688e959055822cdad0c914f9cd8a755cff3ce6da913834f1ddbc7063afa4a8770f8d694f2562180118926ee89ed82ed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258435, "uuid": "53469da9-647d-4a5b-8367-0c24c316422a", "value": "T161847D4396D2FC54EE655A729E2FC6EC365EF6508E183B593228AE1F08712B2C173713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258435, "uuid": "1ce405f6-aec8-4210-868e-aef10dc0ed6b", "value": "d683fcb523ac92743f5db043ced73806", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258435, "uuid": "fdcdeff0-1d82-432c-99cf-87006bd389a8", "value": "6144:bls/DTNiyXaYJczQRmImjkj/Tjrtim4EeOoP0/:pi/QIaYJIQcX6/JimP9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685258435, "uuid": "c0217829-bc9a-48ee-90f0-35e1b80e5a9f", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685258435, "uuid": "6252e128-92c3-409a-b308-d9b873a3b442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258435, "uuid": "a5c9d6a8-3c5b-4227-9a67-7ff703db0724", "value": "11b8d2f1c1da99d2eec370ecf4bca6fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0644e56-fd6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685288414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685288414, "uuid": "2a72cdb2-1b54-4e7f-93e8-e29ae8c7d83f", "comment": "Malware payload (RedLineStealer)", "value": "85ced253fe1a2f6f2d3a9a5afbcc35a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685288414, "uuid": "766f3923-b118-4871-9820-7b528f220dc4", "comment": "Malware payload (RedLineStealer)", "value": "c012744e4051ccffcf633f8c7b79838447e91062d0c77b72685d761f0059cf08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685288414, "uuid": "af121e50-5d0a-4f72-b2ff-9e2adf32fd8c", "comment": "Malware payload (RedLineStealer)", "value": "ea1ef069406d59732b9a5b1f7474a69adecdfd2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685288414, "uuid": "0256c972-ba75-476e-80d2-c775b44bc909", "comment": "Malware payload (RedLineStealer)", "value": "8fd5994bcdc163990c0b3d250c61f41540e2c5048553243589227c75d569a92d9156b62653bc2e79a8c734f2b32a62a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685288414, "uuid": "ea58f58a-1cdb-47f2-ac45-e9c8b12ee128", "value": "T1FA0522669BEC9831DDB4237068FB17831F3A7C611D34872A328828560DB3BD16975B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685288414, "uuid": "0e94f494-1918-4d75-9286-b2290b059179", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685288414, "uuid": "eff03d96-0123-4102-ac45-520b9f9071e4", "value": "12288:eMrmy90jESOLE+dESTeERWkQkP3c8ONtilQv5HYoRnfO+S+rIr5STM02qKG/SAaT:EyaE6meEAkQS3clNtU+4oRnWMDZr6Ai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685288414, "uuid": "c1d6427a-bef6-4130-ae66-997e7d8bda71", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685288414, "uuid": "0f29a423-d482-4741-9888-9d24bce35a0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685288414, "uuid": "ab9e20e2-e0b1-47dd-85e4-00cc947843e7", "value": "85ced253fe1a2f6f2d3a9a5afbcc35a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db581c9-fd7d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685294906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294906, "uuid": "0ffbccdf-8a21-4265-bebb-64b5c32ccf34", "comment": "Malware payload", "value": "b4b84decc017efa8cb3e191d864d6f1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294906, "uuid": "481078f5-3890-46f8-a1da-4ad6dedeb4b5", "comment": "Malware payload", "value": "c040dc2a52208b4ceb487a5d9ef469a4966f4787ba4d27d01c6074c48f017642", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294906, "uuid": "3be1f19c-bc4b-4f63-ab46-5e6b0eb98f0b", "comment": "Malware payload", "value": "c4d01a4d31cadaf8829922fd4e342440fddbeb94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294906, "uuid": "14541aed-c5d1-454b-97c2-a4f6b61e3ded", "comment": "Malware payload", "value": "370cb530868ee3df8a62b2d02b9b03c6e75e487cb53bfdc5d426e89914eaf10bafab324961ea733bd2907a1bf441de34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294906, "uuid": "711ff688-4b00-4a2b-8c93-13233c686c90", "value": "T1BCD6F14AA7BC00D8E5A6E079CA279A0BD6B2BC455232C78F01E4775B6F737604D3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294906, "uuid": "044fa77b-3ee8-42e9-a4d4-36b577de31c2", "value": "88f0a4a0f003858cccf998a5b9be7b4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294906, "uuid": "bfc0ba0d-d0e7-4c29-85d2-9d793d431242", "value": "196608:2+MdpYwfY8+X1333jAYHcKHZOVlBfXSunq5b9Yq3/mfLRlpLfFLOyomFHKnP:Hw6cK1nzDHcK56Lhq5/3kdX7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685294906, "uuid": "2e816040-3f6f-4c7c-80d4-6bad85dcb17a", "value": 12840960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685294906, "uuid": "ea549ea4-8325-444a-a4da-de3ac60c6955", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294906, "uuid": "573158ab-6969-41e9-8283-10ad392e8466", "value": "c040dc2a52208b4ceb487a5d9ef469a4966f4787ba4d27d01c6074c48f017642.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a1eafc-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685300400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300400, "uuid": "2c629b07-7eb8-4955-9f25-c7422ea6c2ec", "comment": "Malware payload", "value": "9f320d07cd49c2628a778d02fb08626f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300400, "uuid": "d123342f-aa21-488a-b41b-7139c64f5f01", "comment": "Malware payload", "value": "c2a0ec9c9f4c9fc77c7955ded5f101d91ba0290dfd3b7021ec83253564ad2b4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300400, "uuid": "ac8aa854-0b19-4f52-a614-537a3b01cf44", "comment": "Malware payload", "value": "230679dd2ad93c0447a3aeb55b3e30239d01f468", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300400, "uuid": "53241d93-0b23-4951-b13d-926e8056e854", "comment": "Malware payload", "value": "0fe786795da2c7585dc96d730be7a4a26cc0470f671e44fce1d37158cb3e162bcd4deb911b15b47a8d93d0a5371214ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300400, "uuid": "12f97191-c554-4584-abe8-572123b8542e", "value": "T16763B61A6E628FBDFB59833447B78E21AB5823D527D1D641E25CD6002F6034E681FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300400, "uuid": "26bb992a-23e8-4709-b757-e5b1fda361b2", "value": "768:bPWek0n4CjdGQKKWgmg0EhFkFkeYA+QotFXyApGqFDjOZ2uyyQ5NeNTP4wnRIZ:bj/hTmmjAotdym2Uu6eBPZnRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300400, "uuid": "970ee108-a25d-4493-85bb-f0ebb47c4752", "value": 72628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300400, "uuid": "849f9e02-64d4-4b35-9ca7-8f69f27e3bb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300400, "uuid": "0ff8fe30-444b-464d-aba5-57e62efee608", "value": "9f320d07cd49c2628a778d02fb08626f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0fad72e-fd66-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685285382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685285382, "uuid": "7721f92d-b57d-4bb6-9427-d0e58f83ea48", "comment": "Malware payload (GCleaner)", "value": "9e571dca867c875c920f5b9e75181bc3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685285382, "uuid": "b3cd9c83-096e-4bd8-867f-be2997a9ea8b", "comment": "Malware payload (GCleaner)", "value": "c34601c5da3501f6ee0efce18de7e6145153ecfac2ce2019ec52e1535a4b3193", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685285382, "uuid": "c0a6a523-14e4-4322-9603-f87f18e37a84", "comment": "Malware payload (GCleaner)", "value": "a3982289e746aedfc04ff3f96fac3021669d9007", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685285382, "uuid": "a5dba312-6b6e-48b4-b92f-5bf467c2dbe2", "comment": "Malware payload (GCleaner)", "value": "a562dc8055d1502519ee1cf7bf277001281c440609569a3cd28b9be3b9f06d5be79aa003d23abf695eeecd9072bd89a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685285382, "uuid": "83b74e31-c1bb-45e3-a860-d95319c89563", "value": "T124A53351971B463AD2A28B79DC9A404CD817FD3684131B7833BC3E5DAFB76381C06A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685285382, "uuid": "db418113-6e03-4cae-bd34-89ae84bc2d83", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685285382, "uuid": "92603e91-f963-431b-8b0d-1e6f43072dcf", "value": "49152:iiWAHfYiKeoyopaRCSgQU9b0chuziYpRFeKOCs8wu8:iiZwiR+pzCUCchwNsKSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685285382, "uuid": "41f9cd86-07b7-4b91-b932-b266811972e5", "value": 2172526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685285382, "uuid": "6534e74d-229e-4ae7-acab-4b44308db8f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685285382, "uuid": "c2b8e698-102d-4c46-907e-0b0408feab65", "value": "9e571dca867c875c920f5b9e75181bc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2b0750-fd33-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685263260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685263260, "uuid": "279e4ba2-f4b7-49b1-a6e1-dd01aee43c45", "comment": "Malware payload (Smoke Loader)", "value": "3d8207e1ce6762ff10db118bee3bd99b", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685263260, "uuid": "1a1ae3e4-c886-40b3-8073-d829be18c58d", "comment": "Malware payload (Smoke Loader)", "value": "c38267836dde53953018c962a372e8e74153f97932418b682fc653ecfcb7bece", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685263260, "uuid": "545a3f6e-9c3b-4ba8-b734-a04ceb05d6fb", "comment": "Malware payload (Smoke Loader)", "value": "82a02d6e00de00074b48ba3cc76424a6efe3e6ab", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685263260, "uuid": "fa89245d-9f3b-4917-acc9-b250a2b13a17", "comment": "Malware payload (Smoke Loader)", "value": "354786512c09fe604a668cf1b0d953e4e8824f2bcee412de93bd1d3d5951ed51e2bf88274712f24481591a18296a616a", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685263260, "uuid": "70560670-0933-4101-a062-7d6b5261e3c9", "value": "T1E7542A1392A13C90F9264B769E1FC6E8B65EF5708F197B69325CBA1F0872172C273B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685263260, "uuid": "b394be67-c7f8-4734-947e-e01c645e35dd", "value": "2d9ed3462f8a74bfd1231e2e9de56b43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685263260, "uuid": "1f61159b-e2ba-4c76-a02f-d669537dcd2f", "value": "3072:1nsNTcFBW0dKNogILXJ6WPLpjHysySMX3YpCUtn5grTtiFmAevZ:qNTcddpgInDtHMn3frTti9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685263260, "uuid": "0b24a4d0-e3be-49e6-8039-840503ccea69", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685263260, "uuid": "f482aae5-5eab-44d6-851b-f869e11aa258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685263260, "uuid": "a9bc1d37-bcaa-4a6d-a161-9ff2d83bc5d1", "value": "01860199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2eda32-fd33-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685263335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685263335, "uuid": "dd78aa49-5304-4197-b15a-6dd5a40812e3", "comment": "Malware payload (Smoke Loader)", "value": "6017e7c6f19de9e3b0aae0965fe25603", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685263335, "uuid": "d495138c-cac2-4fed-b61a-02910b91ca6b", "comment": "Malware payload (Smoke Loader)", "value": "c421418b410ea4bf78ef47c8edb75c8fc96220043573ba6d8268bca900a4c041", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685263335, "uuid": "ba45a34f-6d5c-4290-9045-021a9090c161", "comment": "Malware payload (Smoke Loader)", "value": "605250b6dabafb86252272b757a1713078c6ae79", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685263335, "uuid": "5d496e10-3ebc-46a4-b9da-e538a88f93cc", "comment": "Malware payload (Smoke Loader)", "value": "7add9ee081c456c228c3efcabb0f93a78c2c95aba1c2d8e7bac9c1c764f6fee1c199e94eb9b47d2aecc2970be57b6e6d", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685263335, "uuid": "a449fa83-8d49-4d9f-8835-ed62c03bc81a", "value": "T1BD543B1396E2BC54FD668B729E2FC6EC761DB1A28F19776932184A2F04702B2D173713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685263335, "uuid": "62f90c09-aeb4-41e1-9d8b-37709a6c5fb0", "value": "d302e4ac3406067f8ed838633897aebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685263335, "uuid": "e8de1a7e-ebae-4a9c-82d1-0ccbc9b38185", "value": "3072:kKAuVGwBlcQlbzjmj7FHmfuzv+ippcQPd5gG+LGvAcYWt:9AuVGhQlbzUw+5XcPGmvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685263335, "uuid": "f8cf876d-c6dd-4aa7-b1a0-980f1e4cfa83", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685263335, "uuid": "60dfa946-1444-46ef-88b7-edbdee6d9706", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685263335, "uuid": "1e52b7f6-49ca-4360-9102-3d60e8d3fe4c", "value": "02107799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a1f0be-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685299642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299642, "uuid": "a5e9c803-06b8-448a-bbe2-05e681f1fd0f", "comment": "Malware payload (Gafgyt)", "value": "9cc572027940d5af11e097052ab2cdc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299642, "uuid": "199aa648-670d-46f2-bdd6-8dda1cb136d6", "comment": "Malware payload (Gafgyt)", "value": "c4218f2f52d9271d7abe42d68bd8555f125589ebd857c53cc77d9b00b385b8a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299642, "uuid": "c4a25249-496a-46ab-bd7d-41a2af60a1fb", "comment": "Malware payload (Gafgyt)", "value": "fc2667c15ff48d1f2f7c55f82f4ecddd247bfb17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299642, "uuid": "a7382da0-6535-4684-ad13-51e805b51fef", "comment": "Malware payload (Gafgyt)", "value": "8d6f78e32b9925ddc4f8a75a0a8089f3e3f3e621abc2337c0365402641dca7f1630dbd7a8213c9893c4ba3b0ede665a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299642, "uuid": "015b9477-1a74-4015-ba88-df263f3cd868", "value": "T12FB31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299642, "uuid": "000c1745-fdc6-4b57-be7e-6cd463848ee0", "value": "3072:qd0weSAewzi+Xn+8Uhw6W+aP8JmDk1c8xF6KjW:rfO8IBRJmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299642, "uuid": "500c7c6c-2faf-4c4b-bac6-8a925d5618d0", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299642, "uuid": "62a1ea78-725d-493a-bbe9-7cd8929fc546", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299642, "uuid": "15e9a0b9-a9e1-4fa4-a10b-221abf6e1017", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6643d1-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685299921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299921, "uuid": "c2ac666f-f713-4ead-b14d-988431f412ba", "comment": "Malware payload (Mirai)", "value": "d4f30089336bc305b12128cef43104bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299921, "uuid": "6a39e913-4275-40b4-9b83-4a1c00a14b54", "comment": "Malware payload (Mirai)", "value": "c42c74d5e82e775cfd73209eec459b4d456f57f6ca9e1426a84aa4d04166c97c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299921, "uuid": "88b4429a-ac79-4df6-8520-2cecf081acc5", "comment": "Malware