{ "Event": { "published": true, "date": "2026-09-08", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-09-08", "timestamp": 1791367609, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "77e3f0e1-d55d-403d-9f2e-10a1d181b1bf", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e929b58d-abd5-11f1-ab4f-4201ac107002", "comment": "Malware payload (XWorm)", "timestamp": 1788907065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788907065, "uuid": "590d10a3-fd6d-455b-9b6f-e30d041636b2", "comment": "Malware payload (XWorm)", "value": "1697192d8b707f96dc3ee1c409771b61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788907065, "uuid": "f47c78ea-b90c-443c-9360-73cf7198190b", "comment": "Malware payload (XWorm)", "value": "007e5fba613f08c75b4073409e63b03622623a4d12b25ab8bca74bb68db77f5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788907065, "uuid": "77a2f69b-9f38-44ca-876e-a14497a1cd29", "comment": "Malware payload (XWorm)", "value": "8dfcde94065c4858328741d9886e74fcb97143f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788907065, "uuid": "737ddbaf-f51c-4605-bfd5-99080d722c32", "comment": "Malware payload (XWorm)", "value": "07ea2424e240183cbf7c66c073b5f70a1292676cd95f8d7f4cc7d386484b2813ef338bff35cae9e3032f55f404347a9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788907065, "uuid": "ec38557c-cf2a-431d-90d8-88f731d14ce7", "value": "T115162319DBF569B8F0B3A5329E624826EBB37C094B305A9F139949975F33AC04D39313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788907065, "uuid": "080be3f2-1713-4837-b4ee-d1158b5a1e4d", "value": "e715424ebef62edcf8229c713419932e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788907065, "uuid": "afc38bf6-43bd-4912-9996-f55d20d4a139", "value": "98304:MCf9xH6tE/9WFJgJEE/ZMuMg/5FePiSSS/VQBmFxcSVUT8GEXqqn:BFxHiE2aVDbrkISd/FxhVUUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788907065, "uuid": "8f992ff6-9ea7-4993-be92-45e6b48290c2", "value": 4391547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788907065, "uuid": "06dbf3cf-bdf3-4c13-8e10-c8052fe88769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788907065, "uuid": "aad91deb-2211-4c20-ae11-47e43f089e76", "value": "executorfree.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ea6b3b-aba2-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788884915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884915, "uuid": "8e48723a-07f2-40b9-a1d2-b6b84f665d6e", "comment": "Malware payload", "value": "13c8bdc7a2f0cfd81594705c3305a463", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884915, "uuid": "edb065c2-1405-4e1c-8b5d-9310a1bf95c1", "comment": "Malware payload", "value": "00d892c3c2f3d65cde491e28ac5c0661c294c56dd8ec09e36768d7c541a1d7bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884915, "uuid": "ac0c6232-e079-42cc-8159-85d1c6228262", "comment": "Malware payload", "value": "cce2ce82e0faba91dd1872fdb6e1efd2063d4dc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884915, "uuid": "aa4a4045-e4d6-42bd-b70a-d42a419dfde8", "comment": "Malware payload", "value": "bcf70937eeec48c30f59729c25ee546bdbb69eefb2ad40a9ba257d95b941d48f3f74089ae70a584f9243c2dff7640146", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884915, "uuid": "62255f84-68d5-4235-ac48-a8727bfc2cfb", "value": "T12262BE10D29ADC46FAF66EB047ACD3D233E05E8E7B9584E14710EF887C02217B6079D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884915, "uuid": "e080680d-d6d1-46f1-b98b-6830e9595e16", "value": "384:ZKilclbY1mYLKQB5ZDzgbnzM4uVcqgw0OLM+XO:4i6wLKQB5Zww4uVcqgw0t4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788884915, "uuid": "7df9e385-9c00-4d6d-8c36-619a6b322b97", "value": 15220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788884915, "uuid": "24ec3c8c-e6c8-4add-aaff-c556ba7af4a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884915, "uuid": "7a8bd5a4-8396-4cf6-99b6-1217232a7d59", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "880bf1d8-ab72-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788864382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864382, "uuid": "10d6c097-7a2e-4567-b273-dd0b85b99b64", "comment": "Malware payload (Mirai)", "value": "a6825c5742cbcc898924ca9d0b109ba2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864382, "uuid": "6e29a533-e7a7-4c10-8f0a-38ef29e1c972", "comment": "Malware payload (Mirai)", "value": "00e531a66d4f0763b70298f3b5c6e76a91e5cc744dad375c71cacc201b3d5f1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864382, "uuid": "733d286c-8f86-497e-9fa7-389420d0c2af", "comment": "Malware payload (Mirai)", "value": "9b741d71846c505dbc59ec3d2c0ceab7e05bf7c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864382, "uuid": "3b2d08fc-4838-4375-9dd5-bb25005031b1", "comment": "Malware payload (Mirai)", "value": "3291d090a4321c2ddb3d638c70a58bb91d5e1065b8fd5042f3831e36218ebd503da7aca22d3b9c6c731a65386623f20c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864382, "uuid": "f0d81452-2873-4715-99bf-1e0283dcccb2", "value": "T152B2C0CC61943084C98D7C7C178D4A665F6CA1C0BAED9B26E350CD98B3BEA8F345D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864382, "uuid": "9ea72e1f-c4ba-473b-8f51-032b385dd529", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpDZqSWvw:4QlS07FUXqIYSXQKquVqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788864382, "uuid": "fdf6bcd8-81fa-48f2-8eda-621e2e829fab", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788864382, "uuid": "94cdf024-862a-4f10-8f1a-4ce0082eceb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864382, "uuid": "155b456f-cfa9-430c-80b5-6b9ccad89bfb", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e316dc9e-aba5-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788886439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886439, "uuid": "e5380eb6-6c8b-463e-9c1c-75fe9e883dbc", "comment": "Malware payload (JOMANGY)", "value": "60f1c1db16e046b9039797febeb7c6f4", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886439, "uuid": "b3409903-c963-4935-8b8e-58c744a7b52b", "comment": "Malware payload (JOMANGY)", "value": "015be573b9de2b8a44cbe8ff282b897e178cb11307af56fc1856f7c2d9f6c434", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886439, "uuid": "71040da3-3dc1-4031-8a15-8262273851df", "comment": "Malware payload (JOMANGY)", "value": "ce4324bd7f544510607b59bcc037ee1b18c9bcca", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886439, "uuid": "b1300056-8bbe-424c-bfac-3ff9fc997950", "comment": "Malware payload (JOMANGY)", "value": "791fa7992bb60070aa2e5c32f51607e4e2a46f759c447026a824084e0f775d18f932a506cb2d43d8df418e23be32e263", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886439, "uuid": "8e10ee8f-451e-469f-891b-eabd331454a8", "value": "T181C28D966A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886439, "uuid": "aa52492d-6b49-4fcd-af22-b85cda012777", "value": "768:N8vCB+25j6es8Rvx9FYpMSUpi+20qUpi+20YQX:N8l25JPd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788886439, "uuid": "ce11a5a0-1af5-4ed9-a3a1-6bc3c0f808ac", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788886439, "uuid": "191f27d1-a004-4368-be18-d80de9dc8c0c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886439, "uuid": "dbc032dd-9c00-406e-a675-67e90698c9c2", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df828b56-abaa-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788888580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888580, "uuid": "b9f22434-2a14-49d6-917e-9e67afe53064", "comment": "Malware payload (Mirai)", "value": "5ea2385b5dd52165683564eda976b61e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888580, "uuid": "7735adcc-f93c-4133-9198-b237503fa663", "comment": "Malware payload (Mirai)", "value": "01dd5723b2231c280497b0bb11ed1c03c8b030265d4c6292679859ff3f30b8b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888580, "uuid": "f7e60218-2f9d-48e6-8be2-9903307d58c5", "comment": "Malware payload (Mirai)", "value": "b32ebba7a9da537dcfecf8fdc9a807082f382114", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888580, "uuid": "fd0c6cf5-b63c-4518-81ea-eec39cd34230", "comment": "Malware payload (Mirai)", "value": "98388b340b55c750d840450c1e485418014d3a43e947993d6fc4d76950f3a8190034026979b76400bad3b687a66f2aa0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888580, "uuid": "faf52f9b-6a70-42c3-803e-10bd3ea5107e", "value": "T13533F1E5E391C775C07F14B4062D39D40445C24FBE64B57F8EA13A3A8A73D915B84A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888580, "uuid": "44ca7cab-cd43-4a2f-8996-ed27785b5796", "value": "1536:K9vWkKQmsCi1rbU9Z06jFTqHFOrnouy8j4:K94ihbU9ZvyFCoutj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788888580, "uuid": "354f28e7-e889-4aaa-b60f-55245a5581f6", "value": 51464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788888580, "uuid": "1ab7f09e-f3ad-4359-82ce-758f2f752ad6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888580, "uuid": "2dedbdef-195c-4409-828f-d413b9a69285", "value": "01dd5723b2231c280497b0bb11ed1c03c8b030265d4c6292679859ff3f30b8b5.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc1f164-aba6-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788886648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886648, "uuid": "aa60ff91-0ceb-4e23-83c4-24c249bf74f1", "comment": "Malware payload (Mirai)", "value": "67ca6921811b51d1e47dff2e9f20da07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886648, "uuid": "bab76c5a-214b-4025-8e7d-afecc79d419e", "comment": "Malware payload (Mirai)", "value": "0289d4324ac019dd949415ff1d4ec2d9441b360308911a53e7f4fa0c35a2dd0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886648, "uuid": "2818fe54-cb5b-4016-9361-8ba692dc29ef", "comment": "Malware payload (Mirai)", "value": "a8ca6f148202f7c178bfcc8446be7438240c8d7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886648, "uuid": "cef69293-48f1-45e4-a810-58080928a9d1", "comment": "Malware payload (Mirai)", "value": "ddd0bd5c0515b5cbfed3331615a865b40d38ce488a0f9c647fa86c6f58f9bcf52d8e63a03e5a1c27ca946cd2bef4faed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886648, "uuid": "1dfa3bc5-b2de-4f4d-9d57-3c62a8e4c17e", "value": "T1E0C35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886648, "uuid": "fb247a48-a66c-4823-aae8-53fe4feaf0c3", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHo0rScVM/9OAvjik:cowpuQyNSG24a1styKdlTuI0rSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788886648, "uuid": "bc44dc44-3655-478e-bf6f-616699330de8", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788886648, "uuid": "068ab5f6-c6fc-41cd-ae82-a5b8c7adf070", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886648, "uuid": "7264d3e5-9028-4338-abca-58948c991509", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b150a51e-ab43-11f1-915e-42010a9c000a", "comment": "Malware payload (ConnectWise)", "timestamp": 1788844265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788844265, "uuid": "fdbb0fd4-c1ff-407f-89f9-64752ea0db71", "comment": "Malware payload (ConnectWise)", "value": "ec792503b1404197ceecc8a95bb0013c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788844265, "uuid": "0270762e-4dff-4aa8-9fc3-3d42ca1e1827", "comment": "Malware payload (ConnectWise)", "value": "0389d005d024a6bc0e2900361aeab49c685850294ed8ee6c2bad2fe6ab9e2f0b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788844265, "uuid": "e7547434-1063-4f1f-be9c-a2430e6307c0", "comment": "Malware payload (ConnectWise)", "value": "520df4eedbe16a4ba2f639202242004dbb3da6d8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788844265, "uuid": "d1395929-44ae-47ab-a980-f47fcc5ebb7e", "comment": "Malware payload (ConnectWise)", "value": "972f84c5ecae7a9a305eab1dc0bec4a493079a8356cf485c61b677d7e2559c4e2507f54e5b0b0cf85c75dfbeb93d3166", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788844265, "uuid": "ad36e4e9-14c6-47cc-8b3a-d4e7df2a4967", "value": "T1FAA623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788844265, "uuid": "465150ef-ebd3-4792-8fc9-b3f557d61b9b", "value": "196608:5nCtVYqI5MvbWEpKkq6IJqKCnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqEnCtO:hCXvI5MvHx2JACXvI5MvHx6CXvI5MvHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788844265, "uuid": "d486073a-1d11-4b54-9a2d-6fb50f62034e", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788844265, "uuid": "89b14209-1e9d-47fc-8504-c48d9c6636bc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788844265, "uuid": "1fc644cf-c6d6-4272-9405-60d2606fdc3e", "value": "0389d005d024a6bc0e2900361aeab49c685850294ed8ee6c2bad2fe6ab9e2f0b.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1462d86c-abcd-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788903272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903272, "uuid": "b284fbb3-4e97-4c2d-b56f-723e8536997e", "comment": "Malware payload (Mirai)", "value": "883871dd31d2d7fe20cc5b7e2df2a982", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903272, "uuid": "6ef9e71e-5d54-4fd7-98b6-0247c7f17b91", "comment": "Malware payload (Mirai)", "value": "06710dd73fee4a517b98dac1823e091bb3defdef400d7a20c65ea78eb85c0f52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903272, "uuid": "d83fc890-ccee-4c57-b7ad-7c9eb1e39f51", "comment": "Malware payload (Mirai)", "value": "703e2c761e18262eea572d4ea462b041a3dd8aa1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903272, "uuid": "acd5b99b-3e6d-445f-a2d2-0a2a7b717219", "comment": "Malware payload (Mirai)", "value": "9e932481be0bc434faa1ac1d80bd50c5bbf9e638b3d5e4bf3d6c7cec50dc5f6ab2dadc8b488d4d59bd176b40d8b5fed4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903272, "uuid": "34620db2-37ca-4bcc-9a3b-32ef11ef3a30", "value": "T1C9A34B227D721D2BC4D4A47962F70335F2BB878A217C8A1A7E610E8CBF756407257BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903272, "uuid": "82c1953a-8ad8-4b3b-8b0d-bbe4b7f40307", "value": "1536:QtEUXWrES+aThR01EBhgM1pgMu8FqtcUL75YzR03x2tXhNX54MXNPc:KXZkPg+po2+V0PbO0N0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788903272, "uuid": "e4b13e41-6609-470b-a47c-08546e387239", "value": 100684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788903272, "uuid": "19af75ba-4ba1-47b8-82d4-9cd655102ae8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903272, "uuid": "26b37ba8-b033-453a-b8a4-f99c272e5c0b", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96cdf6a5-ab9a-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788881586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788881586, "uuid": "e54c4f8d-b44e-46bf-8f75-2791cb8f4303", "comment": "Malware payload", "value": "f2ac62849ab78fb984af92b99c721991", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788881586, "uuid": "265b699a-efe2-4e3f-b10b-cec973208a91", "comment": "Malware payload", "value": "06a82fe1700db9bf3ceda7ec8cd8d6f3923919bacb0c78d54e1477f92e74cffa", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788881586, "uuid": "b388c4e8-fd12-40e9-858f-3cfdc25b2ddb", "comment": "Malware payload", "value": "d2f153e5bdb8c18105bf4b2027af7a14a534c60f", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788881586, "uuid": "c92107c3-3e00-4932-8ca5-0b4d4dae692b", "comment": "Malware payload", "value": "98f0331788418c289d9c2ce444be247152d8165cc45d1c6775fe88fe631db9fb6da49dc9af25750e7cb57079d8360f10", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788881586, "uuid": "660d5130-ff9e-4ea7-bb33-0ca1aeea4d12", "value": "T158C47D59F5A411E9E17AC2B4CE439513F7B2B8481370AADF03E059772F236A24B3E761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788881586, "uuid": "f2abce46-cb39-4f88-a841-f965cba60552", "value": "d2441e08cd14a63b72ecff236fe48934", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788881586, "uuid": "8fe70999-02e5-474a-9240-d4ade6254c77", "value": "6144:3haBG3n5dfk6gKyzcyqh/WlX9xCeYoYUf9UcWXEt0KFMQVe4/mdvlXmwnJpicQmK:JNgKyz/qhelXDCh9MMXFmXmPXgc7uN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788881586, "uuid": "dd634b3f-8f54-42c3-9b1b-b239c550b457", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788881586, "uuid": "3a544e4d-8bc1-46a8-aa57-df641e5a3430", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788881586, "uuid": "cffcd949-b192-485a-9296-6cb1121e936d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af1854d2-abc6-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788900525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788900525, "uuid": "9aba06fa-5510-4690-8c4b-b5dabbf3d7fa", "comment": "Malware payload", "value": "ac7fe584292a2a1061310bd694948551", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788900525, "uuid": "daf10799-058f-4f22-b786-12b4a021ffe5", "comment": "Malware payload", "value": "073bc6f44e0f2c23183f87f73e413e74e21d185f2974183d9b5ca1cb8bd3e1d7", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788900525, "uuid": "9b720fb4-3e56-461c-b588-a108c80264c8", "comment": "Malware payload", "value": "d169a040985fd55840fa449bf5012dff81e0144f", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788900525, "uuid": "f2a12094-0b36-4809-8185-a47b30f0e230", "comment": "Malware payload", "value": "27b7a46faeb148278cb0576257a90c7cfc8b92a97f5dc2841f5e82717df7a7afa8ac6cc641d820ffead625724bfb4751", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788900525, "uuid": "fc299aa4-5f4b-40af-9e33-643588257a98", "value": "T1F5E6C003EC5548E8C0EBD13285A38513BB21BC895B2577D71BA0B229AF72BD06F7579C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788900525, "uuid": "6b628cf1-46e3-46e0-a6a3-c860f17ab05c", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788900525, "uuid": "ca44730f-7645-4556-9556-006f42659979", "value": "393216:OJ+8dSYRG13q8kLgcUKgu+jeoZxA+aJ6y6Un:OJrG1LuGfvvoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788900525, "uuid": "4a203715-cffc-4514-8bc8-7ef789671efd", "value": 14683136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788900525, "uuid": "be4239da-cc4f-4d2d-a046-83e81daeaaea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788900525, "uuid": "d5af7182-1d43-49f1-9c85-ec7fa4a3834b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e44e23a7-ab95-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemusStealer)", "timestamp": 1788879569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788879569, "uuid": "a1b9af8d-9090-4352-9c0e-0a7eb790e08d", "comment": "Malware payload (RemusStealer)", "value": "9878c275a40bd2d6f63698b36c65890b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788879569, "uuid": "e8833428-597e-4f5b-aefd-5260ea4781bf", "comment": "Malware payload (RemusStealer)", "value": "0917ecd8ebfb2ef6f9fb4a7687ca51e842bd9edb1a1e24b30803e3d213cf324f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788879569, "uuid": "2212dea1-c0fe-46c7-adfa-62fa1cf87703", "comment": "Malware payload (RemusStealer)", "value": "a8eef4f895067616efa923b072fa0cf98b65b2a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788879569, "uuid": "c55318c7-5060-4643-b41d-9988148b4f6f", "comment": "Malware payload (RemusStealer)", "value": "49283a32f0b403afab67bec13d337fc774f5a2c8de8ef5b4e26cb117319fb5f9a48981e6ea759d4bbbf223cce96c4cdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788879569, "uuid": "de8943b2-1bc9-4725-ab34-b87dc962d7bc", "value": "T1E3073A17FA9110D9C45EE338866B17527B30BC4D9B3273E32E916A743E66BE2AC75700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788879569, "uuid": "2f5321d5-a7d5-4555-b6e0-3ff75e334922", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788879569, "uuid": "14b69051-b5df-4590-ae3f-877afdfe78a7", "value": "49152:hZ5Wre+Zk4phU3MJ7CAsGllFvmSD4O//eDP66y8rpxxqn9HsWORudliSFgQ0JA8U:hZ5v+2wZtPpiZps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788879569, "uuid": "1c4856f1-a9f9-4f9d-9715-c2b391713432", "value": 18140960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788879569, "uuid": "f990f6a7-2003-4438-bd1e-aef3694e4025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788879569, "uuid": "e8b8f8c1-a711-4dd2-83cf-24f2b66bf745", "value": "installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cefb9e4-ab24-11f1-915e-42010a9c000a", "comment": "Malware payload (Snowlight)", "timestamp": 1788830916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830916, "uuid": "ddc0ab48-2d71-479b-ad1b-f981bc6553cc", "comment": "Malware payload (Snowlight)", "value": "8ae0e988bbd97af193982dc39da4fae2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830916, "uuid": "f676a195-02b1-4ff6-994a-887815e5d5c5", "comment": "Malware payload (Snowlight)", "value": "0b4820e8fe52ae14b18ce28ace05605609139bf43431859fd1d5f36132af39d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830916, "uuid": "efb5897b-71ba-4ed2-9567-40963a8e36de", "comment": "Malware payload (Snowlight)", "value": "cb42d118cd83a1a0d8e7b7dabbba28a6c6f3f4cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830916, "uuid": "7a5b0c1e-a7b7-4f33-b04c-a56a50a0558e", "comment": "Malware payload (Snowlight)", "value": "28dd903cf9a047bb909be3d9867af4e9b6512a4a447b28cb73eebeb06dca97bef5a79b6c2ad1137737a92fc903ed515f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830916, "uuid": "bf41445d-34da-40ba-80fa-9ffff709b75a", "value": "T1F3E16017E2E2CD32D8D4137E55930A1A223DC8659E83DF132E0C896D2E537DCBA72B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830916, "uuid": "185acdd0-20cb-48f3-98f5-adbc45c27475", "value": "96:f6u6TiUBOUw30JheuhiL5Zz/cq/BK+M3mh/W785/f7kbalBgBi5pzBIQ:fEcbEJhA9Zz/cl+M2x/fLbpziQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788830916, "uuid": "0b0264d7-b782-4de2-b5e9-4dfbe820fa19", "value": 6968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788830916, "uuid": "332423ea-59e2-4895-afcc-0e42ce60d177", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830916, "uuid": "91b0acc0-5897-468f-9efe-fe3f96599831", "value": "0b4820e8fe52ae14b18ce28ace05605609139bf43431859fd1d5f36132af39d9.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69f426d-ab28-11f1-915e-42010a9c000a", "comment": "Malware payload (Vidar)", "timestamp": 1788832731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788832731, "uuid": "d5be6638-af00-4af6-9da9-df9cac351551", "comment": "Malware payload (Vidar)", "value": "bedbf012561c71bb4a9a65c2984b400a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788832731, "uuid": "90ccf3dc-b24b-4da4-a269-b5e2204fb5a0", "comment": "Malware payload (Vidar)", "value": "0b5baefd7cc0b2f4ed9a537ec813ca59130fe2d88783971687d8bcfa50015ff0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788832731, "uuid": "076eabff-1494-488a-82b7-30bcf2845240", "comment": "Malware payload (Vidar)", "value": "d2ef8967da190d374da416b080051a19e56f1947", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788832731, "uuid": "71dc7b68-157c-43e8-b1d1-ab0abeea0b5e", "comment": "Malware payload (Vidar)", "value": "b2525e1bc050e178beb31e1dc8f51e7d4922f64cffeaf51bf69ff953ce75324d9dd549266c496f88198f48f7f61c58a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788832731, "uuid": "4c29a5f4-9e4f-47ca-9329-c5485a5e979f", "value": "T175E58D476CE009E9C4AA963289B75191BB75BC040F3223D76E50B7783F72BD18E39B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788832731, "uuid": "df19abba-5048-4e13-94de-bbe948baad95", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788832731, "uuid": "4574f2d7-142c-4625-b016-084fd98c73e8", "value": "49152:j08NnZT2vRs/qCIw9XYfOhXSh3wDPxdhOz6JS/:jLN9za22wDPNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788832731, "uuid": "c9e139fc-0868-49da-817f-275b55c13a09", "value": 3162480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788832731, "uuid": "b94594da-1632-4320-a5dc-780b3cb9988f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788832731, "uuid": "972a3595-2bab-4171-a536-6fa6244987c4", "value": "0b5baefd7cc0b2f4ed9a537ec813ca59130fe2d88783971687d8bcfa50015ff0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793a76e2-ab5e-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855767, "uuid": "84a81a46-92d8-4b15-a571-a8d816e5f543", "comment": "Malware payload (SilentNet)", "value": "a5fd1dda9fd9746a6b21dcf2a6ee2160", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855767, "uuid": "16ecd8f5-9c96-4e6e-8931-884cf334c860", "comment": "Malware payload (SilentNet)", "value": "0b9186fa35770dc3b4b121a35551d49c6d623c0cd8dafbc5bafbce2d5bdcd7f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855767, "uuid": "28fcab7a-59c8-43dd-8875-abb888462cce", "comment": "Malware payload (SilentNet)", "value": "cca8db27a784908e40544eda5f3d327e1bd1d088", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855767, "uuid": "0c9b0ffa-9171-425a-87d4-b88d9ddfe640", "comment": "Malware payload (SilentNet)", "value": "0061a2457d6af50e14ebe03974fa7189cd65cf76d49665a8616989d4de02d096ea79baeed352be16bb851abbb27cbea3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855767, "uuid": "f4758614-8123-4f7c-892e-bd916f4cc40f", "value": "T16F357C83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855767, "uuid": "0f84f2ca-6541-4888-b42e-df1b025f409c", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855767, "uuid": "f2a4892b-f496-4210-a3fa-e67aac13a118", "value": "12288:igbs/m0E54jwaFXGc8lEBBBHGBKq2IZwDYIvfqItNqdg:5bOVE5ifGPRZwRvf3fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855767, "uuid": "7361ea5a-3da9-4625-b1b9-1b6b30cce5f5", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855767, "uuid": "a576a7de-48bd-4674-9be8-5f0140a564dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855767, "uuid": "37dd112b-6a2a-490d-ad0e-520f2b71c90b", "value": "V4L PR1V4T3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112a7632-ab52-11f1-915e-42010a9c000a", "comment": "Malware payload (JOMANGY)", "timestamp": 1788850438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788850438, "uuid": "42ab0243-3d4d-4962-a01b-e61a6115ac1d", "comment": "Malware payload (JOMANGY)", "value": "00206f712a45c734dae9012fc9c60ae8", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788850438, "uuid": "af3170f4-09ba-49cf-aef9-6738f0f4cef3", "comment": "Malware payload (JOMANGY)", "value": "0cfef126d2a0df0d4dde9c9a5f5ededf91cf022adee472e38902b0825d37122d", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788850438, "uuid": "56248ee4-ad7d-4698-afdd-1737c29cb6e4", "comment": "Malware payload (JOMANGY)", "value": "29d5de74cd66580b2ec90a86fbd907d92c37a323", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788850438, "uuid": "79a479c1-5274-4df7-b997-9c19156d9417", "comment": "Malware payload (JOMANGY)", "value": "f0937b65801f23632a3c984d3f8f8112b600affa15f0ddf068c3cffbe1bff276d61a77a272350d379eea87b98d08dd90", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788850438, "uuid": "24882d68-f50c-4e60-bf21-93596cef6a7d", "value": "T11B237D552A817C14AA98C4371D7E2F0CB9AD43E6320492ED7FCF3CF68C5A69DA11871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788850438, "uuid": "30054293-40c5-4aa1-b119-f81159d449fa", "value": "768:JXOGVvn9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:1L4cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788850438, "uuid": "367c9d34-fca1-4aa4-beb0-a074cfa2a06d", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788850438, "uuid": "b4f94ea3-ac9b-4680-b30a-6ac6ca0151df", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788850438, "uuid": "d2bf923b-5bee-4380-8465-785abe73a3cd", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679ce4bc-ab25-11f1-915e-42010a9c000a", "comment": "Malware payload (VShell)", "timestamp": 1788831256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788831256, "uuid": "c7ccb527-250c-4d47-af41-efcb180f225a", "comment": "Malware payload (VShell)", "value": "a8600fe6786c4a1a45c1f875555efb13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788831256, "uuid": "5d065edd-4c70-49ff-a655-5437781d408c", "comment": "Malware payload (VShell)", "value": "0d1aab5e2557315556d1a50f58f538e8bc0911e9f0dcbd8c33e9b20841caa369", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788831256, "uuid": "2354cf71-63fa-4993-b451-41c4e3a952e1", "comment": "Malware payload (VShell)", "value": "462c2491e7a7e919848d6dc58eb9a0b429dcb28b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788831256, "uuid": "ef333129-c3dc-4e22-ae40-daf98953863f", "comment": "Malware payload (VShell)", "value": "24f4092226315fbfc37970cd9b6cf7a2d3aa1892da411b15d1e47b54737c9cc0ab150cd112ca48984d1fad2e0de84cf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788831256, "uuid": "53c04e0e-8c90-466a-9d69-6c329bb95c74", "value": "T1D691C64270B989E7E85D45BB4C0FB8A0B919740A41C483A60378A5953E3957BF57CB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788831256, "uuid": "e7be2ba4-0b28-442b-8c12-910cef35e333", "value": "e82dd51b077167be63c004bed23d0c1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788831256, "uuid": "e626193b-b59d-486a-abfc-3a573250f3bd", "value": "48:6IIF9BlQaexEgZoB7An0cF5uduvxRxUjbON9XM/ge93ahr0/:y9BOaMN30cF50uDxUOvXeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788831256, "uuid": "e71145ea-7ec8-45f9-a872-819c28d624c0", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788831256, "uuid": "d0f4d6a7-ea74-4608-94b2-ae17aca759a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788831256, "uuid": "decf0a24-e549-4b70-87d8-103390a18b24", "value": "0d1aab5e2557315556d1a50f58f538e8bc0911e9f0dcbd8c33e9b20841caa369.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7526caf7-abc7-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788900857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788900857, "uuid": "ebf49e61-81cf-4877-9f1e-431649bb2c5e", "comment": "Malware payload (Mirai)", "value": "8ed846195f72a7127631a375ec0b0f41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788900857, "uuid": "9023a366-492d-4bf8-b9aa-eae40520c0aa", "comment": "Malware payload (Mirai)", "value": "0d85349b8f1c736d103ac566fbf28b895e0565c545bece7633ff19778f40408b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788900857, "uuid": "cd63cc93-62ce-4471-af5c-c4980cef5f90", "comment": "Malware payload (Mirai)", "value": "03b772f20f5661ea53f82edbced90813ea415576", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788900857, "uuid": "032f48c0-9e6d-4bbd-b193-4d9b8c29222e", "comment": "Malware payload (Mirai)", "value": "daf2c0d4beed404f533f4acea6a3e68d8c143a8d6f5b98124a93b533913de3c697d10ee1fe589ab65d883a40f45914f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788900857, "uuid": "b0a9b051-2769-4a65-b32d-37432e55bd4e", "value": "T1D6B35CC5F683D4F6EC6255756027F7374B33D839503ADA87D3ADAE32AC226018A1A71C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788900857, "uuid": "9cebc4c3-6391-48bd-8fdf-a01c307f0df3", "value": "1536:udlPRrwXZaqgLKiTPtJNDPDoAcy/QQF7D2Vhu9vHX5EO5SsXhsVMb6ZTJD:A5r7jntjDMyODoHpQsRFKTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788900857, "uuid": "77ce2e04-59ea-44d1-8961-4b7addc7609d", "value": 117120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788900857, "uuid": "0a03628a-db28-4f41-be60-33b424ba699c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788900857, "uuid": "e696cf89-490e-49d1-bd5d-cc4108aa9809", "value": "7b93ebd36c707e336610fd34e41c17d276b85840b773b4063141a5acd3200027.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f83226b-ab82-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788871293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788871293, "uuid": "55034a3f-b5d4-428f-a8f4-e33db4aa98bd", "comment": "Malware payload", "value": "a12f4b4c276178f00731a42f237deb71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788871293, "uuid": "01e7f4de-9f28-4dd8-b8a2-fbed7bf86481", "comment": "Malware payload", "value": "0dbeadc82062b60c81ad99987db4d5ee7db97bf3b7ae3c2a2a16740b9800820e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788871293, "uuid": "984b9606-2dcc-484f-86d7-efd6ec5e7d8d", "comment": "Malware payload", "value": "118743987718287685a6f7b646696152746d7007", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788871293, "uuid": "34e12980-4c37-4779-82a3-9c8a3d82b36e", "comment": "Malware payload", "value": "ebd6bb14eaa12d9a137672d54cbd5c8f1c1b1c4617699d9d953a1232a150e2986e388e4be9668afbd28a288ba23a2943", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788871293, "uuid": "6118f7e0-dbf5-4dd8-afc1-04dcc061fddf", "value": "T10147DF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788871293, "uuid": "85379650-0394-41b8-83ed-6b233f830f97", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQa:cqYUQuVDt0TZER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788871293, "uuid": "d2a265fb-89b8-4b99-b4cf-ef8d0fe84158", "value": 25296896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788871293, "uuid": "4f7ed2f5-8b50-4570-9644-24a2310a93bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788871293, "uuid": "ea6d3df7-9296-4e63-b1f8-94392c51cd1b", "value": "0dbeadc82062b60c81ad99987db4d5ee7db97bf3b7ae3c2a2a16740b9800820e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27cc7747-abd0-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788904593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788904593, "uuid": "6c792f0e-42db-45d6-a94a-0f9697da9dd5", "comment": "Malware payload (Mirai)", "value": "09dd70265a218b41b2f0af7b5cb1cbe4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788904593, "uuid": "b4da3027-fdff-4daa-9d72-22f9d376f92b", "comment": "Malware payload (Mirai)", "value": "0e4ed32d4ca30f45369fa17f7a8b90c0fa9f2f9ece78048c6922ccaf1853bd8d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788904593, "uuid": "d1e922ad-fe20-41df-a2d0-9b540ec71246", "comment": "Malware payload (Mirai)", "value": "5d0d0b004ce8a9e914025db2933e4217749fc44f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788904593, "uuid": "224199b7-1500-414f-ae37-44b8168594c8", "comment": "Malware payload (Mirai)", "value": "4e328077a2240087ed2b7310562f3fdbda9bfa4a5a730ffe54614cafb23b8c18eb4d0dae68c0e775a50ca9798f055fbb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788904593, "uuid": "7bc9e462-d838-4e5f-9543-a97622e776b7", "value": "T15131A48E50240E314212CA9E7377384CF18DE1F72A9FD7D598481EE957882CCF2A6B4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788904593, "uuid": "ed16794c-04d8-4130-ae67-f34694b5224a", "value": "12:U176/NpxBB76BdbtHvlR6s8Qr6Mf9LbdKwr6oBcQx6QDRDR1JR6J/Px6P5wc3DC4:GylsjHnz08VPd91vDCe1twmDcDk+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788904593, "uuid": "6bffc2b4-e4c9-414f-bc34-ce5cc91fe82b", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788904593, "uuid": "c95a0780-9947-4e6e-8d5f-26056e338a0b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788904593, "uuid": "6965906f-83ec-4f5a-b128-2ba5f8e71848", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804d93d5-ab86-11f1-915e-42010a9c000a", "comment": "Malware payload (RevStealer)", "timestamp": 1788872959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788872959, "uuid": "062db8fc-ff62-4e36-8fd2-9176f83141ac", "comment": "Malware payload (RevStealer)", "value": "ffa687fbfaf48299c074d953c8478776", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788872959, "uuid": "0b1c1c18-4d66-48b3-a6f5-8396b54572ce", "comment": "Malware payload (RevStealer)", "value": "11b4c154870b507e05c90ccadd1a3cd6b96a09b2b3d8f415ebe020262f11b007", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788872959, "uuid": "3fa27e1b-e121-4546-b0cc-246c44c6bcb1", "comment": "Malware payload (RevStealer)", "value": "1cf2ee3805bc361f27b49ba3b881b115295124a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788872959, "uuid": "54446147-78c4-4ea1-8b7e-d0b607672d8a", "comment": "Malware payload (RevStealer)", "value": "8b33aafef7795ff1694707ef791b95e2e7ca00035cd8945c81c8f2d9b16076faf6d9ffb07f7805aafd3b1688280d13e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788872959, "uuid": "0e830b20-61fa-4c3e-83f0-a124a550c58f", "value": "T1E1D52288BDE20DB2E436C37397D3E06E7129BB4446B08D5779C86B056E528293D7B378", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788872959, "uuid": "860b780d-a8cc-4a8d-b8eb-e964c9770ae0", "value": "5a2ed47d8c6c6433dbc831d38c92042b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788872959, "uuid": "17c6805b-eab7-411e-9915-6e76fab07408", "value": "49152:qwjbcVfdXMEpVaDyEtRbfEib++TYmqJD1lnDu5a5H5iT502bLfzRDbMdr8XQ3nsH:DjAfdXBa5tRbsWNYHJJlnUat5w5dbLfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788872959, "uuid": "a73c34b4-3cf9-4d57-947a-c428501e903d", "value": 