payload (Mirai)", "value": "48eb405fd22e909f06b511ed78627a05daa8a129", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299921, "uuid": "8c907668-c4cf-4664-a443-c5022e047732", "comment": "Malware payload (Mirai)", "value": "07397ee49d0b214a4bb848abfa1e12e8b7d599a39cc7c9ebd333f2eac2dfed252e501809129b2aff1ed0251db5b0b068", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299921, "uuid": "8572e766-80a2-4380-a0d9-0be2276c60b8", "value": "T106637EC9E287D8F6FC1705702036E73BAE71E0AA211CE696C778D5B1FC86941A117ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299921, "uuid": "47d066d6-8fdd-4445-a808-af4306cc0550", "value": "1536:pnUQJZdRlDAXO6QyQUK6+QGpxMx97qJ7RvsuIr5bhc8V:pnUQJ7RlUXTQpUK6+QAxMn72+uWJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299921, "uuid": "2532abfa-04ea-41fd-bf6b-74b4bf2d17af", "value": 70736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299921, "uuid": "c895f015-859f-4c08-af45-8f8dd0cd5653", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299921, "uuid": "9f41a302-3b6c-47ae-b813-484f7fab060b", "value": "d4f30089336bc305b12128cef43104bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908ca037-fd7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685294266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294266, "uuid": "fd9a517c-3b00-4ebb-8775-2f67cc41a205", "comment": "Malware payload", "value": "c0b0b22aa44636c9e843af16a8108ee0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294266, "uuid": "b1e6074b-9b45-4526-b9ba-6ea3ecdc28f5", "comment": "Malware payload", "value": "c56013cb5add8122420066b42e507504d22735a64baf29137c5da40c86dac9a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294266, "uuid": "932e35dd-519f-4591-9d6b-eb66b8e68f93", "comment": "Malware payload", "value": "252a5eb2054c26d79f06382e21319471668bed53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294266, "uuid": "7162ef95-7cfa-4af8-9cf3-e4e3131b6680", "comment": "Malware payload", "value": "24ef03942e230fd9bb9b6e61d05aaf89a190bdfeadca6aaaebda65cf5bb97f81a5fbf948dd30f62262677d3c40050716", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294266, "uuid": "c29724e7-ffd3-418c-b674-25bd6303cbd1", "value": "T17514C781B2618EBAC9464733B21358B81111FDF54637C2EAFB9F6D707D85B907738AA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294266, "uuid": "67b31571-f869-44c7-aab4-6e1867ea5b98", "value": "6144:EBFUVtXoQbjretJ8aZJT2vxwmn1950e8I8n1:EBynB7etJ8aXT2vxwmn1950e8I8n1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685294266, "uuid": "7907a8ef-b158-4d0a-a6f9-21a8c5e8975b", "value": 200289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685294266, "uuid": "055b8208-5790-42dd-9309-048f83d60fde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294266, "uuid": "59f4d080-cf88-4272-b41d-9644dae73ebd", "value": "c0b0b22aa44636c9e843af16a8108ee0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8ff107-fd7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685293969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293969, "uuid": "408e16d9-3b16-48fe-ab57-68f21676a6df", "comment": "Malware payload", "value": "aa3e7700566a60713b4fac883be20523", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293969, "uuid": "e05a6348-af11-4b90-8f6b-d60fae06d958", "comment": "Malware payload", "value": "c66c6a0ec037683adc3c24bf21b45863819a6ee87aaec3ced692858ce780c3f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293969, "uuid": "c133152c-dfec-4c6c-bba6-998bf7c22346", "comment": "Malware payload", "value": "03d5fdd52ed4a659ef1d5e8376e61c2a1b040211", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293969, "uuid": "865e1877-88b7-4205-852a-bfee0cf2b9f9", "comment": "Malware payload", "value": "364475f3b4b0061999bce4fa3de366de573d9893b6fc84e4a7742edc427acdbd2b75f4dafc4f41f5837ec58d8bf2630d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293969, "uuid": "3c1cb37f-8763-40a6-97cb-6890f284d0d2", "value": "T1A724F8027C704E79C984C377B1D30EB01245BBE0467BCEF6AB9B5D603D866B6722DA64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293969, "uuid": "b822d959-bfac-4024-839a-ce20daaf02fd", "value": "6144:Q3diTc8/w7ietJ8ajANEVd1giw8FTm9H9hU/IIPg3:Q3diI57ietJ8ajA7N8Nm9H9hU/IIPg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685293969, "uuid": "eddad5d1-0e15-413e-bc6e-6e521280ec06", "value": 216184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685293969, "uuid": "a269f762-0752-493c-9ca8-fd265bed99c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293969, "uuid": "ca480d83-5173-46d0-98dc-6baf88ee7871", "value": "aa3e7700566a60713b4fac883be20523", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ad33f1-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685299986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299986, "uuid": "ce18fa1e-8cc8-4f6a-8c77-3a08c02c5fec", "comment": "Malware payload (Mirai)", "value": "b178c9dbb817863d99df061239bdad5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299986, "uuid": "fbfb167c-a8b7-48cc-a1d6-4f1d2b79e7b0", "comment": "Malware payload (Mirai)", "value": "c9a8e98f6a93e7a185eb9fba3d3e4fb4b47981cb04eb17ca4f8417ad99937ecd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299986, "uuid": "72e3e79e-496e-4141-895e-bc18b3125bc4", "comment": "Malware payload (Mirai)", "value": "4a722b8d3788f03dfbd2084e42a2e9c96c319a34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299986, "uuid": "69160283-2159-45c6-bac8-dd55976b7257", "comment": "Malware payload (Mirai)", "value": "25bace65423dc8c96ed9cb3ea78b3183013b1a18f857414c107836dd6657a7c45aec0d1593bf67b4b73c6063218268e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299986, "uuid": "5c01658b-e238-403d-a00c-c1e9397e588b", "value": "T180E32B56EA418B13C4D61775B6EF424533239BA493EB730699287FB43F8279F0E23A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299986, "uuid": "d6f401df-cf56-4096-b368-406984417896", "value": "3072:TdRNpgjix8x7ma7vzj4dxlQhENQIld7MXb15AM/9tD8ygW:TdRN+i+1ma7vzj4dTQhY/7MXb12M/98W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299986, "uuid": "dbf41dd9-3e18-447a-8791-57398f54ed2c", "value": 153594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299986, "uuid": "089e189a-2a0f-4062-bca2-5829e02421e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299986, "uuid": "149db219-d9a1-46e9-8c52-913266b81765", "value": "b178c9dbb817863d99df061239bdad5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e566496-fd76-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685292142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685292142, "uuid": "bb7d8f47-44b8-49bf-bea8-a3354eb40b1a", "comment": "Malware payload", "value": "4c1bbe87ee4ab42478c8d11e5bb42ebf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685292142, "uuid": "e273a2fa-59f1-4db4-8481-980aae340f31", "comment": "Malware payload", "value": "c9e867da8945ace03fffb15fb6c8b73e556131b3e7ceb652ec2f3e36bc26ca66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685292142, "uuid": "cc0bb4f1-a4a0-4b06-9ea5-2d704874bfe3", "comment": "Malware payload", "value": "01911b9c7b596872d3bf53cd6924c7f917799d90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685292142, "uuid": "390b1755-fadf-4cac-a32d-1275b9079a15", "comment": "Malware payload", "value": "fa4478e54af58f1ae4e87a5906e38b498f86f6c44861425265a4c5ea132a654ef7f836da57117c6b55c4f853db1b4404", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685292142, "uuid": "58ae7fad-e41d-4572-9384-09f3126e20d9", "value": "T1D82612237916614BE65EA83649B3FED831F12E2B9F935874717EFBCC00702615E0BA49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685292142, "uuid": "1934ed96-5333-4085-8108-94ae9efa344e", "value": "a2f5171a69aa0c364fdec613d51f1b5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685292142, "uuid": "b38e5f14-ed4c-4361-b543-d7d9c1c4b491", "value": "98304:mKVgqRNSUVpJgLtclkBCY+2vE79BjrQ/L9nV/7mLY3B31Vs3P3fOj:mZ2NSiJcculwTExV/7p3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685292142, "uuid": "465f9581-7cc9-4d4a-b82b-e3abd3d85dd4", "value": 4612272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685292142, "uuid": "41bb657c-f38f-4fa7-8df6-12cdee8c2eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685292142, "uuid": "de5408a9-818a-49d0-bb22-1c714ae45195", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc8c1d6-fd80-11ed-b3cf-42010a9c0076", "comment": "Malware payload (WannaCry)", "timestamp": 1685296382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296382, "uuid": "9dbb408a-24d7-495b-ae68-091e541879da", "comment": "Malware payload (WannaCry)", "value": "f8db667580cdaa9e33bdd5de9d766153", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296382, "uuid": "5174a1b9-d466-4fe7-9e66-0c86cf021b8a", "comment": "Malware payload (WannaCry)", "value": "cb11ca7f0afe82833d91792dc891a81088f1605c6cc029edecc21b4f433c0756", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296382, "uuid": "a62aaa19-4b6c-4b22-8cd3-02147867322f", "comment": "Malware payload (WannaCry)", "value": "0c4a662548618bb027191803c93d2bb828d390be", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296382, "uuid": "00754cf2-b5d5-46b6-a854-573cb5d88e42", "comment": "Malware payload (WannaCry)", "value": "838b35f3a465d8e839d359a604a5e2014f93a5f882ddd4c8618129c0011ec07ac10f6d273038e1a8dc12c4fcbdbd6ae3", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296382, "uuid": "79f15846-743e-4f11-8108-e40dd61517ca", "value": "T15C063394612CB2FCF0440EB44473896AB7B33C69A7BA5E1F9BC086670D53B5BAFD0641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296382, "uuid": "1a6e6b5f-69cd-4c32-bf1e-60c6fd976ead", "value": "9ecee117164e0b870a53dd187cdd7174", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296382, "uuid": "096c96c8-65ed-4441-bf32-4ed960d7f5eb", "value": "98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HI:yDqPe1Cxcxk3ZAEUadzR8yc4HI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685296382, "uuid": "c50b4713-bfd7-4605-8afa-dcc931ec85ea", "value": 3723264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685296382, "uuid": "7ae32e26-d72d-404c-96ea-fd5cabf4adfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296382, "uuid": "7ec5803a-273a-4ca8-b527-81aa129b42e6", "value": "05894899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16bf8e6-fcf0-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685234621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234621, "uuid": "109598b1-026d-4cae-a996-2f22709332f5", "comment": "Malware payload", "value": "5aa01d9599ce85353488cc222f36f5ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234621, "uuid": "dc5db222-b039-4138-9026-6ed6139b124f", "comment": "Malware payload", "value": "cb4214bb5bf75b5b1a96233e63b073c293eb680fd96c8b12225e534d7a2caf0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234621, "uuid": "143fb318-c894-47cf-b518-81a697bf34c6", "comment": "Malware payload", "value": "36215fc6ec2c93f404f6ded44ae141b1d74a546f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234621, "uuid": "085c7c91-e8d2-44a3-a28e-8e3cc63cf026", "comment": "Malware payload", "value": "90566fde80d05c9b4183476b9bf02599761f305782cc998a1256451e20adea4c7be5d1e4fd8435355608ec336c06bd26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234621, "uuid": "c22bac6f-e162-43a5-9e86-988fb040dec0", "value": "T16246330863D00CFDF877413DE6E44912D1B678224350DA8B5B78D2674F67AE5AEBAF80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234621, "uuid": "3bf19791-636f-4008-8e7a-a7c7879082e4", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234621, "uuid": "c54f7830-d302-44e4-b711-9138acf30589", "value": "98304:0Gx7uICDtPfeE/joXxJVEq2JI8uupu7wYWx7ZhpTEjZkmI82vxj4+x0tsvd10vg:0Gx7uICteEroXx7EqlbkkwR7VTEJH+xD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685234621, "uuid": "01c2de22-18ad-4e68-8577-248d71df1493", "value": 5842962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685234621, "uuid": "29bea522-ddba-441d-9378-0444844d8067", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234621, "uuid": "2c4e2c78-0cd6-4d0b-b751-bafa5ae8cf87", "value": "nuke.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af4d6d6-fd28-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685258421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258421, "uuid": "78e8a77a-d25a-43d2-a3bd-6789530cb861", "comment": "Malware payload (Stealc)", "value": "84f304e30439cf1f837ed4f31c1fbb28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258421, "uuid": "3544e68e-249f-4417-b0e6-f63e1f0d43f7", "comment": "Malware payload (Stealc)", "value": "cb7f4e286a4a8fdfa525168591131d37019090d94040feb13c8078c4a7ae4b37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258421, "uuid": "16bc7071-ad38-446c-a4e6-f9ba791d3956", "comment": "Malware payload (Stealc)", "value": "257518ece774da6ba53ca070121a206519f0c229", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258421, "uuid": "c5e3750d-3d69-40c3-bed8-fde486007125", "comment": "Malware payload (Stealc)", "value": "ef0c6580acdb997b05a277457250339db9048ff38b41cd946ea1743bb316d19c9eeeca907bc868c6ee9054b1b2891cba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258421, "uuid": "ad08d256-00a7-45de-8707-09bb5702cb89", "value": "T1DB542A0396E2FC50ED668A729E2FC6EC779EF5508E19775A2118AE1F0C702B2D173712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258421, "uuid": "621f17b0-d037-4d76-a74e-4792a7cc170e", "value": "d683fcb523ac92743f5db043ced73806", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258421, "uuid": "84dec3bc-cf75-4954-aa23-46307cabe0d4", "value": "3072:Ad9jDaSlXbBp6mLpIlYUEjOyv+L5bIWw7az/5QtGvAUd:qDakXmmL0CuLhIPtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685258421, "uuid": "4c35fe6f-7d5b-4184-a380-34e69b454800", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685258421, "uuid": "1599cc92-bfef-49e8-9e7b-0babf28cb5b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258421, "uuid": "877010a6-7f45-4a0c-9a56-dd5e4b83bc6e", "value": "84f304e30439cf1f837ed4f31c1fbb28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4471355c-fcef-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685234009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234009, "uuid": "25932d09-c4ec-406e-907d-33a04a43dc32", "comment": "Malware payload", "value": "481dd8a31454f9c44a0627eb6269309c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234009, "uuid": "73c6fa3a-e22f-48ce-af49-6d10c9df46f4", "comment": "Malware payload", "value": "cd26de8bee55c69f5adeeebffa9b4f68800fef2130db35bd6c28d28c70d8fd5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234009, "uuid": "bf264231-198c-421d-b9d6-f877c334d399", "comment": "Malware