2984960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788872959, "uuid": "56115662-6ac4-4077-af01-f033e2632883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788872959, "uuid": "a7c5cd95-f685-4ee8-9db7-5a4e7d753a83", "value": "11b4c154870b507e05c90ccadd1a3cd6b96a09b2b3d8f415ebe020262f11b007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33751cd-abb2-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemusStealer)", "timestamp": 1788891942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788891942, "uuid": "0bea0298-edf8-46d2-b84c-90b9b5dd8f45", "comment": "Malware payload (RemusStealer)", "value": "d253a31a21a6d91c3958c49cd0b723ba", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788891942, "uuid": "4719f864-1653-4335-a741-999f331b7c4e", "comment": "Malware payload (RemusStealer)", "value": "11db652095abfe193306e29164342735aeb7c6bdccb51a966c97253535c61b7f", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788891942, "uuid": "bba75487-2b37-4636-9551-793379d71e37", "comment": "Malware payload (RemusStealer)", "value": "26dfc2d94a2c5a8f10ddf14edb6acecccc7c8274", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788891942, "uuid": "8e300678-8c88-4f32-ac1a-da94fe6c994d", "comment": "Malware payload (RemusStealer)", "value": "11191ffb7fbf660cd2a5496a139ad9802fed029c2bdf254f12ebf212febca56024ef78ac479c954384bb02be82b2694f", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788891942, "uuid": "a5aa5af5-91c8-466e-9d88-ab026d99426e", "value": "T19A648D15F7A914F9EA77923CC9524506FA727C524760DACF03A04AAA2F237E09E3F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788891942, "uuid": "f3740940-3812-4dfd-864e-3b6513feea41", "value": "60420083cbef850f46902f930a3679de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788891942, "uuid": "88cafc82-da82-4b01-a95c-a9e5bdd868f3", "value": "3072:6eAxjQBULkLjstRcnU6s1OB/N8MdRsr5xBP5LKDmVb9CeNHsjHvd8yMGTHYHOtKi:67xQc1u18aClHgSja+HXMCBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788891942, "uuid": "1d826345-d9cd-4a44-aadf-f2b05e289788", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788891942, "uuid": "c03c91e4-3b57-4e2b-8bab-84c24e87bd72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788891942, "uuid": "e18a4a98-649b-48fb-9f1e-f5e88cebe26f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd3793e-ab59-11f1-915e-42010a9c000a", "comment": "Malware payload (Vidar)", "timestamp": 1788853627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853627, "uuid": "fd37680b-f42e-4291-bf5a-d85862a39e23", "comment": "Malware payload (Vidar)", "value": "2d59fa38dd0bda0896af9f0ee1c8f8e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853627, "uuid": "e2126172-97ad-456a-91ee-aa25b5c60502", "comment": "Malware payload (Vidar)", "value": "12ce747f92de61b2de345cecdf3e9378b6857d4715164d6b14b0c8986a833234", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853627, "uuid": "d993ac40-fef0-4630-958f-6e28a51224cf", "comment": "Malware payload (Vidar)", "value": "d5ea73bc169448dde2368ba716ea829bfba36ee7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853627, "uuid": "c876e90f-bf4c-4307-99c1-b533d8abd0c0", "comment": "Malware payload (Vidar)", "value": "eab988c13f86ab217cd8497b3dba461acb71b6e97185a16bbe331e567449746f95ddd2b624114efcb29cd32ac6c91efe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853627, "uuid": "40ea74fc-2c99-4460-84de-1bf6e8af9885", "value": "T1B6182201BE4A5568D08AC87493070A934F3170DB123AA9FF52E951683F9B7F4DB3E35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853627, "uuid": "bfc16181-2828-48ef-8642-eff103605a6f", "value": "093a6cd038fd14a54e7d359b46cb8dab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853627, "uuid": "aac17629-bd8f-4bb2-bb6c-6d0c96c4668b", "value": "1572864:Gr8mogV4xJZlzoZ5QEyIUeSLAsRFXgwV0td4yaw7LRDBGCj8qeum:Gr8NgVsMhyIY3RFwDr4JIV0ere9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788853627, "uuid": "dcdeba9d-e3f5-468b-88c0-9a1f461d1612", "value": 90279936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788853627, "uuid": "e028d142-da02-4576-abec-85e40d8eb775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853627, "uuid": "c00457b6-8260-4c93-95f2-439fd5c4bce1", "value": "2d59fa38dd0bda0896af9f0ee1c8f8e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc09d9b6-ab74-11f1-915e-42010a9c000a", "comment": "Malware payload (JOMANGY)", "timestamp": 1788865355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788865355, "uuid": "bf9195dd-5a91-4f7a-bfcd-b07306a595bb", "comment": "Malware payload (JOMANGY)", "value": "c7a0e8bc91a98784539047097e378ff2", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788865355, "uuid": "68eed57d-0afc-4e50-a921-120bd09cd709", "comment": "Malware payload (JOMANGY)", "value": "12d3dcb3d527c30a931b2d70e41ca29b25981765ef2f895a26a6deb3ca424fb3", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788865355, "uuid": "924db95d-a460-40b9-80e2-0549b695e292", "comment": "Malware payload (JOMANGY)", "value": "30902fd0800f33cdf22ac40603ac7265175d3937", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788865355, "uuid": "bc7db31c-a954-4279-9b6c-9a61da55ff50", "comment": "Malware payload (JOMANGY)", "value": "cd81d0886b3322dd29a42a0e69929fd954fdf33de263e2177d3680de2f7aca96cf752d3cb12ea92c3efbf37217c80f34", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788865355, "uuid": "b6367b45-f007-4265-ada1-eb9644f5e7d0", "value": "T103236C6516857C14AA99C4365C7F2F0CB9AD43E6314492EE7FCA3CF28C4A6AD9208A1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788865355, "uuid": "86e4d310-a71b-4ea2-ab21-710283ae9531", "value": "768:Yr9NyXsZztCC9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:GHusZicr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788865355, "uuid": "926b3f3b-4089-4b1d-88ae-6a95926659a1", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788865355, "uuid": "38fbab88-005c-433d-a69d-099766d5309e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788865355, "uuid": "f8f63a70-8be4-4964-9e1d-a2c5980b6bab", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a13d8e3-ab2a-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788833327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788833327, "uuid": "e6327ac5-a0eb-4b6f-b0a8-37918ecb986d", "comment": "Malware payload", "value": "e0607a3e5911960845dadd109397488a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788833327, "uuid": "ba639994-bc01-4d68-b9a3-c0a190bb4932", "comment": "Malware payload", "value": "12f496cdcf357d55002675e562864d201ecb9cd5956f76958da855ca9bf299d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788833327, "uuid": "7c21f653-ece9-4f5a-a33b-85b00b70e0a7", "comment": "Malware payload", "value": "29a6e5f52fd98311ac30686e9e2bcdbeeddc8a6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788833327, "uuid": "ab0ffa01-614e-427f-ab1d-1b36935d1ab7", "comment": "Malware payload", "value": "c33934706769cd2b0997fa5bb40959a8917c63a5616c8b6326e4c1240e68d46d7940898ef0cebe05c7f546587bc99a77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788833327, "uuid": "a98e050d-31b6-42f3-adef-140794b318bf", "value": "T1A926331CB59D322A309E70CBA512F3AB1EE714B31E828DE6497C563524FD1EEECC4199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788833327, "uuid": "66708932-b249-4dce-9bea-7d361f2375d9", "value": "98304:oGabQ93JrEQ220qaUqIK70XifIaGTVyCCxtDhA6B/Q5swsWFq+4:oGac9+1jUIAXifIdSxJ1wiWQ+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788833327, "uuid": "08506786-32ca-4511-bc0c-96580fd4467c", "value": 4645217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788833327, "uuid": "ba17e7ef-a793-4168-9a53-abf5693bc72c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788833327, "uuid": "570d6112-b8d2-4853-9e4b-c52e2fdf3403", "value": "12f496cdcf357d55002675e562864d201ecb9cd5956f76958da855ca9bf299d7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21aea03-abcb-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788902758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902758, "uuid": "5da76cb4-a32e-4d2e-9fd7-0b2362dde1b5", "comment": "Malware payload (Mirai)", "value": "6946a924cd0203ed19b02134d393354f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902758, "uuid": "b34d368b-949f-42e5-a322-bfaee3750c04", "comment": "Malware payload (Mirai)", "value": "1476885ceabb54b25f302d2fa363a87b3b11a4616328fa0844bb9e7a160d5946", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902758, "uuid": "23b2a574-51e2-48c2-846a-d6f555fe3a74", "comment": "Malware payload (Mirai)", "value": "cbbe184e2d8045ebb6e7d6a67ba9e3697067e2f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902758, "uuid": "267b8608-ed47-4f91-884b-3c0fe8c8f7f0", "comment": "Malware payload (Mirai)", "value": "fe38f3ea18c96f313a28dc8cfdd5322452c5d6758e9b961053c30a5730a0d642ef0b15ee0d5864997cd402e2edff6092", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902758, "uuid": "29eaaedf-7444-4095-8ce4-7821a2156c16", "value": "T1B8445A5AF462CD65F54209F498EEC2B03F2096E3273B2D50E5BB42F41B63469B847B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902758, "uuid": "6560a2e1-5e5d-4611-a582-e7a4b2366487", "value": "3072:cjwywiGCFa33/TBKoLV0dPV4a4YV8h/RxkG7hTQLqmWUqU:Sw1CFaLB9LVWd4a4Y85kyhTQOmWUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788902758, "uuid": "bd9824df-c26d-4d81-a17e-13c0e53ef993", "value": 264060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788902758, "uuid": "8f638e45-1aa7-4d76-a09c-5b5a69d97532", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902758, "uuid": "fc274f5c-24ef-4663-b454-4907fe8c3787", "value": "titan.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11fbe9e-ab5d-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855431, "uuid": "443d55b2-96eb-46a0-b89e-d9ded6b37372", "comment": "Malware payload (SilentNet)", "value": "4b509e9b38888f0fd5570e01d474bb4f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855431, "uuid": "b1e17908-1289-4a9d-bc4a-eb886b5c498d", "comment": "Malware payload (SilentNet)", "value": "151b045db157a1894b7f1b3a7cda38869ad53b673c56d3dbe10c7251a7bf74e9", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855431, "uuid": "4dc41e99-023b-4a21-ae16-d61fe8a0ae99", "comment": "Malware payload (SilentNet)", "value": "43bf154eda1c91fa229b9a87ecd2230545d39921", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855431, "uuid": "7ca13f32-fae6-42b8-aaf9-217f57219c7c", "comment": "Malware payload (SilentNet)", "value": "a9fb3fbc8d7aacbc8b00257f8241992b98cd300df5ac18502c41724e1209eb6380e342220eac343c1e8c1ae9954de69d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855431, "uuid": "2002bd17-76aa-4392-879b-96b2e32a22fd", "value": "T1AB252373B34D1137D897B27135115F116A2E63F0E406E2AB6BB808962ED98A91F0F73D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855431, "uuid": "a2154961-4392-4ffc-9bbc-9569f5983415", "value": "24576:pfEyZQx67RDARl6quP9M2j2hWS/vMFfefJKcnh/FrcmaP:pp5WRl6tdyhZfoMF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855431, "uuid": "19d50aa2-0779-42b7-b75b-d70ce37012ba", "value": 1007013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855431, "uuid": "bed48f1d-01ac-40e1-ab54-4ea48526de23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855431, "uuid": "83f71c6d-7c6d-4bb9-8bb4-24a782f8459e", "value": "Krypton-Cracked (2).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a653aeb1-ab9a-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788881612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788881612, "uuid": "48864aab-340f-4083-bbf9-e5804f507693", "comment": "Malware payload (Vidar)", "value": "99e31693118326b81e513da85e448361", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788881612, "uuid": "6af15da7-2929-4fe3-a809-a0eacdc2be11", "comment": "Malware payload (Vidar)", "value": "1645b87df08aada4e4ce352ca9f146626d32138a093ea311090eddf1fedec9f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788881612, "uuid": "e8eadc7e-7f5d-4dc8-9e44-3d33a0dba299", "comment": "Malware payload (Vidar)", "value": "8e11803a8af60c612c69ab47ae6a3826e1ebcf93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788881612, "uuid": "e1b13a48-ce51-4b2e-9b92-d0bbc7684dc6", "comment": "Malware payload (Vidar)", "value": "63df2dc6b97a0fae84d34cb4beb64b5108175f95c3b754ef82e25ef1a443cd77ead6dcf3951cdcacf4a03355b1008716", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788881612, "uuid": "36f14a23-0d6c-444d-b41e-5624dc5ec115", "value": "T13B666A037FA961F0E069D9788676921ABB617C8D833773AB1E4077202F267D09E36F45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788881612, "uuid": "df20f42c-dbbb-4e7d-8089-076311c81d00", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788881612, "uuid": "82fb21d2-ba03-4e47-baee-d6b46a726530", "value": "49152:tY+VfeLiyjS6oXoy+NoyerYOdOUk5qPvafM2LjOnai4hqNbPOIv324Is:tYg2+4oyaNafMIOndU0rOIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788881612, "uuid": "bfb1f19c-3c51-4c9b-8c4e-4db3ff74bceb", "value": 6729080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788881612, "uuid": "f2a7587c-e37f-4731-8598-e5fafa3c935d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788881612, "uuid": "1880247e-4ce4-4310-8489-22d3b573f371", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e28202e-ab5b-11f1-915e-42010a9c000a", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788854406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788854406, "uuid": "09847d77-b25f-4ead-b6c3-678bf49f559d", "comment": "Malware payload (AsyncRAT)", "value": "e6019aa3e688abcac954bb42d7defd4a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788854406, "uuid": "ec3d8943-3646-44ae-aaca-e127c44df856", "comment": "Malware payload (AsyncRAT)", "value": "1a3c238c9724d237685141e49340c049c85ddb95ce7f47593d04b6f854b643f8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788854406, "uuid": "376659ff-bb64-4b91-89d1-c39b53fef2c9", "comment": "Malware payload (AsyncRAT)", "value": "e1860dcbebc95221725f6db54140aeafa0ca4bad", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788854406, "uuid": "4f3c431a-fa52-4eeb-910b-9acacdddc43b", "comment": "Malware payload (AsyncRAT)", "value": "5a0eb0ecc5ff6dbea744f726441eb40646ffa171e218d82337c61d49dd6bb8b26f31330199a90c005f89f7e590b1c0d7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788854406, "uuid": "7d963f51-8c85-41c0-a656-d4925d75ef3f", "value": "T1F515CFAC3601F49FC817CA768E60EDB4AA542DBA9307D20395D71DEFB91D987CE041E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788854406, "uuid": "668aa097-d095-4cbf-aa17-c7b317b419c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788854406, "uuid": "4178e998-0f76-4f37-92a7-66c791204a6f", "value": "24576:VOJ94qj0qdP0tg7eGuud6DnlTwe2Wq0xC4x+2KBf:VO1Otgq/ud6ZOWT9KBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788854406, "uuid": "caacf12d-9d9d-4893-8074-efefa7b99389", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788854406, "uuid": "4e7e968e-c4a0-4d65-b516-33d3d0af8515", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788854406, "uuid": "0f2fbe4f-3cf3-4c47-a90d-9aaf0568e061", "value": "ALPHA WEB BANKING ???????? ??????????..PDF.e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1273474-ab72-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788864424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864424, "uuid": "b2dddce5-e99e-4fdc-b026-b68cfa8880d5", "comment": "Malware payload (Mirai)", "value": "1aa836e299fc0114dc4db13b83fa6821", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864424, "uuid": "d94385d3-b2bf-4de3-a603-be393075a721", "comment": "Malware payload (Mirai)", "value": "1b271a22c4816a74b34239d0f1e941035c4c927d74253760947ea34c23ba65d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864424, "uuid": "92acd8a1-1dac-493d-8724-ff2871a0852a", "comment": "Malware payload (Mirai)", "value": "50c74fb3c5cd40e9793e48fd3a5fee5b053325e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864424, "uuid": "6f709a83-707e-44f6-972a-388c2662b97c", "comment": "Malware payload (Mirai)", "value": "648cf482a8ea8a34bb91685d00572c76dfeef5435041b7ef47ae4c67ab544cb88592099affad1cba2ce4261df583700f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864424, "uuid": "97df78f3-9b5c-447e-9046-8876ccdbe8a1", "value": "T1FAA2E11462532D66F3DC1C3DC96A835BF9A71BFC90B532B679415620C94D24B3E38A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864424, "uuid": "ae468ac9-e392-43d0-b1bb-69fd982ed7ea", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjA0cOhymdGUop5hZ:vvQn4j+ZO5fKAlxc0Ts3UozD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788864424, "uuid": "2f5b1d5f-93db-4a3e-a64b-23fb0807ee75", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788864424, "uuid": "0851a887-0d0c-4d7d-8fa7-aa85ec17b71b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864424, "uuid": "6ee41b20-eae8-48c5-b7a1-f295bb4bce94", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01d278a-ab26-11f1-915e-42010a9c000a", "comment": "Malware payload (QuasarRAT)", "timestamp": 1788831861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788831861, "uuid": "7d9c2109-3bae-4422-ba2c-b111115a1a6f", "comment": "Malware payload (QuasarRAT)", "value": "b1ceadb93463f22943f9677aa330f15a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788831861, "uuid": "6108eb33-271f-4aa2-afe5-081c519e004d", "comment": "Malware payload (QuasarRAT)", "value": "1b68d68b9fd200183c69084e91fe53bd5dca5c501bce1bbf1894034bc69fafe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788831861, "uuid": "aaf1b9a9-79c0-4c46-8b09-85c2ff1e403c", "comment": "Malware payload (QuasarRAT)", "value": "1f37d2345e765100b8dc628bb6ce098472891fe0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788831861, "uuid": "3890620f-fb81-4557-b6c5-1a3c2504f35a", "comment": "Malware payload (QuasarRAT)", "value": "585c7e7d4f54eb765ecdbd95d450386aa4bce4a5fd17001734bdc241e10dedcd8b729c6ffb30fb82de0715cfa1fc05c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788831861, "uuid": "29239284-580a-4f15-93dd-7283b7c77c15", "value": "T1B62633815EF7410FDF2748F0402BF19CF12D9B8166BE896A2A7D59265C2FAEDE953300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788831861, "uuid": "cc92e4e0-6ec6-4238-af28-09caa82ed305", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788831861, "uuid": "7f1e68ef-78d4-4e94-a603-f472c1d4ccf7", "value": "98304:/RHxlqvc70zd7sWExoYnQyRazSzsDm8ijFeR/asE8DX/Pe1qN84S:Zxlq070JoWc4+zTjKl/2084S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788831861, "uuid": "a6dbf070-908b-4a03-9e28-98b9c660e2ec", "value": 4816384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788831861, "uuid": "c42d7788-b4ab-4a94-bed2-85e4efdc8668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788831861, "uuid": "05961a39-5c8a-4ff5-8293-e3f5ed269bb0", "value": "1b68d68b9fd200183c69084e91fe53bd5dca5c501bce1bbf1894034bc69fafe6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ed0366-ab6b-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788861229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788861229, "uuid": "633b25cc-0747-4297-8e45-b0fedf2bdc0f", "comment": "Malware payload", "value": "03576b3744bdacdb2f4a51b0f3eefe10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788861229, "uuid": "0364327d-14ba-44eb-8b03-bf8f7ecb0d2d", "comment": "Malware payload", "value": "1c53a1603cd62b6559bec4ab73c870a28f54a79e8038cdbc234d454ce83bc51c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788861229, "uuid": "65335a98-3134-4464-a5a8-8e33d3ad4581", "comment": "Malware payload", "value": "ca6cff6e3af9a8f8c329730a9ebe0859082e35ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788861229, "uuid": "91d738a2-0104-45b9-bfef-64a003894f6c", "comment": "Malware payload", "value": "346a479d89ba779a816d45f4108cad09fafc0610a53fa06c15c139d6e3af6ef0a041b5b62b3d4a8b42d9b42861500010", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788861229, "uuid": "eb06ecfa-71bc-45b5-bcab-ce17f9af6de2", "value": "T19ED5239B65F215B0D837C3B8DF83E4BD712A3B915A615E0BFA8E1A008E135581D3B736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788861229, "uuid": "b9310621-9be9-4da7-b1d0-a56beb392831", "value": "58f4b17816a07f7a36dd14e504d515e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788861229, "uuid": "b67a42a4-a32a-4c2c-be08-4b715ca96071", "value": "49152:4twAVWCoUBstCTcATLU7guFJCit0p9uE5SAoqBfqqVerF1AlCbA+:6hQ6itwcATI7zyitg9umoqBfq3qU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788861229, "uuid": "b292bfd1-8805-4c7c-9106-74dfb8eceaa0", "value": 2919936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788861229, "uuid": "9b62bdc6-ae19-4235-8890-282d3bf02d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788861229, "uuid": "8d88903f-8af9-4e2f-98b4-a499308bc5d4", "value": "1c53a1603cd62b6559bec4ab73c870a28f54a79e8038cdbc234d454ce83bc51c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cdd0d83-ab36-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788838566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838566, "uuid": "7c8e0938-2384-4e34-8f2e-3c2eb9bb83f5", "comment": "Malware payload (Mirai)", "value": "c0981d5785941bfd0ac13369bd7eb7b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838566, "uuid": "fab8fd49-c240-4157-8363-57295491efe2", "comment": "Malware payload (Mirai)", "value": "1d37a1a5605c36b1f06174151af5791b0e818810a962053c7d043cde5f67621f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838566, "uuid": "20a7bdf6-e367-493c-a5dd-3b5a5432215e", "comment": "Malware payload (Mirai)", "value": "dd2d5a23fdcb6c6b9894e39244b7a904786fce1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838566, "uuid": "19d09b6d-c8a1-42f3-ab7f-1723a39be6af", "comment": "Malware payload (Mirai)", "value": "0ead74cc00c698c7adc2d69c986d205f123381f5f7bbcd233ca472473d1d9379749ccf1164d88b800c9a87499d30cd2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838566, "uuid": "ac34465a-b8fd-4a0f-abc2-af470f3c4ae3", "value": "T1E0C302974E5B8787D271EC739E27A7683BD1B9303A8E6D4D47350028EBD500BA2B2257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838566, "uuid": "0ef7203e-80b6-4a67-bfa2-29310c7f3e20", "value": "3072:nDlt9Oa1vjPvPoDERx+Fx8P1fkge63YSCo1b/qxkW:Dz97LgDED+U3YSR1zBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788838566, "uuid": "4fdb9562-34c3-48ad-840b-5822a95ff3bf", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788838566, "uuid": "09ec1ced-292f-4408-9e2c-bf2f394543d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838566, "uuid": "e828dbef-1487-4589-b887-72a8c0ad9a19", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d7f25c-ab33-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788837219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837219, "uuid": "743d44f3-6d31-4173-b737-858a30425693", "comment": "Malware payload (Mirai)", "value": "e45862e90dd1b2e0ff6c42077dd40360", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837219, "uuid": "86de5901-e0a5-46a6-8c8d-60e2272555c7", "comment": "Malware payload (Mirai)", "value": "1e419adae89234aad1983f9ed1a8ce48cd80bd07cec7aabf2101b492523d1a2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837219, "uuid": "5efb61c8-605f-4ca8-b3e8-0c8abf41afb8", "comment": "Malware payload (Mirai)", "value": "2f713c3e65a43761d4949a7b832b42ca3f306150", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837219, "uuid": "054805df-7527-4354-b594-0d923aca4aec", "comment": "Malware payload (Mirai)", "value": "12f1c277809cd5788daef9a6295ccf13a77ac88ebc868aa87b0bb0bd1c91b4620c1d5a89eaaa822c55b34305e6f0004e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788837219, "uuid": "99ca9593-cc33-408e-b07a-6cd365fa9cba", "value": "T17ED3124ED3984507FEE784FDF3B0479D6E2A06B161B29DCBA020F1A097825EE79B8505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788837219, "uuid": "e9864900-99f3-4e3f-a69e-9090ff7f37ee", "value": "3072:q3vlREb3w0vdhTDbyhNutV3BaWhXK7PDPOhdH4ut9hVs:Yl4JQQ7phXK7PidHz3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788837219, "uuid": "8041120d-1476-4845-a1de-f7254b8a45ea", "value": 133624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788837219, "uuid": "be9f4e21-91f4-4278-b00c-19ed077c6d86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788837219, "uuid": "dddf0325-bdac-4ee0-a452-40e23e55aa2c", "value": "1e419adae89234aad1983f9ed1a8ce48cd80bd07cec7aabf2101b492523d1a2b.