payload", "value": "a28790eac00394bbcb09d3c4b6ecf2d92757801d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234009, "uuid": "39c8712f-f462-4cda-bda9-e799f0969419", "comment": "Malware payload", "value": "9db351ec7f53df166e450f3919138b4fda2ef91bf92d1363e90ab1956828e90acc4327c55ac46f634724861ee0c296f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234009, "uuid": "70f51d95-9b2d-4275-8db8-9a71d00cec9d", "value": "T1F976330467940CE9F5A3003AE5A48915E0B6BC334750E9CB9B7892274FA7EE57DB7F80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234009, "uuid": "51aba344-acce-43b5-aaa6-5b0e9f76cb33", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234009, "uuid": "beb4ef65-d8db-473d-a359-d529567f4995", "value": "196608:jnxnNpICteEroXxDVfEqlbkkwR7VTEmLEN+x0SumEDlsyP:/pInEroXzfEqirRRomLo+uSumEDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685234009, "uuid": "fd2e20be-70a6-435f-a6b8-3c1229858ed5", "value": 7354618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685234009, "uuid": "cc944325-c24d-484e-a5f7-9fe1a93b44b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234009, "uuid": "dd5ac417-8b2e-423d-88f9-53b063eac413", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98190325-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685299862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299862, "uuid": "08da6a3d-4c4b-4a11-9f9b-1ad0beadc6e2", "comment": "Malware payload (Mirai)", "value": "3d39d37fe912179c472f4dd105f6e136", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299862, "uuid": "5671dd13-f22c-406e-95b1-28ccced2370f", "comment": "Malware payload (Mirai)", "value": "cd499653f08ea18177f89b4921f834e63df2b6e8f2f360bbabd9cb904622ae92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299862, "uuid": "967b0a3e-2381-4fb5-b9c0-7d07f86db8fd", "comment": "Malware payload (Mirai)", "value": "bff263c9a306572595615cd40fa3b1fb33995581", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299862, "uuid": "59bc5572-0ee4-4162-b382-8f96cbdd788a", "comment": "Malware payload (Mirai)", "value": "4d5151ca64e930fd4243cc47b2cdfc4df2b4c2f36b04fa7fb345803e582e6b84fad4ca74a615e4e78d8202b1ad27856d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299862, "uuid": "7262ecf0-0ad0-45a3-ae9a-2be422cd0952", "value": "T145436DC6D143D8F6E80B0570603BE72BAE71E8EA2219FF47C7689631FC86641A5179DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299862, "uuid": "fbc901bc-3775-4bb7-b27e-7f5f722abf62", "value": "1536:DIqD1xfYqyDgZtmYXs8pJapJoC2TwY5ts0Aj+ISeWYemu:DIqDXfYqykZ4YXsIJap+1wytzG+MWYep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299862, "uuid": "58dee98d-1bb6-4b52-802a-fe7d8d2e3a5d", "value": 60080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299862, "uuid": "fcbb537f-7cc8-4c89-a11a-bd42ab03d684", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299862, "uuid": "97c1ba80-d618-4402-8562-8ddf3d4d5994", "value": "3d39d37fe912179c472f4dd105f6e136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63bc275-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685300396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300396, "uuid": "839faaa9-07d1-44d2-8d11-4ebc8e768e48", "comment": "Malware payload", "value": "27ad852c1bf95a9dc7bc39782edea681", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300396, "uuid": "dc2ca8c9-606b-44f9-9722-ec92d71a2595", "comment": "Malware payload", "value": "cdad7905bf72413a36fd38474fe0858b1c690db4f6a2df24fc7af5fb9aace101", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300396, "uuid": "4f899b5e-5760-4145-827c-7274f708954d", "comment": "Malware payload", "value": "d5ab1b52119e925e4c0c11f139089156fabf3899", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300396, "uuid": "28305759-2978-4faa-b520-abaaf4763529", "comment": "Malware payload", "value": "b77142d524650f92a98c6c52772c9f7ffdd9d25001d5bfedbde5bd89cb73a7cd97be57617d88b33b8f313509de536ca7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300396, "uuid": "2f0bff93-a340-4f9b-9e3c-46baf68f4761", "value": "T1D4634B02B21C0A17D4A31AB0253F57D097BFAAD022F4F648751F9B5A9AB1E375182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300396, "uuid": "3e018dc2-db11-46cf-a84a-5f3a53f5c397", "value": "1536:1soPywUOgfpZGNzdniySuPivNY++BuWzE:15AGNIFvNf+caE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300396, "uuid": "febe09e9-4331-4ac1-a9e7-d9a4886b68dd", "value": 67140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300396, "uuid": "d83582d1-b52f-44ac-840b-47e09b938cdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300396, "uuid": "d29b7a9f-d134-4ab3-93d4-c5413f71c0cf", "value": "27ad852c1bf95a9dc7bc39782edea681", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d904ceb1-fd03-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685242848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685242848, "uuid": "6b64e80b-ceb1-495f-8a28-4ddc0d32c49a", "comment": "Malware payload (Mirai)", "value": "e0f1f79f2ff0d1ad2d078bc7a82535d9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685242848, "uuid": "5635ffb1-0b57-4f9b-b8cc-e66b6301f7f9", "comment": "Malware payload (Mirai)", "value": "ce0efa630175ce9a8bee1758994ea02df33cb36e136ab9aec632b0126f91bbce", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685242848, "uuid": "d5097eb0-7d70-4094-a764-994a66804a58", "comment": "Malware payload (Mirai)", "value": "d2fa9e9c2e01b4b8fbe28b1bd5d5e07840222dd9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685242848, "uuid": "65723a65-328b-42fd-a651-da1c08fd356c", "comment": "Malware payload (Mirai)", "value": "c39520414b12149cab5dbe1cb40d910863a1fead9db547de9141576f5396cfad169c8148d7516c1d06227a36beefcb13", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685242848, "uuid": "105f5e69-c021-41b7-8133-522e97e8f4cb", "value": "T153631807F98281FDC19AC1740A6FBA3E993275FD0229F2B67BD0EB263C95D210E19D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685242848, "uuid": "b6525fd4-f037-4144-beb1-060edcc47077", "value": "1536:bkXA2MEnzb2LxKJ3BffwY9MiM3o5MmsrLG+L1mWMN:YXHMEnzKdKFJIY93M3ouPLZ1mW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685242848, "uuid": "78c2fdd9-fbe9-4c94-8a2c-f0462177f4b3", "value": 67392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685242848, "uuid": "d7baa8a0-a358-4d6e-a1ba-e3606ad57f6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685242848, "uuid": "036da244-b65d-4e31-b5b7-c55fdd99b788", "value": "e0f1f79f2ff0d1ad2d078bc7a82535d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5803ad-fd7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685293994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293994, "uuid": "9b87f5ae-05d3-4d97-b9d1-c1e3c160ecb2", "comment": "Malware payload (Mirai)", "value": "7ffa5122fc43ab6e413e900eb854e587", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293994, "uuid": "d9d07b28-3464-4447-836f-68e85fab8316", "comment": "Malware payload (Mirai)", "value": "ce62dfc342657159f8e9ae1960991d37cd49b16291ed59a912feed6e88118899", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293994, "uuid": "bd9a5d99-df6d-4d97-a1d7-ea5a4e0ff982", "comment": "Malware payload (Mirai)", "value": "6ac12f1e5028a33d2f3bc0281203a490ede70c01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293994, "uuid": "2380fdb5-a505-4423-b8c2-5f097897ea2c", "comment": "Malware payload (Mirai)", "value": "67e64cb8e0f438f79d5a4908a2b2b4f93540cfb135cf1bee37ae7aeaa0aee32962ba52b32fc642ff028d67c1e065ac23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293994, "uuid": "8facc009-f711-4d98-9b1c-ae7b8d3b4e1b", "value": "T11A832B46B8819A15C6C413BBFE1F008D331657F8E2DE7222CD145FA477CA86F0E67A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293994, "uuid": "b9f83f29-50f6-4200-9e7a-c1841a919485", "value": "1536:pWnDGBudxPj/bibobxPvro1Yl7yD5zmdJ++ppbi1RhD2uLmKPX51ti33:8OiHU+voYp25ilsRhD2Cm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685293994, "uuid": "e770913f-229b-4a99-a2f8-bc8b3be1a357", "value": 84168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685293994, "uuid": "5cd8e72d-cc9c-4ca4-b5e5-3863dc4c6569", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293994, "uuid": "21fbb38c-31b0-48e7-bd99-ce659105a07e", "value": "7ffa5122fc43ab6e413e900eb854e587", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6ea94a-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685300304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300304, "uuid": "125e6b74-5ac4-4ac2-a176-d4eda74d290f", "comment": "Malware payload", "value": "192f45b35218473c4e5c3db753b33480", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300304, "uuid": "0b0c1198-e12a-4d27-9892-f8c14779ea42", "comment": "Malware payload", "value": "ced42b61451a324356f83ef6730c753086481a8d88425bcf084034ac48721660", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300304, "uuid": "1c02abb7-db9e-4c91-b720-45dec5dd0b93", "comment": "Malware payload", "value": "b99686e5a4161f16fcd45dbea3790f22abd1f5d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300304, "uuid": "823de99b-ee28-40af-adb0-e8bf30e05525", "comment": "Malware payload", "value": "13e603d8c2aa9dff9d974a39428929251151f7027a1befb6407188ae71e0185288a9f0cd18110f1e0b20e0176753f718", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300304, "uuid": "1157b31d-a654-4c65-822d-23ef8a22ae94", "value": "T15E438D36E96E1E74C04641B074748EB56F23B4C893972EBA1AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300304, "uuid": "45547dc1-aadd-4fe0-95d0-2e54db25c161", "value": "1536:9aa0brW/Od9hlCRDeiTKQXACspfDCMx2+WA:9v0brWGd9XJiWQqpfDQ+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300304, "uuid": "da454375-c87f-4afe-9912-570f116ba42c", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300304, "uuid": "59e63f8a-79e2-4339-94de-d0fbbe2b1093", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300304, "uuid": "2a73630b-a04e-44b5-b907-7e36af961705", "value": "192f45b35218473c4e5c3db753b33480", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0324b5f-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685300386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300386, "uuid": "fe18230b-83bc-4baf-8490-42a2e42d9a0a", "comment": "Malware payload", "value": "6aa95f86a13a4a0f48cf6696b9ce7185", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300386, "uuid": "fa908824-6a87-4377-826e-ce550c225872", "comment": "Malware payload", "value": "ced5780086074f3dd14bd533d113c667bd8bc8d37dc74f313d0327a3d849500a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300386, "uuid": "358139db-955a-450b-90c8-73d5429d1806", "comment": "Malware payload", "value": "2a9f701de95222116e9e6e7ad259c6464d342ad8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300386, "uuid": "acd53f5b-5352-466d-8356-454f5274c1d4", "comment": "Malware payload", "value": "718b618ea09fe3f2d1b1456b5f31d08015003e86d5324aaa247a4f8acedba8deb5bf9f82c89ab1e930674061ba09b81f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300386, "uuid": "5e304a08-9e65-4eeb-ac3d-aa1d4a265cd7", "value": "T175433A31BA760E27C0D1A8B661E74B25B6F543DE26E8CA0B3DB10D9EBF715406503AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300386, "uuid": "16983d84-f082-4656-bebc-2fde8639a6b5", "value": "1536:fvf20dYmgHg1We/mrYe6RQW+75MUtydNzA:f20K5G+VM1NzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300386, "uuid": "264fb7b2-63a4-4781-8062-e8836b85a341", "value": 59864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300386, "uuid": "4482449d-0ad9-4d52-a8eb-e391a84a0a51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300386, "uuid": "82a5846d-975d-43f9-90db-153e3dc642f6", "value": "6aa95f86a13a4a0f48cf6696b9ce7185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae829b00-fd7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685294316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294316, "uuid": "7e947c34-bc77-4953-915c-962b11310684", "comment": "Malware payload (Mirai)", "value": "5f00179dfe3cdd9a6078e33d5213e2a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294316, "uuid": "541c94d5-9087-4bb7-b108-2e013ec4df92", "comment": "Malware payload (Mirai)", "value": "d0050bb8306acc05401821e3ffb65cdabc92cccfba5bd3a4249ff905e3751aa0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294316, "uuid": "29153e61-e957-4d49-b777-377014afee51", "comment": "Malware payload (Mirai)", "value": "2e7408d08dbf99d3c42be6822451b567d935fa14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294316, "uuid": "53e4a919-52c5-4dd7-bc0b-32b243422ed7", "comment": "Malware payload (Mirai)", "value": "d62a3dabdc7a1130059299d82248a14d0d5e79695987e5701f81e3dfb0caa3db58a9c2391855e45c865f0fced8b0f518", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294316, "uuid": "5c2d2633-65c2-442d-8aac-46b0ddae80ee", "value": "T1AA731885BC81A626C6D052BBFB6F018D3B1953E8D2EA3203DD151FA0778AC1F0D67B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294316, "uuid": "c7b69a9e-174d-43a1-9bb4-39cbe0608098", "value": "1536:9LaCdiyKn6mm0ehhIdtwAr/uhBVR87vTppVmjUMPX51ti33:9LauiyKbmxhh4/qB+vTpbmjUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685294316, "uuid": "5a776f0b-2197-4457-9ada-2316a0681f26", "value": 79156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685294316, "uuid": "6897ee64-d296-4f47-8d2b-035c27a12c59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294316, "uuid": "48381caa-4f39-487b-9510-8713909868f6", "value": "5f00179dfe3cdd9a6078e33d5213e2a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2af99e-fd80-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685296245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296245, "uuid": "a1477e57-709f-4e39-9ba3-619445187e37", "comment": "Malware payload", "value": "9870a05fff62808bbc56b9556b3dbc3c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296245, "uuid": "dfea96e1-842b-4e4f-b83d-39f98ae1436f", "comment": "Malware payload", "value": "d0aed6f8fbdfef9c66fe74e2870b203063b2498a18692d16d6c3ffbd672ea553", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296245, "uuid": "ce73dd0c-ccd0-4f77-83a2-c8bb7ad43ff8", "comment": "Malware payload", "value": "16bea3c63ea9ec8ca3560a66f83bfba402960a9e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296245, "uuid": "d640ee97-e516-4fac-904e-66a9f1b8c7c8", "comment": "Malware payload", "value": "601d013d5428867a8968f5b528854d23b6cb6271cb218cfa99da93666c94bc7b5f9a0d55e4349daf66bf8810363f8be5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296245, "uuid": "92db4a54-ace7-4003-a802-5949e2cdb223", "value": "T1C9636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F968120F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296245, "uuid": "34430afe-df1f-4fd2-bf7f-b203ac39bc14", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296245, "uuid": "284cb25f-5cd6-43c6-9e00-e7006d24338b", "value": "1536:LZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:Kd5BJHMqqDL2/OvvdrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685296245, "uuid": "82c11ec5-e2ad-4e97-83f3-b078f5a48cfb", "value": 71693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685296245, "uuid": "fbce33ba-d15d-4a73-9fd6-8e628a82a483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296245, "uuid": "cdb62ede-e468-4b48-be39-79588d2840f3", "value": "01964799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c49dd8-fdac-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685315154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685315154, "uuid": "2edd684e-f9cc-497d-a028-dc4ad6b2e0f7", "comment": "Malware payload", "value": "780c5aed3e9c811ee92dfe6a817ae3b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685315154, "uuid": "99f0f65e-7e7b-4509-8284-6e33ec51254f", "comment": "Malware payload", "value": "d0fe6ef3150d68642f77e4ef2c96a013b54febb842404f9579b6ee5fa295d172", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685315154, "uuid": "3fdcaef8-78ed-49d3-a16c-c11159ee918a", "comment": "Malware payload", "value": "8a12fbff26048e797f504d68603f4f5ad2e916b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685315154, "uuid": "bf6f540d-5a19-4145-a05b-448e6dcdf01b", "comment": "Malware payload", "value": "04444969c78d735e4e5f4b5586ac345b525ff550f75ec0f12ab6141ff2c80d034d26c9806a9cc6cd76648d5a1dac7c8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685315154, "uuid": "9c9666e7-f80a-4e28-91a8-5e253cb1440d", "value": "T13BB4E08373A39879F30905B15B939B64CB808FF9E02994E1BF462F9D9D913462E320D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685315154, "uuid": "c2160a40-4152-4db6-ba6f-c0203a4d584a", "value": "12288:pVFYpfhYMafwhecC2PyEviujwPuPYF8Jxjy958chpoYMgFYn9:nepZXafYM26Ev9IuPYmJk0YMn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685315154, "uuid": "5951d4b8-00c5-42c8-8f09-5846200e66e8", "value": 512880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685315154, "uuid": "d7871cb4-f425-4be3-9737-2af90f4fe6dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685315154, "uuid": "a9f4f4a3-3929-41ae-be1a-a6894ef02692", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c4f0ddf-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685300299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300299, "uuid": "62dd04e0-4fa3-4a08-a581-2731e7c85c8c", "comment": "Malware payload", "value": "13fb082c2cca38c6c1391f83230d071f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300299, "uuid": "96b9c9e3-2fcb-4609-8025-e40f0d95ea54", "comment": "Malware payload", "value": "d2bed7e65bf4833684b839c1eda5967755d6d9ddc9bee777e868fdb07b4a7b4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300299, "uuid": "10613536-2d69-480c-8592-39e2f767b561", "comment": "Malware payload", "value": "121d293a07f9179443f640c642cc4a7b45ba9a27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300299, "uuid": "04f88c81-9087-4471-b6a3-ba1f1954dc4c", "comment": "Malware payload", "value": "aa0faced427afd82ef84ad0feba00e2953b78a9405fa0be6f3750852c8fa124daeb2f05fa82c3b293f6d8ad67d5a1433", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300299, "uuid": "65b5c702-167b-42b9-ab1c-2be30aa5b511", "value": "T197439D77E41A5E64C5490270B4609EB41F53F1C843972EBB19AAC2B5A487FACF901FEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300299, "uuid": "1b670b6a-90dc-4677-ae2b-6865a214c193", "value": "1536:A+aLHz/BJstlKxdOzcwTRKgCR/da9JHFwCLhH3vWYs:x8HzZJstMxS4g+a9JHFwiXvp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300299, "uuid": "48dff277-5d56-4475-b470-b20c09bf0231", "value": 60136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300299, "uuid": "bce9c908-267a-4f26-a05e-e11be7560d1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300299, "uuid": "471fb21d-14d3-4215-bd7c-e4d77f7fb2f5", "value": "13fb082c2cca38c6c1391f83230d071f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdbd40fc-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685299925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299925, "uuid": "60345725-81b6-477f-b4fe-c8d671608b0e", "comment": "Malware payload", "value": "890969e6b18f4a4cc2fae9f04202f1ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299925, "uuid": "210841e2-f605-4ab9-b6bf-f5d9bb83da75", "comment": "Malware payload", "value": "d3ca142db80760453fbe04ab34871a10fbcd660641e59bd7e1cd33e1af308880", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299925, "uuid": "6f7f918b-e680-43d0-bae2-89517bfddbbd", "comment": "Malware payload", "value": "794544c20d488be713be5dd043cc3799d56d51b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299925, "uuid": "4afc8aa1-71fd-4afc-afde-627a5d269a8a", "comment": "Malware payload", "value": "24020bbdeb53b63a05a8ab2c2529b034c29c6e78e40cbe77a9f3ceee163bca53acb44d410ede3d1e9f109df45bb43b28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299925, "uuid": "76f55986-d79a-4dcd-8607-da03fd7ff1e5", "value": "T1E183A51E7E218FADF76D823147B74E25A69833C627E1D642E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299925, "uuid": "a713190f-6600-467b-8c50-d7f2f1cb109a", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/deyLYwHuRHI0I4EH6gTw7ZDYovZ73x/nL8y8Q7:Rakdn2Eo3eQaV6TwRYo99Be037W0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299925, "uuid": "77400757-a37d-42d8-9088-966be9f1387c", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299925, "uuid": "7245dc01-5610-4a99-acf5-4809ffc7868a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299925, "uuid": "497935ad-9c2c-47da-9467-0e9951fa566c", "value": "890969e6b18f4a4cc2fae9f04202f1ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b424b921-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685299909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299909, "uuid": "4a21c111-4a93-4fc1-af10-718d39d8c409", "comment": "Malware payload (Mirai)", "value": "a8331eb0550eb555f1d2fa3ceb6bf5ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299909, "uuid": "5b386815-688b-4ceb-a01d-3d564dc6b772", "comment": "Malware payload (Mirai)", "value": "d7101d83699a9fae418e4dd5a20fa9a08e76116da7f184933b1542fd4fb2c2aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299909, "uuid": "b470c975-a181-4dd2-a9a6-7667a03a0fb1", "comment": "Malware payload (Mirai)", "value": "df459ebdf649e3e934216604d7fb036e97c9fd66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299909, "uuid": "6fc4fe71-2567-4e52-808b-9116bbad2bc3", "comment": "Malware payload (Mirai)", "value": "5793d8b06462f443f9b7351bcc261ea29593bda9505458b2d85d235e59e3be3cc763e6c709f6af3d2676c892e49ad5cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299909, "uuid": "7a3908a9-2f1d-4af0-ba7e-fbf61066d4e5", "value": "T16BF2E951B8854727C1E41379B6AE5A8E377073EC92CBB62BD8224B207BC591F1D63F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299909, "uuid": "effee16d-9c9c-4e2b-ac95-079441f1d12b", "value": "768:VxwgXqSoG5M1ImBHGaBwO3iRtWV5za9ZSFHZ3RCTXpoc3tSwn:VRqZG5MRxGaeVKSU5B+Xjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299909, "uuid": "2e0ba643-655d-454e-9a3e-69be028a302a", "value": 34864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299909, "uuid": "fa67e10a-0f34-4799-8aab-58945ee120a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299909, "uuid": "7c57c085-e8c2-4c61-8419-8ed848acf1d2", "value": "a8331eb0550eb555f1d2fa3ceb6bf5ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b85cf6-fd92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685304016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685304016, "uuid": "6f0e2c17-ba10-43b6-8d95-7170796d8b5f", "comment": "Malware payload (Amadey)", "value": "a59198f6331a5e84156ccec39113d145", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685304016, "uuid": "40aaab6f-51f1-4e95-a19e-7448e5e54da7", "comment": "Malware payload (Amadey)", "value": "d83be445ccac2d1f61ce9057a4dedb2ce4774f4785ba751b6da2aa5dfbcec94d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685304016, "uuid": "a61142c9-d26c-4d3f-9bb5-d639d720ba51", "comment": "Malware payload (Amadey)", "value": "e6f4c0428d2e47e5d6f23d6f8068a905aa490818", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685304016, "uuid": "3bee0c6a-971f-49f6-9398-1e5a952addca", "comment": "Malware payload (Amadey)", "value": "6da960ec7e1e2f0bc4f9e6980c47da9e39be1efbd9e31a3c6018cc01c834e49de6918bfb49881517a6a7559af916284c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685304016, "uuid": "cddaa837-09ad-4852-bfbb-b49a556d94a6", "value": "T1CA25DD9D765075DFC86BC472DEA81D68EB60B47B831B4213A42721EDAE4D89BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685304016, "uuid": "d6e69b22-ce07-4a3b-a57c-82cd9ded338a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685304016, "uuid": "11d5c301-a042-4a4d-a0ac-5d677554e2d9", "value": "12288:bmGas8DTmI+HQBtuKyYc7WKN1Ekgla5oyK2PxnnaukD7qHgWuddSTCs5SVKSdH9D:aiGcJwxSccxnIJp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685304016, "uuid": "b86f2739-c812-4048-aebc-d1d08a46b122", "value": 986385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685304016, "uuid": "7f7da5b9-14af-4e6a-9d80-85eeecf83aa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685304016, "uuid": "89620e9d-5aeb-4110-a76a-e74c247ca09c", "value": "a59198f6331a5e84156ccec39113d145.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b404d7-fd7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685293998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293998, "uuid": "9c5ee9cf-a60d-4b41-b836-05df63b0eba9", "comment": "Malware payload", "value": "f84600a0bfeeadaac142364c479c3ff7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293998, "uuid": "24e7d170-57e6-44dd-a65b-218d60dcb0fb", "comment": "Malware payload", "value": "d8f88353e87c5c7a3ca33c7381616077ce4504f77eb4ad07acaea830af845f9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293998, "uuid": "12c8a7eb-2169-43fb-98d8-b1c40494aee5", "comment": "Malware payload", "value": "a54c40d7d3e303399ce5c93445300257b8a776d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293998, "uuid": "4b18ef71-44df-4d34-902b-bf7e3e6c9a68", "comment": "Malware payload", "value": "28edc0a49b97251f6148a5b0f61a6d23114644eb8769651852e74057e1daa55df5464db6babb19a01c4e113d4bcb26a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293998, "uuid": "774626fa-6598-4c9c-b9cf-e9180e9524f7", "value": "T17634B6123E224E76C9C58273B1930F702599EBE415B7CEE3ABC7AC143D456E2372DA94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293998, "uuid": "004e7a79-3d0a-45e7-b5c1-a2b7170cf060", "value": "6144:dWh3WoutJ8ajA9EldVDiD2SVxm0KNhTyyITmD:di3hutJ8ajABDpVxm0KNhTyyITmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685293998, "uuid": "007dbbf1-ba25-4f91-b3c0-9b10b2500e7f", "value": 237223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685293998, "uuid": "d855b3d2-a113-4dae-aeda-a4b2adf50717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293998, "uuid": "c2779875-13f9-4c7c-bc60-746a2a95907e", "value": "f84600a0bfeeadaac142364c479c3ff7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97765af9-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685300291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300291, "uuid": "e34954c4-0e6f-454e-8f6a-91fab4a99146", "comment": "Malware payload", "value": "2c4970deb057faf8048a3441ab756fa8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300291, "uuid": "4bf04e0f-82fc-44e0-95b9-199ecf637130", "comment": "Malware payload", "value": "d95b58b4c1354f2c996b60fde11d9eb07489433ef2af8ed1e0f08a5b0c44ba0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300291, "uuid": "bb9b8e85-f6f7-43ea-9499-4dbece46295e", "comment": "Malware payload", "value": "278b05d245bcb5bb09acbb1623c55d70d1efcc33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300291, "uuid": "1430d4ce-11dd-4f7f-95b9-4c9f313a6c68", "comment": "Malware payload", "value": "bc8c5b1ca2c869e6e19bb89ac7b1720d8af10c6cb13a404a5ff6973e3bb1995935d22a5ab0054d6943156057112865be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300291, "uuid": "e7f738ad-cacd-43b3-9137-b402ad3f0577", "value": "T10A538C7BE45A9E94C0820170B4748E756F53B6C842872EBB1AEAC2765443DFCF605BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300291, "uuid": "138e6037-2fcc-4def-b1b5-7d7b760649da", "value": "1536:za3g/CiBh1q4IYJd6AWKAQTMyfQ7CIznjWs:zAgFBnq4t9pA8fQ7njx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300291, "uuid": "8a15d76d-b4e3-4aa2-8496-7baaff2b02fc", "value": 62836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300291, "uuid": "91008763-1807-48f5-9b73-fb448ad8b4c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300291, "uuid": "a6f40107-05ed-4dbe-b4ce-a1d9d4ee2914", "value": "2c4970deb057faf8048a3441ab756fa8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c595d970-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685300368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300368, "uuid": "03e7631f-8657-4762-9126-ce836a31b375", "comment": "Malware payload", "value": "b1991f23bd229e4456d9fd6893b2fc45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300368, "uuid": "ce8b6521-ba12-4a6a-a05c-c7b5437eda00", "comment": "Malware payload", "value": "da2ba23a8699f11662c69cf242e54a0b2e2b13e7906e279a253d0282a2152d54", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300368, "uuid": "a1e06ed0-80b8-4d96-b1c6-b28dcbd17478", "comment": "Malware payload", "value": "b2834daae5722f116b8a31d4f0cd9f28872d11a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300368, "uuid": "ada6ebe9-0015-4187-abbb-24f3c6e52175", "comment": "Malware payload", "value": "e6e0cd4027bfc30e9b434d2243cab23e95c88bc5f2a779575d6ad0fb197602dbbda28a5acc657710a39631a35b381b23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300368, "uuid": "09ade9ae-939a-439a-b0b5-db3103b0513e", "value": "T17573C61AFF620FF7DC6BCD3745A8170239CC554A12A47B3A7534D828B65B24B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300368, "uuid": "3595e972-bf54-4013-a258-c67ae1b2502c", "value": "768:K3sJmkqElhWHgJvd8p6E95Des4ReDB2wJ2iwgugBI2ZpMIXi5Ij7+eOcIoJhwnZS:KcJmk51+5B4RcBvC8W2ZpMe7+pcI3nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300368, "uuid": "847a80f2-8e38-402f-9fa7-579b4acd57d2", "value": 