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec84700-ab72-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788864500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864500, "uuid": "788d69e9-2be4-4c5e-9944-24f6fcce5219", "comment": "Malware payload (Mirai)", "value": "988093eee5f1cd7e597dd546118cd401", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864500, "uuid": "ac55b51b-151c-4122-b23c-fd63be910c03", "comment": "Malware payload (Mirai)", "value": "1e5fb76ff33d0e345db4f3148e4dcc4c1c204285990c5c46b470eb78b82826d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864500, "uuid": "b2a3920e-1341-44f5-9c1a-702de35d3ce6", "comment": "Malware payload (Mirai)", "value": "2d1450dab4aba2dfb6a224bb4b60f7feaf0613a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864500, "uuid": "e4ddcadb-2479-4953-bdb0-f12464c38eb0", "comment": "Malware payload (Mirai)", "value": "a4ea4f6f36aed2f69ed5c08786e901c632a1a11f7d433bcf51e629038d5e44fac15767f551983e41bc17718e348b5329", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864500, "uuid": "336962c3-a728-43e8-8c09-fb941d06befd", "value": "T1FB330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864500, "uuid": "13c8cb7d-fa12-40f3-8def-27e9b915f3c0", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGK:r/hqaJMcjeqK806MHdMfQXoHuCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788864500, "uuid": "38d6a6c8-fefe-4466-80f2-3c66e7f147a1", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788864500, "uuid": "64881ef4-94c6-43a4-9fbb-4aa28f2186e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864500, "uuid": "daebadbf-1031-4b14-a40a-30c8f11ac269", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7c39f7-abce-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788903824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903824, "uuid": "cb10ea1b-7a83-4672-8265-1c840904b90e", "comment": "Malware payload (Mirai)", "value": "7509303ed3162e62d91e105f4547ca67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903824, "uuid": "99cc8c47-2db1-49a6-8cc1-ac2592ee6723", "comment": "Malware payload (Mirai)", "value": "20627e7bbf0bd28d5c9b150498e926332d9eca4b39804a6e53907d4a6597a27c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903824, "uuid": "05d97bab-35c4-463b-b699-04d5d15439be", "comment": "Malware payload (Mirai)", "value": "cba5df082150935a4118d8d16578390536704e58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903824, "uuid": "efeb2c0e-924d-4e97-8a62-af1ef808917b", "comment": "Malware payload (Mirai)", "value": "78e8c372dcf270a0e69d82e037ff58686b253594cf3cf05690310110725250350b8bc6583995bfc098ec8fb99f404793", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903824, "uuid": "8fb82ad1-5c7d-43c4-b11e-b77abc374665", "value": "T12853F11B836ADF78C6B1E831A40F7C94A6B6ED195202174B118A35DCC8B27D7BE2C371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903824, "uuid": "fb40e621-cad7-4eba-8680-30f5a80f33f3", "value": "1536:ehejrFZqD9EC/WUM+F5hY4lPUY/CSWHT+dL+V:DrFAD9UJ+F5B/8+hC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788903824, "uuid": "4e97aef7-68fa-4443-8bef-cd7f28e50ab7", "value": 62252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788903824, "uuid": "ab0cb582-2462-4d08-bcd0-f436cdcd2fd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903824, "uuid": "834ef3cd-138f-4f8b-a39b-f3ac2207e264", "value": "20627e7bbf0bd28d5c9b150498e926332d9eca4b39804a6e53907d4a6597a27c.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a548c50a-aba6-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788886765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886765, "uuid": "d66120fa-4f56-4c9f-8b95-9cd1b43dc915", "comment": "Malware payload (Mirai)", "value": "aebd2804c9cc052a60f9f500c933338c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886765, "uuid": "cf4ec684-b5b0-4cd4-96d9-1361ad6e8d7b", "comment": "Malware payload (Mirai)", "value": "217029b3a21a5aba040e836cdb59fb5e7e295119e605ea9a628b791e2c213b51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886765, "uuid": "16baef62-9e2b-4d1e-8e20-bdf673505534", "comment": "Malware payload (Mirai)", "value": "53f7c1d4878c4ebe4f6d28d6cf742d17a3e86045", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886765, "uuid": "5c61ed4a-1729-4de3-98d3-b8fc76f573d4", "comment": "Malware payload (Mirai)", "value": "d18e695fe0a8b1b76ff8d58d4a7cc88e3e1a24d2f77d64e510ad9d1196488e69f32f5ffe9026aec24747c12bf2aee7fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886765, "uuid": "2a3a10b8-b59d-4d80-b68c-2ebe7ef23ea3", "value": "T199F30846F8819B15D5D251BEFF0E528E33231B78E3DE72139D246B307B8A86B0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886765, "uuid": "a0baf262-9e6c-495a-bce1-df36aa4c733b", "value": "3072:J/wcYlstJqi8DJ5K2XiLYOYan5YVX6bprkzbuaa9JWZx5Xm2s:zYy2DHXWYHa5+KtYbuaa9Ox5Bs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788886765, "uuid": "6a9772ba-db2e-41c6-a45d-ea8bfd8e037c", "value": 165856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788886765, "uuid": "878686fa-8283-4070-9dba-1c3bead4d245", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886765, "uuid": "0c61394f-56df-4438-98cd-8ec537e7bb7f", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7c2078-ab7f-11f1-915e-42010a9c000a", "comment": "Malware payload (DonutLoader)", "timestamp": 1788869973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869973, "uuid": "2dae4c1e-7532-435a-ac19-1e97273008f1", "comment": "Malware payload (DonutLoader)", "value": "d0a61af5201dbc02a1e510f378e6033d", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869973, "uuid": "2bdc81fa-f402-4cca-b368-0891464e4875", "comment": "Malware payload (DonutLoader)", "value": "2312ae3c94e311c8c328f91a74519fdcb985acc42f87aa0e91681fb1bdbc40da", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869973, "uuid": "ac4eeca7-5199-454b-b686-41ee34d3e8a1", "comment": "Malware payload (DonutLoader)", "value": "ee9e623bb3d32f1fe3717398007e9862618c5488", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869973, "uuid": "6d56a9d6-7beb-4726-bfd2-c27201e82f77", "comment": "Malware payload (DonutLoader)", "value": "fe9f29a38097cf0a199f3d30bc47614e8a284bc365d371b3f4b683a3c823d196f574e26e2a60c9cb908f28aeb8240f1a", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788869973, "uuid": "83580183-d017-4de6-afd9-7d309ed33a68", "value": "T101C6D38623589232B725EBCD8239DC71E64EA35325C9CB34716CC9153B3DD1BA358AF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788869973, "uuid": "aad19d1a-1b4c-45af-a248-5936ee431388", "value": "196608:W8EaV3K+S/T+VN+bPA/6jVkWVfOOZBCJH/v8B+yxYYt8Bl1dJjyDw6sQVp1rDBgg:PlsDdsQVpND+aW36VwbetEgk6KpYThgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788869973, "uuid": "99d3375d-1986-4eec-81c0-f8bc198a9c75", "value": 11993345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788869973, "uuid": "f5b01655-9178-491f-906c-d25ddd900e09", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788869973, "uuid": "d25514b2-1c04-4e1b-a11d-c079123acdfc", "value": "SWIFT COPY_TXT.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f980fdd-aba6-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788886621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886621, "uuid": "b2f730a0-2fbc-49ee-b4d4-9cdbdb4c899a", "comment": "Malware payload (Mirai)", "value": "960d8be0ad2ed0bdd00837738a681bd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886621, "uuid": "4293435f-9e36-47ab-95f2-7b8457b236f8", "comment": "Malware payload (Mirai)", "value": "23231395c4e817e8bbd3aaf5c6a4bb982c2283c2d9057d9e9c9854e4b74932d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886621, "uuid": "a275e00e-edea-40f1-ab31-bdc66c63c15b", "comment": "Malware payload (Mirai)", "value": "8b64f218b2352f61f979371cf148a1c1850b1480", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886621, "uuid": "48e4184f-f093-4947-8297-89816fb9d408", "comment": "Malware payload (Mirai)", "value": "da2bea3f26f543fd71d9e7eaeb686a3a384462f2471ef4ea60d265830283c27dde2b12b00c7c497079f486c6666ecfc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886621, "uuid": "58c5d387-9389-45f1-b208-15656a6ee5a9", "value": "T131F33B46AC91D933C6C217BBBAAF109D33316798D3DB33429D182F7826C665E1E3A345", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886621, "uuid": "919068a5-82d4-4842-83cd-055b52264808", "value": "3072:NIodHFxgAdrYOSjEcOi9Ov30x9jwjOsxJTnT54eDX5BPF+AJs/:VdlmA9YOSzI0fw6MBPbJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788886621, "uuid": "69775acd-d7f4-4d4a-a033-62ba41000678", "value": 158209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788886621, "uuid": "826d0544-c275-4106-8542-e114cf065a3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886621, "uuid": "e45380c6-e270-4f59-9862-c7653ea7ee2a", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff010070-ab3f-11f1-915e-42010a9c000a", "comment": "Malware payload (RevStealer)", "timestamp": 1788842677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788842677, "uuid": "28b4fd4a-6a0f-446e-93f4-e16c99279646", "comment": "Malware payload (RevStealer)", "value": "040956b7dc28864a6c5cdff5ddc99044", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788842677, "uuid": "cbd34656-2380-4aef-9036-9cf0fda48780", "comment": "Malware payload (RevStealer)", "value": "2342a2aba31f0afa99fea56fe8e79fedc95fffa61f33521a88f468e7050e9372", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788842677, "uuid": "f7107df9-7667-4ea7-b578-f065d77484cc", "comment": "Malware payload (RevStealer)", "value": "58003e01d5fde1d41859fdd53d56965962ce78d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788842677, "uuid": "8d7812d1-dc92-42f4-adb4-5afbb2ae1270", "comment": "Malware payload (RevStealer)", "value": "dd6ff97fbb7daa8208e93d0c4cf0f2a567a8440d379d7da0d72b82743db0df3aa2d67549039bbb384365aea003e014f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788842677, "uuid": "3d81f868-bffb-499f-bc49-474e2cc8d794", "value": "T1B7D5229D79B65674C832C7B6CF93F4AEB07E37C18A308E4B35C969048D526506C3AB78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788842677, "uuid": "5fd755f7-3123-401a-882b-7667d5c75f72", "value": "fe230628262faec735b6f015758b7519", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788842677, "uuid": "39cd2195-21c3-4581-a8ca-9fa4906551d2", "value": "49152:CxWEYzMO/6rN1+2SLj/ZlHRym9tiUaw2EM2ZfKqpccyT358L+5FfIcQ:fpzMk6rL+2arPRBvi6kPq7O58LWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788842677, "uuid": "c5e3ae8e-dda8-4cf3-a7fe-0b19099d5a92", "value": 2956288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788842677, "uuid": "5d15a64d-3d31-42e5-af0b-78a816fbc26c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788842677, "uuid": "ab98ee14-8bde-46f4-bec8-5a66c7e02627", "value": "2342a2aba31f0afa99fea56fe8e79fedc95fffa61f33521a88f468e7050e9372.