73796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300368, "uuid": "57be52d9-23f6-4816-ae01-a908d1bc076b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300368, "uuid": "634a7062-0ac7-4a08-9a56-27ad879cb6e0", "value": "b1991f23bd229e4456d9fd6893b2fc45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67002ec7-fd81-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685296773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296773, "uuid": "d1487457-4e6a-463c-81a4-99d1a7d8334a", "comment": "Malware payload", "value": "bca754bd6e7b4c7b23e17d0244e425d0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296773, "uuid": "4f06dbae-a474-44e5-a47e-040958266af9", "comment": "Malware payload", "value": "da6f543313480695aab95a5e685741a8d185fba0600363f74063eb1cda0f672e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296773, "uuid": "cc7918c6-6c62-41b4-b465-8c54b21978fc", "comment": "Malware payload", "value": "257cef8651509e1e33d95b07d5a7b07fcf1f6f4f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296773, "uuid": "656140a8-ac09-4d2e-9aa9-f40a5b484fbd", "comment": "Malware payload", "value": "02f755ab75131231c55bf734437d5352b30b31fe25267e8b1ee0a02b520a270735159dca2c4920ed22b4edec2689bdb3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296773, "uuid": "a7ad5fdf-e38e-479e-bf94-94af001b8da6", "value": "T173C37E1EB3C12373E1D203B5FA6A7DD2961E2D3437555BE304A6807D26139F46A3B782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296773, "uuid": "dfff5ad3-ba5c-4637-a2e9-47cf63bc640d", "value": "08d4380d96add6bda6ffa07da5d49b4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296773, "uuid": "55384e60-b5d4-47d4-b052-bd41f1c99eb6", "value": "3072:xd5BJOoMqqDL2/OvvdHv3uqz3++OAYWgO:xdJODqqDL6gvdHveqi+GWgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685296773, "uuid": "dd227e21-d471-4cdd-bcf8-f99f2d6574d1", "value": 119941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685296773, "uuid": "51a440cb-be60-4353-94a2-36d12f8ae0dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296773, "uuid": "665f4307-de58-4342-85b6-49396221e53e", "value": "09156699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fe8547-fd8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685302865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302865, "uuid": "9aee33c5-28ee-462d-820d-7869feea14a6", "comment": "Malware payload (Gafgyt)", "value": "eec95c2561b27164696c885ea2031dab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302865, "uuid": "f2777bd2-b00c-4ee3-8480-584b995669d9", "comment": "Malware payload (Gafgyt)", "value": "db47bcf06f18972a028da0a31d496de0c322e74aea3c3e587d1563bc5669593d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302865, "uuid": "824929fd-cc7b-49c6-bc5c-9cbd5c3cf201", "comment": "Malware payload (Gafgyt)", "value": "119c8cd419a80731f088c8ff0515aab105cef1a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302865, "uuid": "275813ce-67c8-41c9-94d8-933533d95d69", "comment": "Malware payload (Gafgyt)", "value": "806aa6c3b99584540541182546973e122ec66e93fcf546413d70c55b1df603295164ea6be14aa9a64dc55d7a8f7f3666", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302865, "uuid": "78968e80-26a0-469a-bc6e-48f54d20506c", "value": "T12FB33B4795A89EB3C086BEB525EB59300722ED120F2F1A9621387BF4437F5CD741EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302865, "uuid": "c7b126fa-313b-4f31-887f-d314e939e6df", "value": "1536:Aq/W65rWXAiP5dfK4EBbkb25lyDQnAjCBB5+TjgkHmmycgYVLu1IPYC:R/vp+9C4xb2Mji0j/HmDcgYVy1IPYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685302865, "uuid": "4f55858d-8718-46ea-919e-626562b5775c", "value": 108486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685302865, "uuid": "29caa2c6-d254-42a4-8b31-d80e9f4811a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302865, "uuid": "86323dc7-1a3a-462d-9923-83895cfdf1b4", "value": "eec95c2561b27164696c885ea2031dab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dacc848d-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685299974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299974, "uuid": "9bf43670-2abf-40d1-a11d-ab8ed4a806fe", "comment": "Malware payload", "value": "5f0789c06a0e3c47d2af5f7dbe4b1408", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299974, "uuid": "a2c1b82d-7cd9-4da5-8cc0-a1a81784aaa3", "comment": "Malware payload", "value": "dba287d208186a64ea5650431c7ad15dafec11d1f97da5e6423b6546ef636457", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299974, "uuid": "a78dbd2f-69ef-491d-b7bd-508e5b38e6a7", "comment": "Malware payload", "value": "30a0a7fe8a28be9ee3d6f29fab5469cd865d2754", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299974, "uuid": "96362c80-793f-4305-9446-8db73c7c6b1d", "comment": "Malware payload", "value": "854a427b8ecd075462d998c61981411609490ba342d7041c3b399619ca055d9e1fd9b07e2a2a0e4585a0227d1d07e6c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299974, "uuid": "140d6503-2785-4e99-bb47-0d63239c1938", "value": "T18573299AF401DD7DF80BD77A4417090ABA30A3D54A831B365397FAA3BD721A91D22E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299974, "uuid": "801b95b7-bc6e-4318-857b-02f66e1aa9a3", "value": "1536:fMP7jF34ysGYptD8eE98Bj4u1ixgIWmdJP/JFgV3XQev:S7jB4ysbAeElu1sgRm/w3XDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299974, "uuid": "d7009ad3-ff3e-4843-b985-cb2d78d78ab6", "value": 73620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299974, "uuid": "766d6116-8956-4d46-808f-f8ccbfc6be1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299974, "uuid": "fbf6cdb4-c5a2-404a-8108-c1614a1302ae", "value": "5f0789c06a0e3c47d2af5f7dbe4b1408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8af4d54-fd63-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685284079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284079, "uuid": "97dc6fe0-9702-415b-8e00-e9f280daa8cd", "comment": "Malware payload (GCleaner)", "value": "3716985119d5e5fd256b9037b31425cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284079, "uuid": "dff05e19-5638-4964-b1bf-8ee2f008a5f5", "comment": "Malware payload (GCleaner)", "value": "de4244c39dd311be6abb54bf14f8c8c687da1b2b6a1b74b32c0a6a5ad09df0c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284079, "uuid": "5acdf5b2-b8b7-41a4-9fe1-5934f32d4a42", "comment": "Malware payload (GCleaner)", "value": "bd459d95fcd44dda660609a38c13b799690983a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685284079, "uuid": "9ef2b3c5-c2ac-4e2e-ae63-b6bcfa521a19", "comment": "Malware payload (GCleaner)", "value": "40f9ac28494dabfc66246006af40191b3b50b3fcf8c864c55b18b6d382c0450bc4c8c1c08408eedf24fbb8d43ced099d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284079, "uuid": "b2293a86-3a52-4e3a-a56c-822cdf7af58d", "value": "T1C3745B5382A13D50EA669B76DE2FC6E8365EF6704F193765322CBA1F08B01B2C173B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284079, "uuid": "6d36aed7-4e85-41c0-ae00-415b79366307", "value": "2d9ed3462f8a74bfd1231e2e9de56b43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284079, "uuid": "8a08d3a7-6553-4088-b7b3-f39c294fc022", "value": "6144:Wub/YS6EdQqatu7oIonRqklmQTm8pTtiIUM:WUQSNQ9g9pkbq6Ttis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685284079, "uuid": "187d7698-c640-473b-8c10-260a5dc81918", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685284079, "uuid": "2a6152b3-e24a-40d1-87ee-393ed0b4e95a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685284079, "uuid": "3fcf31c1-f08a-458c-b3d0-a6b08cdaeb7c", "value": "3716985119d5e5fd256b9037b31425cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84421e0-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685299970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299970, "uuid": "bb7a4959-74f6-4fe8-b79b-649863c259ed", "comment": "Malware payload", "value": "4d24e1732d125043d8037fbfeac6d1b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299970, "uuid": "f21c287f-edc4-4c42-8bce-e62a846be149", "comment": "Malware payload", "value": "de9ad75cba87243c8ab98f87d30c4d0e88eb2efef3397a5dbed9f56854a2d733", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299970, "uuid": "3ca4525c-5326-4e79-a830-edc37340c902", "comment": "Malware payload", "value": "910fdea603dcef74cc8a4894923f514793b053fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299970, "uuid": "dcc48a96-d615-4872-8a3a-a328c8730b5f", "comment": "Malware payload", "value": "a8bbf777415a6099f84f3f1d5b6f8c01121c36a993513f148dcf34d22c8104c42346b8b64196e2d8a6759b3e2ebdd604", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299970, "uuid": "74bff90f-5cf5-4048-a2bc-4d6c2d0bb069", "value": "T19783D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299970, "uuid": "a71f9e1d-3834-4bab-8b76-76207157370d", "value": "1536:iVLymx1KZBkj752dCexuV/8UZlDwfkJ4MYfWg:iVLyIUGFezxu5VD1eR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299970, "uuid": "7048e336-c590-4c41-b474-284e77ac4486", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299970, "uuid": "fca4a424-329e-4644-a144-b5ed080d1375", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299970, "uuid": "2485f1f9-92ab-489d-8bec-fa3028a64967", "value": "4d24e1732d125043d8037fbfeac6d1b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abda9f58-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685299895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299895, "uuid": "17c03b83-4718-4bfe-9889-76aca5688675", "comment": "Malware payload", "value": "0de4c43c8118107c75fc5517440724ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299895, "uuid": "74c26f9a-d06e-4f0e-88bf-1a2a296b5646", "comment": "Malware payload", "value": "df0e12e80a67fcd49255f0ff9f7c265a3a8f80612c1f25576fe7acb4c5bf65f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299895, "uuid": "06500b3a-1c3e-4f16-92ad-2ea6d3ad8957", "comment": "Malware payload", "value": "18ecb7f32856bdc8972c79373ba60bf276325f31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299895, "uuid": "98d401e9-e1ac-49a4-8d9c-0663de2bf5d0", "comment": "Malware payload", "value": "0d4c811ef220d0b4f8c6fab7abdc1773fa64e34962ef74d967ec7f586f94d5e46b85aa4461b6ae9dd13b2cb482bc44d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299895, "uuid": "4cc8a0cb-249c-4335-861f-5fcb80201389", "value": "T18E73C61AFF620FF7DC6BCD3745A8170239CC554A12A47B3A7934D828B65B24B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299895, "uuid": "8be58b43-74a9-49f2-ac8c-0a4a4af425d2", "value": "768:K3sJmkqElhWHgJvd8p6E95Des4ReDB2wJ2iwgugBI2ZpMIXi5Ij7+eOcIoJhwnRS:KcJmk51+5B4RcBvC8W2ZpMe7+pcI3nR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299895, "uuid": "ab4ce175-5668-4944-98c3-f8ec94587fd2", "value": 73796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299895, "uuid": "17ddcdfd-fb06-4386-b7b8-a46dcafac084", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299895, "uuid": "6df59715-d82b-4aa3-a473-dad39307332d", "value": "0de4c43c8118107c75fc5517440724ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82e35ea-fd8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685302574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302574, "uuid": "7f1cc440-06e5-45e4-9798-7c2cfdd972ee", "comment": "Malware payload (Gafgyt)", "value": "e9975d20bc6592b8aa4832ccbc9f41ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302574, "uuid": "d8b1fe04-9b14-4694-874f-d24305c95378", "comment": "Malware payload (Gafgyt)", "value": "df1f2dd250b7450d2678f5d8b6b822643750aae7d47e8befe15f9770ed8c9409", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302574, "uuid": "6a200a9d-09fa-4903-b8c4-8b8609d4369c", "comment": "Malware payload (Gafgyt)", "value": "9708205b9c3d7b1804c8e22093f138b55d42bc12", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302574, "uuid": "7cf63460-4b17-4345-8de8-d58090175c29", "comment": "Malware payload (Gafgyt)", "value": "1c069872278f8ab5b1cc6846963bbab12971dffb19626cd2f80e417f39b382708d7f8c2f9852fb68b47cbe0e48f3b93c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302574, "uuid": "6d016e65-c242-4bc4-a381-62c3c6346278", "value": "T114C3FA45F941875BC3D327BAE74E428C37355E2897DB33156A38BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302574, "uuid": "2a7abdb2-89f6-401e-84e5-2e3cf632cac2", "value": "3072:hQrFRNfuLrGhEPOD0ug3gNlmBoHQuQekQnYW:IFzuaEGQug3CmBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685302574, "uuid": "f2b30d4d-8cbe-42b6-92e0-4f11c080292e", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685302574, "uuid": "4eb2950c-811c-40d8-8b3d-7855fe8f73b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302574, "uuid": "fa3941a2-bab7-4c5f-9fcf-6e44ff773602", "value": "e9975d20bc6592b8aa4832ccbc9f41ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93cc0a89-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685300285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300285, "uuid": "3c7c746d-2878-42f8-b25c-cb18a6b93c29", "comment": "Malware payload (Mirai)", "value": "d7a53bd3a00584ec45e61ff24f045923", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300285, "uuid": "313f6c0d-f15b-40c5-ae50-8de0ba6c5d97", "comment": "Malware payload (Mirai)", "value": "e19f310c3da8041a2824eecc3e30353c3b15a9cab051efb48f9c69b9646c4707", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300285, "uuid": "20e53793-30a2-443a-a6ad-dbf09d66262d", "comment": "Malware payload (Mirai)", "value": "deefdbb964722b283de3a4e69898bb27b75640ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300285, "uuid": "01d0f124-bb18-4856-9738-ab0c44b17c1c", "comment": "Malware payload (Mirai)", "value": "ddc4c1f6a51cf74e7a95d8ab45baf65f8b9dd2a39d7402b0c715fd168126e22b5fd0ed2233d9dae5ee328178ba733a5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300285, "uuid": "435499ff-3391-4d78-a1e9-13b4869612d6", "value": "T14AF2E951B8854727C1E41379B6AE5A8E377073EC92CBB62BD8224B207BC591F1D63F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300285, "uuid": "72ec19b4-8f14-4d2a-a1ac-2b4839a8ef69", "value": "768:VxwgXqSoG5M1ImBHGaBwO3iRtWV5za9ZSFHZ3RCTXpoc3tSwn:VRqZG5MRxGaeVKSU5B+Xjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300285, "uuid": "f1abd78d-cb9c-452d-b2b2-60b6b8c6713c", "value": 34864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300285, "uuid": "c20ef88f-9306-4eea-960b-395686ca87cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300285, "uuid": "dec417d2-bc0b-42e2-9614-18c5454ebe67", "value": "d7a53bd3a00584ec45e61ff24f045923", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1821657-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685300334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300334, "uuid": "ac8d74ba-8690-4675-927e-556650444558", "comment": "Malware payload (Gafgyt)", "value": "534902f7681eed2529a658964674ae8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300334, "uuid": "50fdcca5-751e-4f0c-ad64-5e8bb180015f", "comment": "Malware payload (Gafgyt)", "value": "e447a7094294554c6fa57f06ba78050c1ccb7cfa06d3b153b4441476ec09ba7d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300334, "uuid": "50c35db5-b644-45b6-9094-f022bcfcb2e9", "comment": "Malware payload (Gafgyt)", "value": "b64f18f35815430d6e8e222109a52ae78e910d31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300334, "uuid": "c0e5a0d3-21a7-4b29-b2a6-aabbfdb00ef0", "comment": "Malware payload (Gafgyt)", "value": "8259cac3098ba3b2ba81594d82df9ce8f3671523c0a3719e0ebc1ec8a7d7f9a519f5271045e5a95af9759e2321d9828e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300334, "uuid": "b09be509-0c8f-433c-b4cf-b8ef4e05cfee", "value": "T1CBC30A45F941875BC3D327BAE74E428C37355E2897DB33156A38BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300334, "uuid": "f0f400c5-5ae6-458b-b6bd-b03c931ccfbc", "value": "3072:hQrFRNfuLrGhEPOD0wg3gNlmBoHQuQekQnYW:IFzuaEGQwg3CmBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300334, "uuid": "fe91014d-ba86-45aa-aaf9-dadfb2479fcc", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300334, "uuid": "389f885d-695f-4b6c-9c0c-641b6f10a916", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300334, "uuid": "2a9ee9aa-b32d-44d7-a9cc-5a2db4958378", "value": "534902f7681eed2529a658964674ae8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37272d65-fd23-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1685256320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685256320, "uuid": "8f383c93-2d17-4726-9096-67bd1447856d", "comment": "Malware payload (RecordBreaker)", "value": "d61647f77e4ab5f27a8419c052fd10e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685256320, "uuid": "611c5e1e-4af4-4ebd-896b-2cc66ecce12d", "comment": "Malware payload (RecordBreaker)", "value": "e4b3318cffd6cad2d36ae53107f6d8fd7aab47b596ab83711a89ecc290bda6a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685256320, "uuid": "5267f672-a4f7-4e9c-ae1e-719b14dbe81a", "comment": "Malware payload (RecordBreaker)", "value": "401b6a252a2b201bb575b153252304a7edb8dd9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685256320, "uuid": "9702728b-1d11-4c41-a7ce-448a9e4daac2", "comment": "Malware payload (RecordBreaker)", "value": "92f171b33136b77e11b37af619f4297c768ded2b77b7486c2c73419430c5ea45e17993fe0bf2854b6117f82192328515", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685256320, "uuid": "3771f512-807c-43c4-96c8-4abd71456efa", "value": "T14D543B03D6E2FD94ED668A729E6FC6ECB61DF550CE19776A22185E1F04B02B2C173312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685256320, "uuid": "fce07fed-fb88-4a39-824a-5c231ce1f30d", "value": "82b2bd7dc938b719df57a6b2df186152", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685256320, "uuid": "8cf68da5-f8f3-495e-b76d-0669e6eb7d22", "value": "3072:n02qqhNf7mAY68Y8ZrLVTAze+LaOTSSucZ68vQbt5QDGvAmV1Y:02qQ7mZlVTAzzOQSSh68vTDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685256320, "uuid": "69101d49-b93e-4561-bf42-8e4587f44e02", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685256320, "uuid": "28601a0b-d4bd-4d8b-87aa-659d70f4b8ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685256320, "uuid": "8da0029f-073d-460d-a4c9-568981b7d858", "value": "d61647f77e4ab5f27a8419c052fd10e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e3495f-fd79-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1685293518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293518, "uuid": "4661ffef-7ebd-4f38-a574-a6d92c4515ae", "comment": "Malware payload (njrat)", "value": "0e8752032fa8e68d97a16f9c7dd26c17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293518, "uuid": "576dc48d-e1b1-4208-afa0-edc20f57c4d8", "comment": "Malware payload (njrat)", "value": "e4c701c10cc4eeceb1e344e31e05eda5683d40ccb39e0b8473d7750227287063", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293518, "uuid": "cdae4ca3-7f18-42ed-b85b-9509f170167c", "comment": "Malware payload (njrat)", "value": "4c8d7561f7811c73376dbf761d92da88797911ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293518, "uuid": "c6f9a515-f1f2-4857-a104-1ec28edc58b6", "comment": "Malware payload (njrat)", "value": "ab1fb8bf26280ce01f0b3d15b13ccad1103f52d3b4bfde771be345c35be0a35443096a48be7d83c0ddb63aeb0f157b51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293518, "uuid": "97334625-3e9e-4de2-a1fa-37423d0b1e8d", "value": "T1FE54C022B9C1C471D86608350BD597B2B73CBD301B264EDB97986F1E9F341E0AA357A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293518, "uuid": "06b2fc43-2347-4a81-98c4-01337876ec6b", "value": "91e96141ed5dbe3bc541c8aad7ff3c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293518, "uuid": "ddac97d9-4232-407b-a94e-063765d9ba6b", "value": "6144:XdL2uWkVLRR1wOe85TjsugzAgT+tkE98+5QQ:NLllHPwOl7gT+tkE98+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685293518, "uuid": "18d2f464-a681-4ec1-b345-e00f4dbec549", "value": 298265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685293518, "uuid": "6de81346-70e4-4c03-9493-cee61ed0a8e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293518, "uuid": "7c98f2e1-93aa-4614-8a93-582cb0e7b9a9", "value": "0e8752032fa8e68d97a16f9c7dd26c17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90326e7-fd6b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685287516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685287516, "uuid": "065e0a3e-9ad4-4f98-a1f2-950854d760f1", "comment": "Malware payload (RedLineStealer)", "value": "91c40e25f9c6833993f60f9dea631f91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685287516, "uuid": "8b75f2c1-55a6-4e8d-93a2-12de1ce57e7f", "comment": "Malware payload (RedLineStealer)", "value": "e56e39f835d50bbb3af9cb5964ea909cea0af8428740befa096a80a7ccb231a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685287516, "uuid": "2866db60-b4f7-4f51-bca8-11641b31d5ac", "comment": "Malware payload (RedLineStealer)", "value": "b1e92ba56b5838cdf4f170f86b4fe525e5f68db2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685287516, "uuid": "5be13cad-72a3-4ae7-b20f-13acf7ff6a7b", "comment": "Malware payload (RedLineStealer)", "value": "d3bfb6d2785d7e22fa191bb8256439de84d99266745f4fbcfec4e951911e537c4b8ffcccb238ae78af9a0464388b01f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685287516, "uuid": "8adc4823-5dbb-44e9-9ddf-6317ebf011de", "value": "T181052362E7EDD127D9B8377128FB02831B723CA29A3C535F2644699D4CB3285A471B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685287516, "uuid": "351266cc-78ce-4523-ae25-d8bba819bb6e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685287516, "uuid": "471d3c62-6e69-43a7-8a81-4c9741c8b9ae", "value": "12288:oMrfy90NTAFSr24VCpOrHfL6Pdbpj4QEG3Ri7A4u5E1PKn7+5QWAY6LI2lJGrzVW:XyaCp6fWbZ1t/Cgn7+5QWAYKJGrG6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685287516, "uuid": "4b107aee-bce5-4166-a180-5703e6894169", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685287516, "uuid": "40b7114b-1232-45b0-a07a-c03f17e8e158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685287516, "uuid": "f6ba5596-2e7f-4673-8f53-8ce419dc3593", "value": "91c40e25f9c6833993f60f9dea631f91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb6dcb4-fd7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685294312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294312, "uuid": "3db53da6-1652-4166-975f-c6e643088d46", "comment": "Malware payload", "value": "38ac492987523af4798836aa76835a29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294312, "uuid": "e41cf24c-14ec-49be-803c-4fcee60d8581", "comment": "Malware payload", "value": "e6b50f2bfbbae58d12e165842e5f050f88e03c05369c5bf06892fe2340abda93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294312, "uuid": "8eda34a7-d85c-425e-a49d-793ed8434687", "comment": "Malware payload", "value": "837892c359995f261063747aae6521977ffecf86", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685294312, "uuid": "06c1196b-132e-410c-a4d5-5879bafec9ab", "comment": "Malware payload", "value": "91ac9f3b83604e84716c9c83e833ffec2c37d0f3f27e6fefcfc87b91e9ff228d321f041c0a1a726da8ef956bcd311db6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294312, "uuid": "9b712aad-3ed4-45b0-ab89-216f1d84b0a9", "value": "T17F4472057A704EB7CC49CA3371D30E60108CAAE542A7DFFBB796C804BA8661B76E7D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294312, "uuid": "22a482dd-26e6-49b8-b2d5-9efcf81a47ba", "value": "6144:ZTM6c0CIGetJ8ajANEVd17WQSzdmS/QN8jdOCZD:i30oetJ8ajAUWLdmS/QN8jdOCZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685294312, "uuid": "44e17198-cd42-49da-a537-fa20d70d9b25", "value": 266429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685294312, "uuid": "03be4986-9420-4448-88b2-ca834e667fca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685294312, "uuid": "d907644b-7b60-4704-b0a1-0c4403bc69ea", "value": "38ac492987523af4798836aa76835a29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc62d1a-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685300382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300382, "uuid": "ed6ad9b6-65f3-4bae-b5f2-093827542c8a", "comment": "Malware payload", "value": "d3451693920782020dbd6046373cbc4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300382, "uuid": "1073cce4-65b0-4ccb-93e1-0050d1848946", "comment": "Malware payload", "value": "e969f859f3b091c784ef1f65b32f4abdcef98250e7cd38f9dcd00f0f34cc85a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300382, "uuid": "8df7ace5-68f3-4a5e-8a59-89989a7ba489", "comment": "Malware payload", "value": "2ef1eafbf07826b9739f7a6c518b78a80dde4fb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300382, "uuid": "bfa316a6-ef13-42a7-bacc-4a0ed0c23f60", "comment": "Malware payload", "value": "32a614974d0939c07a68aafcd08349fecaba8aa2d21af470f6c825003f391ef035d94855ce7662e672aadae78075665d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300382, "uuid": "5da8175c-02fc-44af-8b62-f0c18aa50c60", "value": "T1D783A71E7E228FBDF759863047B79E21A75833C627E1D645E16CD6002EA034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300382, "uuid": "d8a7d436-2fd8-4acd-ba87-c1c602969a35", "value": "1536:DIYkXCnKDwaACHUPWzIjUHbLdeMmB2W0n:DIFXCnKDwaACWW8jUHbLk2dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300382, "uuid": "065d6dce-a6ec-452c-b343-ff9e6861b1e4", "value": 85760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300382, "uuid": "3491b890-07f8-4765-a351-0d6e275f5a1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300382, "uuid": "0b60ac85-cab5-455f-a677-c49da46eea8e", "value": "d3451693920782020dbd6046373cbc4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c0a891-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685299883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299883, "uuid": "a0561ed1-2fcb-471b-8beb-bdf1de9dd2b2", "comment": "Malware payload (Mirai)", "value": "3a08d8fb8319dbcd2ca8ab9dfcca7fd9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299883, "uuid": "8a1b526d-6887-473a-9a8e-cfeae3f657fd", "comment": "Malware payload (Mirai)", "value": "e9e004bd6e596e92fa5ab1f258ea2e89c7f6086882d058599a4927c7acbca211", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299883, "uuid": "3f33c849-5dbd-4b58-b038-cce4f1ff5ddb", "comment": "Malware payload (Mirai)", "value": "d7dc34b6d24bbc325e755561b0ffce9a518ce1f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299883, "uuid": "16bdbeca-e1da-4a63-a202-4b48298c96e3", "comment": "Malware payload (Mirai)", "value": "ff0c75611dfd7cc6f0029f063f9ee58e367aeb74251c34e8096e32971f4cafb79f3bac94a101ca020f17dbf561deda7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299883, "uuid": "7d414d9b-0db7-4f03-9ac1-c235cf62a320", "value": "T1F4436DC6D143D8F6E80B0570603BE72BAE71E8EA2219FF47C7689631FC86641A5179DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299883, "uuid": "d7416d3e-b20f-479f-9c46-1e5764f97b14", "value": "1536:DIqD1xfYqyDgZtmYXs8pJmpYUz2jMY5ts0Aj+ISeWYeru:DIqDXfYqykZ4YXsIJmplsMytzG+MWYey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299883, "uuid": "ff3081bc-24e4-4dd2-99a6-3ef10ac8cade", "value": 60080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299883, "uuid": "a35fc738-3c77-46f3-8095-f1e955a0dba3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299883, "uuid": "3cda2b39-9397-43a6-9612-58843399e899", "value": "3a08d8fb8319dbcd2ca8ab9dfcca7fd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895a8086-fd73-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685290818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685290818, "uuid": "537043b5-09e4-43a8-8aed-ed0dd0b2def9", "comment": "Malware payload (RedLineStealer)", "value": "f951ef35e89c36aa141c55fed14fdaeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685290818, "uuid": "43cdb981-cf39-4869-8b62-04c0c0485172", "comment": "Malware payload (RedLineStealer)", "value": "ea915ee14d5c24f7d9279a7376741919bc91783083fd8953feb26bf5c71ab4a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685290818, "uuid": "b1682091-701f-42a7-9d3f-4be1b8e6dcab", "comment": "Malware payload (RedLineStealer)", "value": "a801e69382521ad3418d3a3be3dd4f23502c4a80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685290818, "uuid": "50a5b723-5a6b-4534-9074-1a406cda2977", "comment": "Malware payload (RedLineStealer)", "value": "bd51c203eff4817c17aa49aad1882341b1bec11253c42622eae393cb84f36f5238ec3531d9749054392ca99bfad7da74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685290818, "uuid": "599ff1ab-2861-4210-bf49-538075de5a32", "value": "T1A4052216E7DC9072D8F19B7418F602A316387C625D78939BBB85AC4E0DF2482B5367B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685290818, "uuid": "6d3fc708-1d9e-4e8d-8e9d-b04743cc616a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685290818, "uuid": "ee0e3828-80af-46c2-9c66-833937325de4", "value": "12288:bMrBy90hBum9k0fp/WAbDDNB7CQ3SsO2w+2oxBAD5g/Wf7+ZuYDhn4O6nlzKmhrC:uydWBWAb90sO27xqMk+Z9V4OWBvwC4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685290818, "uuid": "da6ec46a-35e5-4139-8dfd-7547eedd6661", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685290818, "uuid": "898e2fae-0bd8-4d0b-97c8-c44766bc70a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685290818, "uuid": "bbea2314-5be2-469c-a78f-9e677afd7771", "value": "f951ef35e89c36aa141c55fed14fdaeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c50adb21-fd7e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685295643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685295643, "uuid": "c651cf7f-d508-48a8-bda6-4b142788f9d0", "comment": "Malware payload (Mirai)", "value": "3bf4b98e760e8a48104ff95ef0a30267", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685295643, "uuid": "c8f8539f-f382-46ff-a448-8be61089dc67", "comment": "Malware payload (Mirai)", "value": "eb582b1cb171f2cae421e6f2739356c6e95fafbf6646cf3293a9fea51d3419cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685295643, "uuid": "70fd4099-4efb-4d10-9880-9b5da7a771ae", "comment": "Malware payload (Mirai)", "value": "6278595fb4a07498da62e32ef415e87195523579", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685295643, "uuid": "ee48c738-806b-4a61-bf6e-96e91ecfebae", "comment": "Malware payload (Mirai)", "value": "fde43007db88658a45fcf4b9bde60bd4331b83265bc75eb22a3e0c888de1b974ccae7a91478f27798b51f88cb0e9ab21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685295643, "uuid": "421e4b7f-3cb0-48ec-b93c-f1bc041adeba", "value": "T17D2339C19203DDF5DC2195753437AB369A36E0B73019FAC7E39DA636D842B02BA4728D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685295643, "uuid": "3618b2ba-63a0-4737-93d8-bb766829b50a", "value": "1536:R4siMVoqpRt1+fj4btHEH1jLYYZ5IwgJb4a8:9VoyX1+fj4bBe1f/ixbj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685295643, "uuid": "d59d9040-4760-45b9-8624-3136ca000006", "value": 49852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685295643, "uuid": "b2027809-ac73-4c09-8a04-4b8353825c94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685295643, "uuid": "8d6978f5-b185-413c-a9b3-d266f41d4c93", "value": "DEMONS.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3603430c-fd27-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685258037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258037, "uuid": "0cbbcacc-cc87-4fef-935e-f8e31d3f228d", "comment": "Malware payload", "value": "a308dfebf76048be6e6f81d05679ea02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258037, "uuid": "7b9daf09-de32-409b-82db-bb79f5864dac", "comment": "Malware payload", "value": "edac065bbea513aab884b5afe583cdfab4c1b5d2a4777fb6e8ba5764361dd35e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258037, "uuid": "50a9378e-e7bb-4464-817d-5bc5a6af28ec", "comment": "Malware payload", "value": "911010df077b4b79810193278f7ff8d57475740f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685258037, "uuid": "4ee9302b-8ebc-47b1-b768-d5e98e5cca82", "comment": "Malware payload", "value": "5be112a0337c2178200f1f587172e51ecdd31f45966f3fc3348b3b063ca2fb925021dfdc3798cdbe52d0e1bf720b5ce3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258037, "uuid": "8d576af1-e10e-426c-8e2e-7f6b81c29f1d", "value": "T133F41222DBD80077C8B51BB05DF347871A35BCA189B8875B6B469E5E5CB22C0E87132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258037, "uuid": "f565d59a-967d-4a5b-ab38-8057fff858e1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258037, "uuid": "080479e4-4ddd-4c41-bb22-0791eff5b587", "value": "12288:yMryy90mUsIAiLMDFU3xUZeu6cyg/viMXPiYj4QBC2RAHL4U6k+exnw4l:UybpiMZU3xUigXiM/D8Q42RAHL4U6k5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685258037, "uuid": "526f216c-b5d4-4f3d-af06-94ef12b4431b", "value": 777728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685258037, "uuid": "8d97f384-deaf-4189-8b48-ed1ad69ee053", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685258037, "uuid": "83d97a97-7f7b-4978-98ed-e113e2faf2ac", "value": "a308dfebf76048be6e6f81d05679ea02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917ba50f-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685300281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300281, "uuid": "a1771ae9-88d5-43b4-bce0-a2367a59087b", "comment": "Malware payload (Gafgyt)", "value": "382a9be456942b88c2bd9d9123e25455", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300281, "uuid": "039c6f18-ab6a-4253-8ad1-e8232d9e2856", "comment": "Malware payload (Gafgyt)", "value": "ee53b7d6dd6d479c5cdd6b3453644f91562d0227a7ee32510fb35e30ac043233", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300281, "uuid": "e1f8d818-f3e0-4fbe-9409-51a7d3ff40cf", "comment": "Malware payload (Gafgyt)", "value": "85c790eeea44943b0f4c2d82d8a810ed69b21046", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300281, "uuid": "46ab8fdf-35dd-42ad-85d6-93542d7db063", "comment": "Malware payload (Gafgyt)", "value": "b3e674889cd50e36e78917a9647f199f4ab531c2b8bf0af37155e196a69f19a741c2ebe508511b54f39ed9fe3c718180", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300281, "uuid": "46aef56b-f334-45a2-9899-9fbf939b7c8f", "value": "T140C3093B6B270A23C0D9507102E31332B9B9DE5938BA43D7A9D07D9C6F3A58834567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300281, "uuid": "935c55ae-5e2b-46a8-8240-1aee9c74b0d7", "value": "1536:ctrv5GE2dFg8aI0DN95P8tf7PJtAWRdc0sfm7ypwYujl3IdnuW:ZP0DNPAn5sfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300281, "uuid": "c1cbed91-2dfe-4d51-b0f0-91a3785b1f4b", "value": 126446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300281, "uuid": "7d9d9c9b-5848-4038-ad51-2ff1150e7f17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300281, "uuid": "6b9873d0-f93c-41ea-9352-f8647506c8ad", "value": "382a9be456942b88c2bd9d9123e25455", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52788653-fd80-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685296309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296309, "uuid": "ef2880a0-3876-47a8-9abd-4e3629ec6e76", "comment": "Malware payload (Smoke Loader)", "value": "750c7c761a2ae2ab39d79e33c8c60bdf", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296309, "uuid": "9734890f-b102-495a-86da-d7bbce5d9c11", "comment": "Malware payload (Smoke Loader)", "value": "f099192fa0abddedf802c4f4968271608f0d8b7c659a0defc95080120ce2192d", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296309, "uuid": "8cf70f3f-3e29-4ad4-b51c-8106b7902435", "comment": "Malware payload (Smoke Loader)", "value": "82743740843d6539fd4b823b7313109dea2d347e", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685296309, "uuid": "d526ed2a-ca6c-43b0-aa37-393d2d33e933", "comment": "Malware payload (Smoke Loader)", "value": "35bc4d9432bc415aff570b56694e2cc44d91ee8f04c72e34c40cfdd9cc79d79d43937323900e34d2399e2d6e2d560162", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296309, "uuid": "9fb83c00-38d6-440a-b744-0591d1a0830c", "value": "T1ED54171392E13D54E9364A729F2FE7F87A1EF2508F497BA916189E2F04B03B2C163715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296309, "uuid": "e2f96794-7bcc-441c-ab15-d02cc043118b", "value": "96475f7ea3cc105ae1bb971e987af868", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296309, "uuid": "5d9a0fdb-40ae-4bb9-938a-c2d010b38aaa", "value": "3072:IuXk2KAESkD72nSGyz3SJXNRVHNzBsES/ltInlLXkfUPdKU085T+wGkQ:VXkHSkD72nZXjzGFElLXeIdLxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685296309, "uuid": "1323a2c4-50ad-42f9-8c8e-7c53af314bf7", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685296309, "uuid": "6531d293-a302-4ccb-b362-c49cb2729966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685296309, "uuid": "eb0b8bf8-6937-4860-97d9-423c3a19fa98", "value": "04868699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df8d00e-fd21-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685255419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685255419, "uuid": "b2586b6a-0ef8-4de5-82dc-bfb9e183bdf4", "comment": "Malware payload (RedLineStealer)", "value": "64107cff205009261bf04a4e64d7208a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685255419, "uuid": "eb3281f4-4e25-4b14-a42b-f6c14b313c1b", "comment": "Malware payload (RedLineStealer)", "value": "f13ea7b381708a18feef49edc01ea053aa89337433fa7c61a1e37ee5aa27aed2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685255419, "uuid": "9b77bb2e-f1d4-4e53-90b8-fb8e39d065a8", "comment": "Malware payload (RedLineStealer)", "value": "ba3b80ed0844cf1aa371764999e6a46265fe7c88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685255419, "uuid": "54deca75-7f6b-43e0-b7df-7e1d8f33a1c1", "comment": "Malware payload (RedLineStealer)", "value": "f27edd94aba0fac5dd521bb614dc9762ab56f1e6b1d78abcad1106a9857e6d2850267d77499261dd1539b5588fa25b53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685255419, "uuid": "2ef33a84-4082-46c3-97f7-ec1753fef880", "value": "T1E995AE02B8C1C136D5B236391AE48ABC452DBC6DC7A7F9EB579B196D8F205D0B3304E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685255419, "uuid": "e2108048-dcc9-418f-bbf8-a9915c8e3d55", "value": "65d9c1a9ed29f52599b050c6a36bebe6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685255419, "uuid": "834306a1-0349-4d1a-a448-c1091e5591a9", "value": "6144:/osOwg0scbOzrtW+IktAO9su3thpzt9p3vVjIaA:3Rg0s8+Yu3thpzpvdFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685255419, "uuid": "bb9f6867-afa0-4cd4-a7e7-b533a6b4be25", "value": 1960448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685255419, "uuid": "e84c3478-ab8c-416e-9272-52836ebeea71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685255419, "uuid": "14df5ea2-b65a-48a7-9446-33db2b62cd17", "value": "64107cff205009261bf04a4e64d7208a.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160e48df-fd82-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685297067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297067, "uuid": "16a55fb9-0f51-40a5-866e-4e2a5d149a8b", "comment": "Malware payload (Mirai)", "value": "431633784759bb0e76ab5aae1475e483", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297067, "uuid": "7250ffef-3e8a-4b10-a803-d1567869bb87", "comment": "Malware payload (Mirai)", "value": "f202fee7c5112e4d0954fcf623fedbdb1a88369296c723384f197f31c33b0d33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297067, "uuid": "2c86cfb9-a812-4a45-a6ff-38ce8ce78344", "comment": "Malware payload (Mirai)", "value": "2decc4f30a9d0d60a0500d2d53e4359e2367ddef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685297067, "uuid": "4ea10e00-0f38-4a9a-a231-22edfadb6866", "comment": "Malware payload (Mirai)", "value": "59566b11e05408e92b3b582a87d076c40e9c514d02427d636938fdfd53e5217c4d5b8e852e2cf40cb3fc21bcf60b8049", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297067, "uuid": "df749882-f24e-4997-92dc-aa187cf3cd25", "value": "T1D063970E2E35CFADFB69863583F74A205654339522E5C649E26CFE015EB070D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297067, "uuid": "b3f520e3-9049-4686-84c9-197d83b544dc", "value": "1536:t0NTVpDuVo/JxlBifnKurBoLiLXabIvl8euO1HmJH:mNT/DIa+KunwIvl8vO1HUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685297067, "uuid": "ff3ecf25-d04d-4d5a-9763-7b39f50a341f", "value": 71580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685297067, "uuid": "0c9a273b-8499-4338-b481-c43323a19bcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685297067, "uuid": "3b8e4e4c-d299-4e55-8ad0-55fb2cc31c72", "value": "431633784759bb0e76ab5aae1475e483", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8afdd98-fcf5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685236861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685236861, "uuid": "c84f1c42-7183-4c22-aea9-b0b279675a0d", "comment": "Malware payload (Smoke Loader)", "value": "4cbbbf1e2c9eb59f3cded9ae490d83e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685236861, "uuid": "560c9bfa-d8af-4e31-831c-f6e705da4ec2", "comment": "Malware payload (Smoke Loader)", "value": "f434dde30d9a4e51fe173e8bd509e73732ee23814fb92753df8130ef7cbf8557", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685236861, "uuid": "6e366682-7a1f-47d5-be0d-4dfb38b6edc8", "comment": "Malware payload (Smoke Loader)", "value": "b5ce8b34693d46981380e6e1fe69dbd7a4deeee9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685236861, "uuid": "4bbb03fb-f636-4b72-8235-402b52eb1972", "comment": "Malware payload (Smoke Loader)", "value": "337000644d9bdcd7050cdb5adbe08b58283726d805a30e52277256b3099a802b6c6a3df65222447faa383e942f13c2b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685236861, "uuid": "52f75a62-348f-44c9-aabb-ed6417145300", "value": "T113543C13D6E2BD58ED668A729E2FC6EC761EF2508F59777922184A1F04703B2C173722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685236861, "uuid": "e68abf1f-f719-41e0-9a26-de11647abc71", "value": "d302e4ac3406067f8ed838633897aebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685236861, "uuid": "0ccd46a3-e790-4438-bbf7-d21560453b31", "value": "3072:WXkV6hbaBZEBT39aIXWE05sezx0QzPSHi9KRQPd5giGvANW:GkVXBuBTXoKC0QzjCPip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685236861, "uuid": "7db95a80-5304-4a65-a2d5-364e22fef796", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685236861, "uuid": "548f51f3-b73d-42a7-b19e-247d81f17245", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685236861, "uuid": "55f96013-0528-4bda-8ecb-b68af66d7413", "value": "4cbbbf1e2c9eb59f3cded9ae490d83e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88437355-fd73-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685290816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685290816, "uuid": "df0ed964-faf2-4317-a40b-edce54dcc008", "comment": "Malware payload (RedLineStealer)", "value": "5e78821b9d278df978b0ef6aa75aa47e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685290816, "uuid": "6ca4b670-42df-440c-a9ee-abc0a828dff6", "comment": "Malware payload (RedLineStealer)", "value": "f46fda13b9a41323f46c2f1e48eea3fe06ca7d3454bb784ddf7d2ed84969cfd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685290816, "uuid": "0953f169-2d32-45ee-9abf-668b5c64b3be", "comment": "Malware payload (RedLineStealer)", "value": "3d9a58ac1494aade6f563b0e78e110015bd17773", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685290816, "uuid": "bd49529e-c70f-4921-aedc-3fb88d0f23da", "comment": "Malware payload (RedLineStealer)", "value": "bac37f7cdc9a25a7a85cb6616bbcd267e4d13320a161439c1a92d3aeada1ac222f1a49955b31880a1b670e94eb8a8390", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685290816, "uuid": "d358a009-481f-48a4-b7fd-b3f5000546b7", "value": "T164052252ABE400B3F8F067B24DF653530B32BC954DB8471B2789A85F5CB2398A536367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685290816, "uuid": "e86b0db1-ca74-489c-8195-fe9b3b483440", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685290816, "uuid": "08f5d2aa-5d95-4eb1-acae-635aef1838b3", "value": "12288:eMrQy90WwuSRD4EvZigr9rflRLR7xnpgkps24iaJoTq4cmX+NXJhjSPf0WZ:yyDoigr9rR7kY4il+NivZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685290816, "uuid": "a6d4ad1a-4bc0-4ffc-8d95-7205af72d06b", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685290816, "uuid": "de01585a-2754-4205-b345-ee7dec1dd2e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685290816, "uuid": "bec036cd-dc23-45c8-a1f2-cb24eb722640", "value": "5e78821b9d278df978b0ef6aa75aa47e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbdd9000-fd88-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685299949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299949, "uuid": "8eff21a0-2609-45db-89d9-e2a3c853fc1f", "comment": "Malware