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6500dd62-ab3a-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788840271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788840271, "uuid": "f51486eb-09ec-4b71-b905-e5b02e7f1ba4", "comment": "Malware payload (Mirai)", "value": "d341a1dc5aa335f66d792a005d0193f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788840271, "uuid": "abb32f2d-83f5-4bc4-963c-4278b792ad4b", "comment": "Malware payload (Mirai)", "value": "2389ed348af56c1f9a1fd46ac37854e1e52f7a7db0b676e12e05cdc625c151cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788840271, "uuid": "12a985a1-371b-411f-bf11-79c001fcb179", "comment": "Malware payload (Mirai)", "value": "1a541f99866d4012890e293ea5273c498c9305bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788840271, "uuid": "1043cf4f-2e68-4901-8ff1-e2e66e6adf4f", "comment": "Malware payload (Mirai)", "value": "72ec0497292c78710b540bb70129a84a256e0b471124bdd26678120c1b6fa1190e54ce4372734715f426081fdcedf1dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788840271, "uuid": "9d248f2c-d36f-42d4-b87a-78147f9f6006", "value": "T11CC3124F990066C9CA6FCB7384B64984076718BD82F975D193AC469AB8C1CF6A7FE012", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788840271, "uuid": "1050101e-49a4-429f-8926-10f42cc3cddb", "value": "1536:k41jG6guKKGVFk6eOBJR4PHS1oluc1luEfIQNBCW3nnCTWAbY3Ek0:kQ66gZxxeKGHhllfIEaY3Ek0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788840271, "uuid": "853fd368-84f1-4fcf-8fe2-3421af659f87", "value": 119016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788840271, "uuid": "796db15a-9d2c-4606-86be-94a65d2a0234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788840271, "uuid": "e0759814-9482-40f5-bf25-7bb3e6f6e915", "value": "2389ed348af56c1f9a1fd46ac37854e1e52f7a7db0b676e12e05cdc625c151cf.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c655f1-ab39-11f1-915e-42010a9c000a", "comment": "Malware payload (JOMANGY)", "timestamp": 1788839762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839762, "uuid": "506b03c4-0af5-4556-86a3-e1d0be47893b", "comment": "Malware payload (JOMANGY)", "value": "e4879accd278b07b04dce383708d7f6e", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839762, "uuid": "914ca00d-d8fc-4c99-9862-276a464bf0c4", "comment": "Malware payload (JOMANGY)", "value": "2579ac9568524c0445da80a83bb7f5a381a738b8534d33ac3fe76b4a4375d534", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839762, "uuid": "3ca980c2-74c4-492b-b32f-2ba30cfec059", "comment": "Malware payload (JOMANGY)", "value": "75b07db6948e16b00dce23e727a3c976c6ba8cbe", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839762, "uuid": "ed9da53f-bfc3-49bb-8eee-ca9789f5d372", "comment": "Malware payload (JOMANGY)", "value": "7f87e4283864761543b52556f3791211e7848b56e7ec8deecd9a0d871b3d9111b84fc381cf1c4a1644799396e5af5b2d", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839762, "uuid": "73b42a34-0a7b-4846-8f5b-68d8d41f28f6", "value": "T1ADC27C956A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839762, "uuid": "568235b2-70cc-42ee-b5e4-11a474f0209b", "value": "768:S8vCB+25j6es8Rr9FYpMSUpi+20qUpi+20YQX:S8l25J9d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788839762, "uuid": "15981ab7-ed56-439f-9188-3c1f152d9a11", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788839762, "uuid": "6d57c3df-9967-44c5-9aff-af37504af241", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839762, "uuid": "e02a228c-67a9-4671-8c6b-567f5faf343b", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193e7d62-abcc-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788902851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902851, "uuid": "a930db0e-15ca-421d-91a8-a69c34c493a7", "comment": "Malware payload (Mirai)", "value": "b3ecda7ee789a7a40c6a7f8b3b8733da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902851, "uuid": "8a84e9e8-56b0-4479-8823-5eb8aa3e620c", "comment": "Malware payload (Mirai)", "value": "25d775826462960f3e9aac0a58c5317f69809f2a403c09a242bbec88e0792069", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902851, "uuid": "532c06f2-1140-4dd3-a775-e4296786ca20", "comment": "Malware payload (Mirai)", "value": "124b642590786bb938da6311fe8eb633b437fd31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902851, "uuid": "96389242-e9aa-4794-8c80-81b8d6fbfe86", "comment": "Malware payload (Mirai)", "value": "be398d330bca96d14de30cead87e5bdaf88a4db20a108de55ce41e233c2c461e2d12ebd0a13ba8209ca728ba59fbf486", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902851, "uuid": "fffd7358-cfda-43b2-8f38-2686364aa566", "value": "T19BD35973C8256F58C568D5B5B0348F7D2B63A91182871FBE19A7C6788083DCCF64A7B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902851, "uuid": "f81a094d-df95-44c8-85e1-d5374f3c45e9", "value": "1536:nqAeO63ssg5z8PyC4HKTgetTj/7LSFKJjUWJLVPRYs/v/aAYx:nqAgss8zbeTR7LSkFUW9Vj/XaAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788902851, "uuid": "12f90aaa-b454-4916-b1b3-3de40db9dba1", "value": 142096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788902851, "uuid": "76dacb73-148e-478c-8506-f8744e1fcc89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902851, "uuid": "53061e83-88f8-4661-a66d-b178362d7b0f", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b4507e-ab67-11f1-915e-42010a9c000a", "comment": "Malware payload (JOMANGY)", "timestamp": 1788859673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788859673, "uuid": "6dd09882-de3b-48f5-b549-cdf05a6ea028", "comment": "Malware payload (JOMANGY)", "value": "3d182603cd3c7ae73b5ff61740729975", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788859673, "uuid": "eec4746e-3f38-4717-892f-0a4800715bed", "comment": "Malware payload (JOMANGY)", "value": "26ade03828d1a431ba06917bf46c5f07f0f0fce90cd2a0e0afa7046d4b07e6f7", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788859673, "uuid": "4d52560b-0111-40ec-bf7c-b3abf030e1f1", "comment": "Malware payload (JOMANGY)", "value": "911f86e6803335ebb405acb78da30b2c78c6bf0d", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788859673, "uuid": "e174aa84-4765-432c-9f0e-ce5883d8f5ab", "comment": "Malware payload (JOMANGY)", "value": "65c8482a91580f43d1132adbfd13bdbe6644d00b8dca2c318710bdbbb449be61996a0fe7830e75c0b4bcc3a175171a2a", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788859673, "uuid": "bed51434-908a-495d-80dd-71b7112b7a58", "value": "T1DDC27C956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788859673, "uuid": "03e97aaf-482c-4fc6-ace2-e221661afb4b", "value": "768:rZ8vCB+25j6es8RXk9FYpMSUpi+20qUpi+20YQX:rZ8l25Jyd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788859673, "uuid": "c495e678-123e-450c-a6a2-ad67142ef7e4", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788859673, "uuid": "6afb3a6f-0fcb-4a2a-b44c-9d1f964211fc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788859673, "uuid": "ca9feb26-c8a3-4081-a743-4f880aabf4c2", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f067029-aba2-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788884956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884956, "uuid": "b1e26cfb-051b-4fc6-a9fe-6fb6b33bbb74", "comment": "Malware payload", "value": "9ce97e7494107ac78ca689464d7c28c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884956, "uuid": "6803b211-c9aa-48d2-8243-a14dd6bff896", "comment": "Malware payload", "value": "26d603d448c8cb458e61a1fd10f44d8a4b2426f99b318e3ddcb8b05b2724aea5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884956, "uuid": "f4ee45b9-5788-46e1-949b-ccfbc5837c1f", "comment": "Malware payload", "value": "be127c72a9570d7109a96d5d49d76b356f9f243a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884956, "uuid": "31d4fc28-3c06-4bc1-9f9d-7737c5e19eb6", "comment": "Malware payload", "value": "242747ee1c654bfaeb8025fb2427a30d6b211a12212da08191ee21327594907ecebad6d71048292a74b51efc6412283e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884956, "uuid": "8cabb695-9179-444e-8043-699cb0ce14ab", "value": "T183B2190137180E97D09FBAB43A3F0BD8A3EABF5121E5D681261EA7CAC1B1E771541C89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884956, "uuid": "7eb86047-26a6-4cc7-b988-d81e484a20b2", "value": "384:nRT9/Q/UYPwTD7cYRK0jJTDxPrtXgA1jTOaAAMP7dRrFrV3+p9:nboG7cYBVVThZAJPJRrb3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788884956, "uuid": "47ab74f0-4f7b-4286-9cea-8ac453e4c7a9", "value": 24032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788884956, "uuid": "3686bc98-c9c9-4448-b578-5ae65e700b5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884956, "uuid": "2e3752e4-5dcd-47cf-a973-700a2caaadd3", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad386d6f-aba9-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788888066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888066, "uuid": "c4b16e96-bef8-4ff8-9ce2-5465926a4bb4", "comment": "Malware payload (Mirai)", "value": "0187d03c5f99e3d4c191b83a4bff3840", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888066, "uuid": "a8f7c951-8f7e-4325-8f72-e6d9a67e1c14", "comment": "Malware payload (Mirai)", "value": "270267430c9c545640a214dca3efd60d9761c309969c2e728f9968f56719c46e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888066, "uuid": "ec7b73ba-e629-403f-bd1e-60916040d252", "comment": "Malware payload (Mirai)", "value": "b75acb615590a70063e65d121e42bc8d7fff4620", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888066, "uuid": "a5b267e6-f1bc-4f7f-9a80-daec57d4214f", "comment": "Malware payload (Mirai)", "value": "979ebeafc20e1cc315337f3cbaaf9b257066bf66720e41a880ec046a1c22c4cea415f420b0f78ab9bcf402977d5eaae5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888066, "uuid": "8b4f6708-b2d8-41b1-9e8f-ccb721f5af53", "value": "T1A553021D7549C5ADF3B2657B07C983A44A720F63905ACC84F54FB8D72A09C6E7A83EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888066, "uuid": "b6218721-c4c0-4ad1-9185-6a2fa86f5c5a", "value": "1536:j9fyv9kaIENq4ah86KSbUaZzHMo6Quc0EHVEWF:jRvaQlxK2UaZzHxuc0EHVEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788888066, "uuid": "25e33f82-09ca-412d-8e9c-b9a1c819a326", "value": 65732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788888066, "uuid": "8183b0ea-efc5-46e1-99f5-b0d271328efa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888066, "uuid": "824d1065-e7c1-438e-bbdc-8fb092ccfa5f", "value": "270267430c9c545640a214dca3efd60d9761c309969c2e728f9968f56719c46e.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811c051f-ab53-11f1-915e-42010a9c000a", "comment": "Malware payload (RevStealer)", "timestamp": 1788851056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788851056, "uuid": "0d12bb4b-f330-4fe3-960c-e7d6ddf38aa2", "comment": "Malware payload (RevStealer)", "value": "be0292b38c6ab0e91a921eeb8e5cc07d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788851056, "uuid": "5604213d-de4f-49b4-a309-e98d64f2beb8", "comment": "Malware payload (RevStealer)", "value": "2722591f976e2f1a23503a58651768767bc41da195bdd2b7de8cc248ad69ff51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788851056, "uuid": "8aa2ba78-5be3-4e07-9a1b-f85a694deca6", "comment": "Malware payload (RevStealer)", "value": "48d746c1d2121da854718c5110760f7cf56b546d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788851056, "uuid": "0fc06bde-cf47-468d-a518-570f41fc8262", "comment": "Malware payload (RevStealer)", "value": "f4dc424e0f895fe2283309001adb2ded2e593c77aa5adcb4e15ecd99b3f082211857be7fb7814530943d99f5b6a8bf31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788851056, "uuid": "5a94833c-d18f-4004-b971-310e6f4cf35f", "value": "T107D52396FEA21975E836C3B347D3A03EF0297B4449A18C9779CC37005E52938AC7A779", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788851056, "uuid": "547f9551-b21e-4db4-880f-013000534d83", "value": "5a2ed47d8c6c6433dbc831d38c92042b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788851056, "uuid": "8996e444-a33a-402a-94e9-2d9b8b963e55", "value": "49152:uQjIbNlmm0B9afdGA0mJgAvabTmN7WOwdh3MjH5inB7HGSPAvmGk07:obNiHafdGmzva6wdh8L5+NHxbGR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788851056, "uuid": "95f514da-df8c-4608-ba32-dfa2f1bb4e9d", "value": 2979328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788851056, "uuid": "4a9e5dfd-dce0-4a2a-a325-7481084c2c4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788851056, "uuid": "1970fcb0-661e-4440-9eb3-93a52c24ef68", "value": "2722591f976e2f1a23503a58651768767bc41da195bdd2b7de8cc248ad69ff51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a2d88a-aba8-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788887732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887732, "uuid": "3774347f-4611-4eba-bdd3-c543513673fc", "comment": "Malware payload (Mirai)", "value": "1f82dc1f4ce97c64e9b59fa70c4dc5e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887732, "uuid": "90d44f94-10f5-4355-9ab2-fbb4d106f044", "comment": "Malware payload (Mirai)", "value": "2800ea3fc045731348962fe4ba17d48305fb4a6462e70c3449bb476409fcdb6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887732, "uuid": "2d1afd7d-f81f-4c0b-b5f9-1ee2bf5ea462", "comment": "Malware payload (Mirai)", "value": "64695805db40e183f5a3ba5932bbb1e8f22dabd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887732, "uuid": "4eba9f41-f3c4-423f-a278-c1c851310b93", "comment": "Malware payload (Mirai)", "value": "fef7843b64b5c1a2f2d5a8b4d4f7bc2456ceae57cb3849f05266f13a07175665779d0ad7e90312ec7bb5736b0dc2f204", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788887732, "uuid": "2337e6e8-3116-4661-ad0a-f8eb05e79179", "value": "T15FF32906A31C0643E1532DF43B3F57E183AFAA5124E8E644254FEE8A9771D32954AECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788887732, "uuid": "e79f80d9-c172-4446-9547-47d04b7d72dd", "value": "3072:L/udplNaklBN1plBN1P6vxd8v8mxdGxlQYXY6lrqUb8PcdZm:L/lvmxdGxlQsY6JqUbTdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788887732, "uuid": "b8e723db-6779-4334-b01d-523a97e2c391", "value": 158552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788887732, "uuid": "3e09bdcd-b12d-424f-9b0e-0592db9c8782", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788887732, "uuid": "8dcbdfc1-6c19-47ba-b448-daeeb6a69079", "value": "fa4a5b7a33aff414c1ed83adbe3088a521545beae7b3ec3c596f392fc7d11c24.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2189ed6a-abd9-11f1-ab4f-4201ac107002", "comment": "Malware payload (SilentNet)", "timestamp": 1788908448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908448, "uuid": "a708efc6-0ee9-40e6-9f6d-6acfa5bc2a35", "comment": "Malware payload (SilentNet)", "value": "c3a253443985bea72d660fc38207989d", "object_relation": "md5", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908448, "uuid": "ac5024b1-9b0f-4465-8f7b-ba2d9422e235", "comment": "Malware payload (SilentNet)", "value": "29ad567237511d625f13a68132875460399aac101ec9ae6a3d43e3bfbb6a4aa0", "object_relation": "sha256", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908448, "uuid": "61732334-132f-42ab-8048-a922bc6f94fc", "comment": "Malware payload (SilentNet)", "value": "0321f39ceff287f50498fc867c11706f48745662", "object_relation": "sha1", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908448, "uuid": "63ce5a89-1195-4250-beb3-a63ca4c68af6", "comment": "Malware payload (SilentNet)", "value": "4c6a65e11cbc055e1bd66d7dea93d74c01db3214914b7321f92fa146b57cc9a3e39b561a270d3d1273983cde5be0a44c", "object_relation": "sha3-384", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908448, "uuid": "72b0869a-3628-462b-ad50-d535977a73ad", "value": "T16B94E0EB5A09DEABD13B567C85631FD1B5143381E806706F0E64E24B813BA9F2334E5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908448, "uuid": "136415e4-7048-4a62-8b4a-c6c082eb561d", "value": "12288:xCgJFlQmwspYR1Dc0k+ar2/dN2khzF5O52C:IgJAmRpYRzk+M2lgsF5Oh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788908448, "uuid": "940e5163-9df7-40aa-9682-91dbebb7cf7f", "value": 445710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788908448, "uuid": "85135dc7-81e2-41e2-9c50-29342495e812", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908448, "uuid": "68071861-3af7-4949-be35-4234b10cd02c", "value": "meteor-gui-addon.com__Meteor-GUI-addon-2_2_0_mc1_21_11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129455dd-abd4-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788906275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906275, "uuid": "81b0672a-7436-42c0-a1f3-271d4bd7b370", "comment": "Malware payload (Mirai)", "value": "fdb2216e3a1fc323cfff3cb15f2b5c00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906275, "uuid": "4999d6ca-1d94-4c25-98d5-994fccca1c63", "comment": "Malware payload (Mirai)", "value": "2a64b441a105af29fd5fcd48bd7215f1044b045f85ba47d5b58cb888e1b20b74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906275, "uuid": "17079512-8935-4376-a852-488adab1e360", "comment": "Malware payload (Mirai)", "value": "dabff7dec1beaee6f2768918c3187a782a1ae8f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906275, "uuid": "77081e57-4105-4871-889c-57368fdf16de", "comment": "Malware payload (Mirai)", "value": "80b24bf666c973dc82c11678c347a566e0a85118c9f04585dcbac7f9a364b38edf59bbc4a3199ebdf4d661a566f9df68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788906275, "uuid": "541384c9-b536-44ec-b94a-5f62608d449d", "value": "T14B44184AFC41CE60F98106B6FA5E42D83B2303FBD7FE75019D150B742BA746A4E2B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788906275, "uuid": "bd362ba7-bb65-4114-b11c-0604ca4d1949", "value": "6144:QnYwoLAWnK8zbhPE+neubSSrWzZxEJA8BRD/8bkyhTQOmw/UqE:YYwAhhXneubqzZGA8v8bkyhTQOF/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788906275, "uuid": "248eded7-d484-48de-8dea-7c24d4eec222", "value": 267972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788906275, "uuid": "c1a84fdd-74ad-42e1-97d1-87dda74a088a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788906275, "uuid": "85aa1a9c-eff3-43f6-a195-f9783a6695ea", "value": "titan.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6b0481-abc3-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788899365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788899365, "uuid": "ba109292-d1fa-4221-806b-5115427a180f", "comment": "Malware payload (Mirai)", "value": "cad3a1ad1a214d81db6dcd9239cdf19e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788899365, "uuid": "82d78697-91d4-4db8-9944-a9d97fbdb61e", "comment": "Malware payload (Mirai)", "value": "2a6a7d52100618b5a38a8ec50c425d8137cfe1f33d86d526f474ed942f871e71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788899365, "uuid": "deed4a61-93ee-4fb0-9a7a-8ce9e673b2b6", "comment": "Malware payload (Mirai)", "value": "8040ce3ad50243f9caee2a8570054079e30db63a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788899365, "uuid": "e2c6f2a3-6164-4e09-8d5d-8155e2677d97", "comment": "Malware payload (Mirai)", "value": "0870fcefd9386373bdead6d1893528c85d9e6c5b75677349d2d83126e9a088073433ac69e36050cf6513ddc526c31f85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788899365, "uuid": "bfc23580-4839-4b5a-ba3c-d31b4be29850", "value": "T16F834B8DF783F4F5EC061A70102BF37E96759D121064DD6BDBA4FA62AE32713920A61C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788899365, "uuid": "2c920bc7-ac9d-4789-a54b-01569f9f835a", "value": "1536:SFcqL0cnNny3w94EGhRGj4PrXPqVOpRLA9KxjGA3:SKqLXUgADGjwrXPq9KoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788899365, "uuid": "716982ef-d9bc-4f2e-b5cf-728574e734f2", "value": 82788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788899365, "uuid": "a13e89f3-0a94-4452-a013-10a3e45be785", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788899365, "uuid": "efb9f5e9-f34f-4079-a571-b1a4e438744c", "value": "8876d082a455b569c9f50f98f4d25097f94b769e2e5701beafa182ea19911478.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d9b75a-aba6-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788886635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886635, "uuid": "64c1bed8-b400-4725-b0cf-d7858ecd9fbb", "comment": "Malware payload (Mirai)", "value": "54e0fca346e69a569d0390b8569a55e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886635, "uuid": "97c257c5-ac02-41dc-9347-4409a98ad096", "comment": "Malware payload (Mirai)", "value": "2a9f90236cce5398627aeee81f008c36023c314ec6e213869f518f2433a76300", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886635, "uuid": "d1abdfcb-9bd2-47e9-accc-0f9fce54c586", "comment": "Malware payload (Mirai)", "value": "5d31c16d46065f236db097f4321f53b2ca49133d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886635, "uuid": "9325db61-5b68-4f49-ae17-2e58cb1c951f", "comment": "Malware payload (Mirai)", "value": "03f98d6a112862d6b5ad4d678e6e76f66c187ae33e6684badb513c6ac307c71354a8cea3f9397864e372366ecfc04b4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886635, "uuid": "ce34ff6e-3c6e-4c98-bc2d-b72c5fff62b7", "value": "T159B33C0765518E53C0C60B7ABAAF866937236BA4D7DB33029A147FB42F4379E0F3A511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886635, "uuid": "876c7f10-af00-4034-b949-cf8e9aac93e1", "value": "3072:X2rsPMqt1a7smCrq9OS1FfaeADL8gs0Zmo:GroM21aDESffYs00o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788886635, "uuid": "fc4e4e73-b422-44f3-b775-40c71cbe7b3e", "value": 110905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788886635, "uuid": "f22bd6dd-22fc-431d-a84f-18bfc172f58f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886635, "uuid": "b0a3f98e-407a-4142-b4a0-d3ee09e8493c", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e568e6a0-ab9c-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788882577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788882577, "uuid": "e369bcce-6b9d-4c08-a3b5-93523d755318", "comment": "Malware payload", "value": "10b95d1594f17d21ac233990ea777c6d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788882577, "uuid": "55e40503-e246-4679-a82e-9bb882123824", "comment": "Malware payload", "value": "2d41372a3ee70895ee6be05e3a94d460dc9a2feb61b9fb907f3155e0c120c992", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788882577, "uuid": "3f1e6be1-df06-4561-be7c-d2a05a7c44e8", "comment": "Malware payload", "value": "ac3b1018c90f8271dccb2afc7c86ac206db9d9f8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788882577, "uuid": "71dd7394-d439-4084-86bf-1ee890bbb126", "comment": "Malware payload", "value": "d65664198c58e0ed778a8973b741e045544eaf6a94c4ecc2c7edaff71ffc969997b49dc11d2dd51658e989e9a888d788", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788882577, "uuid": "3d272b86-7747-42ce-b1ce-5682bc2a8be7", "value": "T1AD31C4DF14ACA82264488F453692C408A904E5CB644BCFD97F5D9C3ECDA4E19B279B78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788882577, "uuid": "3bfa990b-c571-4f14-9bb6-f7f3b24092e3", "value": "24:spWLdj4SFIJGrOXTNSXMDM+0izsCIs002/dZl:spSeJUtXMDj0izsCIr//l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788882577, "uuid": "cb1ad630-c458-4887-96e9-bd0ae41cab52", "value": 1519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788882577, "uuid": "c4b939bc-0a0c-4fd3-a199-2f3c7eb7d15a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788882577, "uuid": "a40d9fbf-2b9b-458d-938a-eac541a28fa9", "value": "a7m2qx.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4dc1332-ab9f-11f1-ab4f-4201ac107002", "comment": "Malware payload (MassLogger)", "timestamp": 1788883865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883865, "uuid": "d4d837d7-bc01-4204-b2a0-52eec0db6d66", "comment": "Malware payload (MassLogger)", "value": "dcb460b768f062e3847fba9d37d79a4e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883865, "uuid": "68f31dde-9a81-4d19-872c-a718bac8cdee", "comment": "Malware payload (MassLogger)", "value": "2d81789280f50f69d01df4e1a32153ab5317f4451accddf27f1c00e17f5ed523", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883865, "uuid": "51e03f36-c0a5-48e0-b51c-0f04da006fb1", "comment": "Malware payload (MassLogger)", "value": "3f0049d4d2a58f43044475c3eb39882815170ea9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883865, "uuid": "1e7b79ae-ea73-4b90-ac69-ce5226154783", "comment": "Malware payload (MassLogger)", "value": "f1aca648194ba6e8f3f72157c30057dea5447e90f2037ba9290558b84e9ba1b64b1c9143953d0c95a8128d344562ea40", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883865, "uuid": "69dd18a9-be72-4da1-8e48-06eb84f4cd6e", "value": "T1A225AC2DBA39B0548DC97526A22967B1D48B4EBF23375BC72C10FF81A642CB6CC61717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883865, "uuid": "f1653d