payload", "value": "b4206f109f136de1369b3ced7ae78cec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299949, "uuid": "df3e72bc-cfe8-4c36-929c-9002d757861e", "comment": "Malware payload", "value": "f4e2aa7fff9a6433e50fecd7005c749cfeea8ab87869cdc5f7bd20eef213953b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299949, "uuid": "3b5f74f7-e0d2-4121-91a9-1800cb6de1e0", "comment": "Malware payload", "value": "cc47d2d557183bdf58eb7aa8ef1a2aa2b7120925", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685299949, "uuid": "bf451654-05c7-47c6-bcd4-d303cf03de53", "comment": "Malware payload", "value": "14516af57c8032b1f5e7a3f2327ff464523139c49a73f97cba95296ed0c99a49b0622b34394e78ad6658d1a555bb4644", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299949, "uuid": "ffb78267-c899-41bb-98f9-c2eef514cfb1", "value": "T1DE93961E7E228FBDF75A823447B74E25A75833C627E1D641E16CD6002E6038E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299949, "uuid": "2df83bb8-3f48-45e4-9227-72f27000043e", "value": "768:oQcZTscQLQpL0kF2p+Endna8l6O71o/lD/cFz8dCtgLK6aO9mjeszWAI9yrBcDWV:TupLP01Fh71icqsz9IW/VeIklWcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685299949, "uuid": "5524c9d4-ad6d-494d-b845-e526e2df4dfe", "value": 88892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685299949, "uuid": "97ab0578-f96e-4f6a-b0b6-5611f9283ca5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685299949, "uuid": "f0416578-84b9-4055-9be7-009cfc917856", "value": "b4206f109f136de1369b3ced7ae78cec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6d866f-fd32-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685262715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685262715, "uuid": "11aeaf14-043a-4f5a-8900-43659caeb743", "comment": "Malware payload (RedLineStealer)", "value": "18ecf495a7e8dc91de0f57f60c9896f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685262715, "uuid": "8e92e0f4-b640-4c32-9bef-95cad6828367", "comment": "Malware payload (RedLineStealer)", "value": "f4e57d6160cc7f2ad503c3b1627cb5176ccc6e20490399b3700cdf7eeef8beec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685262715, "uuid": "2bd33a3c-062a-4b38-94c8-3e420c352e31", "comment": "Malware payload (RedLineStealer)", "value": "10a613527dc3d67c40957b9ee2eb8e0a4dd79fcc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685262715, "uuid": "53f5710f-f015-4660-85cd-799357423b6f", "comment": "Malware payload (RedLineStealer)", "value": "7e383f2b8de07f3e680a1ab86c86fa570e1652379db94745630060b91f7c343245f6a060e3541125aeb3f8d246732d9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685262715, "uuid": "b2fa3b76-53ce-4f5e-abf2-7db4fd6ac2c5", "value": "T1C0745B1382A13E96E9A64B769E1FD6E8761EF1708F597769321CFA1F08700B2D173B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685262715, "uuid": "c57c3534-4ece-4bab-9ec0-72cd2aadc17b", "value": "2d9ed3462f8a74bfd1231e2e9de56b43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685262715, "uuid": "a2e85b3b-596a-4e13-964c-a0ad6ffe6781", "value": "6144:Ofr4CTYnMaqblzRhIVpCaTLymSB+1Va/dliK+jzTtim:U/TYM7bhRhmCaTRSKqdAPTtim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685262715, "uuid": "e3658ce8-8ab3-4212-a961-6fcdfc1be1df", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685262715, "uuid": "e9298de6-0ab9-42dd-9a3b-3f17ac606f75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685262715, "uuid": "5ab6369f-27a1-41d5-8638-f005c2235c1f", "value": "18ecf495a7e8dc91de0f57f60c9896f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05739791-fda8-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685313360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685313360, "uuid": "b5fa25e4-1012-4c54-a53b-d226c0febfa6", "comment": "Malware payload", "value": "5aa7d64b30db9fa5b8db9849ca994277", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685313360, "uuid": "6a7ccff8-9f33-450b-b554-d32b42880d7d", "comment": "Malware payload", "value": "f59e09fe861020680339aca9e594f1ade3420399e46f9cf903b5f7462e73a23d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685313360, "uuid": "a3305334-d5d9-431f-b424-61e300df35a5", "comment": "Malware payload", "value": "e17ce459f2f8423770a57e1d824103e514f344e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685313360, "uuid": "e65544f6-55ae-446d-82aa-7832c5fa7dad", "comment": "Malware payload", "value": "7e75bc6883ae897ceebaed6e68860862de8bb9636c9d4f799f753a113c3a87d9488a04fc9e38bf5f185765a55b063310", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685313360, "uuid": "0025349d-2cac-49fa-8eb3-9b6c797f1867", "value": "T13D051203BBE485B2DDB147F158F5029707797EB0E83452AB2746581E1CB3B883A717AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685313360, "uuid": "cca106ea-973a-46e3-acce-ec274294733a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685313360, "uuid": "63b5743f-8d66-4aa9-b88a-095b6a6b347f", "value": "24576:RyRz3yvDfKorJha/sjwdr5epnP6USvH3F3lz:ERbkeorUBapnPsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685313360, "uuid": "859e7d0a-c8f5-4f6f-a709-961c4d0d8cad", "value": 826880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685313360, "uuid": "0ea98bc7-80d2-4e1a-80ad-c4854f42ad87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685313360, "uuid": "8ff317a0-0ed2-4f96-8e48-51b163fa766f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180c844d-fcf0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1685234364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234364, "uuid": "a997fe63-566d-4865-8e7c-c6f91828946e", "comment": "Malware payload (Glupteba)", "value": "c4527cef7558bb0c1db2bd2d650b7f34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234364, "uuid": "0dd8aa65-1869-405e-87a2-4d97eb06f13d", "comment": "Malware payload (Glupteba)", "value": "f6d3b34404a9cfd68093d6d8001f0d22365a0040e0f124cbf8d1cc96afc08f32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234364, "uuid": "ff9ea76e-9dec-4253-8abc-d4e09228e50c", "comment": "Malware payload (Glupteba)", "value": "6fdcb43ec9f60962e5fe4cbbb6b11acf35501b35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685234364, "uuid": "8d347ecc-859c-4ae5-a959-2ff6ed2ce68a", "comment": "Malware payload (Glupteba)", "value": "105011f908313ea3127af3cac359605ca26ad360fd5b13c670ec578bb36ba40bd9122857ae50744964412c6516148465", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234364, "uuid": "33067622-cbed-4e0c-8d6b-3f0673bdeed7", "value": "T1FB1623439AA3FD44EEAE8772DF2F9E9CBA4DF1508E19677611144A1F00B02B3C52375A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234364, "uuid": "17d9c2af-6a81-4116-9fd0-e3f654f33da0", "value": "d302e4ac3406067f8ed838633897aebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234364, "uuid": "e1768988-95d4-44a6-b15a-ca97aee79004", "value": "98304:+LdEAtCskksXMx/oJuuZNyBrdmQWAVLvt/uBKWAbqJ4+:+TfkkLVxuZYhTZVu+bqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685234364, "uuid": "528f8419-c90a-4635-bbb8-2932024e8e10", "value": 4371848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685234364, "uuid": "e380dc98-66d9-4d78-94f0-d0b63cd2a26e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685234364, "uuid": "2be9b531-8a51-4978-b11e-45d2692dcbf5", "value": "c4527cef7558bb0c1db2bd2d650b7f34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3d9c4b-fd8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685302879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302879, "uuid": "371e2ed6-661d-46a5-95b7-5a5023eed11c", "comment": "Malware payload (Gafgyt)", "value": "539210e81e3946a5764c3fa36c9b69da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302879, "uuid": "0116b6e4-c05c-4c1b-974d-79a5ab453595", "comment": "Malware payload (Gafgyt)", "value": "f7024ba469cf042c7abf7dfbe16bcc9eb8f53f9c09ba63fb7e14023912811f71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302879, "uuid": "0d066df9-4e95-451b-be8c-d38f8a071027", "comment": "Malware payload (Gafgyt)", "value": "eee990c901e8418ed8c8a6a559bbb8b967155c98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685302879, "uuid": "334db5e4-8783-4da4-a6bb-430aedcc9ff3", "comment": "Malware payload (Gafgyt)", "value": "edb24518add9c70485b908fab7d8fc9b4f80ed367e80277f90afa4123d580f115ee6381265663cdb084b8584ef92aa92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302879, "uuid": "0adb3400-b21a-4fcc-aec2-2bdfeb3bd087", "value": "T1C2A34B8AD743C2B3CC530AB2124BA66A4621FD3B092EAF49F7197DB09F374C97125B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302879, "uuid": "6cd8b735-2cf7-468a-8ba7-8d96fb4f71f9", "value": "3072:cWCjQrLpnr85EdT9Oa8vqbVr7H/CEgmqAgcVyZIcBI:cf5EdTbpr7HWmqAgcVyZIcBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685302879, "uuid": "5dcca5fd-a4c1-4d20-8797-041dada24af2", "value": 99084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685302879, "uuid": "43713c89-1144-4d2c-909d-2d79005d5d1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685302879, "uuid": "bbb31b30-2cd7-4953-9df0-46c579b94d85", "value": "539210e81e3946a5764c3fa36c9b69da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e6a2b2-fd89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685300295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300295, "uuid": "87fa3ca0-b6cd-4080-9c59-2f7236de9da1", "comment": "Malware payload (Gafgyt)", "value": "db53fdadd357ed484e54fcea1a63e903", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300295, "uuid": "926accd2-a686-4f4e-b086-0edf6a20aae7", "comment": "Malware payload (Gafgyt)", "value": "fb1b0b291d3c63dfd7c4ea780aac46efd44ee17ccb68d2fa721ce280de0de7ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300295, "uuid": "d02c2b67-8f90-4e5b-a7b8-1dffeb1d4aa9", "comment": "Malware payload (Gafgyt)", "value": "33ce2fab04f9ca84f26241e7433b5d3d0b8e9ca9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685300295, "uuid": "0b708ee7-1bbe-4df0-811f-d86e321749d7", "comment": "Malware payload (Gafgyt)", "value": "2719ceb48ddbddf15898d1664dead6ca1569208ca6762ab84fc05725ff1ab4bcc28dbe6307bab1016b852d2a77fcdb4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300295, "uuid": "27f897ed-8dff-4bea-b5a6-78d1e5889a89", "value": "T1B7D31905F460875BC2D217BAB68A425D37231F7893CB33256A34BEB42FE1B981E79531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300295, "uuid": "b76f775e-ac44-4794-8ab3-ce93fbf52762", "value": "3072:Sdf+fvEqa9FazYA7IboRhKe391CErktmCQA9FX9aH:ifWEqa9FaNhKe3DrktmCQA9Z9aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685300295, "uuid": "1b6d63df-bd2e-4b94-9677-2df11a661d7d", "value": 139585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685300295, "uuid": "10089cd8-ce95-40b0-aac8-341ae1ae0253", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685300295, "uuid": "24098c92-cb29-41b6-b417-2ccb4d771c03", "value": "db53fdadd357ed484e54fcea1a63e903", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e838e8dd-fd7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685293984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293984, "uuid": "705a2b54-0d0f-44e7-8266-39b1c7bd7642", "comment": "Malware payload", "value": "34d908176a7339a11dc94966cccd38d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293984, "uuid": "f7b37d15-dc74-4622-9967-db81f9bc8912", "comment": "Malware payload", "value": "fca6f75a0ec3298660fd4c29b272bd95a7d3386695601eb6d176088dd7d94304", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293984, "uuid": "551f54e3-1082-4589-9dab-443bcb538415", "comment": "Malware payload", "value": "5bf35b3c0620affd9d3e0b49ae925e07e8bf00b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685293984, "uuid": "2961edcf-11fa-458b-984e-e1cd0509de87", "comment": "Malware payload", "value": "060281fc09592bc7b62e0321856c1545fa70123be50aa88439fe01d328f96e8435f77262c3073862fb43dd0e131c598d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293984, "uuid": "cacba85b-767b-4bbd-8155-12d8454afa5d", "value": "T15A14C6C171609EBADA864333B2131AB41012F9F55637D2EAFBEB6DB0BD857407734A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293984, "uuid": "8f3463c9-4b58-4264-a6d5-c059fec09cdb", "value": "6144:xbR5sb2Ek85Za0b7etJ8anvJKZEKCZXSdCAmn1950e8I8n1:1R5sb2Ek85JetJ8anBKwZXSxmn1950eY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685293984, "uuid": "c722f3e7-745c-4aff-8d75-9f7cbba1887a", "value": 199617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685293984, "uuid": "52eb53c4-86df-4b45-a0a5-61f5396a041a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685293984, "uuid": "7fb0b31d-3462-4ae8-9356-0b9f6bf09b2d", "value": "34d908176a7339a11dc94966cccd38d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28cfd6a8-fd86-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685298817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685298817, "uuid": "c9cee980-f672-4d90-b802-5defeb5df5b4", "comment": "Malware payload (Gafgyt)", "value": "2aa47dd8d47f98d73f3605fbab54edc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685298817, "uuid": "2bcc5d05-b3ee-4e64-afe0-aa9d62669a43", "comment": "Malware payload (Gafgyt)", "value": "ff13b9d3942b0f176613a288a016be0b09c531e60fee992efb24e95aa613c0d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685298817, "uuid": "95e82b54-bb64-4de7-a257-6e69f4eed37e", "comment": "Malware payload (Gafgyt)", "value": "eb10de3da34ec99c94735de31b329d9ec4563ff2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685298817, "uuid": "1e763363-cbc9-4db9-9e88-756ef70fe552", "comment": "Malware payload (Gafgyt)", "value": "407ae58bb28f3165ac528ddbada8aa5de65120d2b3e978251d2e05f29b612bceb12c0e18f8146d6b715185dc44a99e4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685298817, "uuid": "e440633c-291b-4a14-8ac1-77e2d94df1ef", "value": "T182B31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685298817, "uuid": "807f045a-25c8-45c1-a3a1-a0b9bebc92e1", "value": "3072:od0w4SAewzi+Xn+8Uhw6W+aP6JmDk1c8xF6KjW:zfO8IBDJmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685298817, "uuid": "a9d71283-063f-40d7-801b-88f4f6abfa74", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685298817, "uuid": "d2fa22f1-d8ca-4489-9185-441ae63df659", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685298817, "uuid": "4238a3e7-d19c-4643-bd37-3903e095b1c6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }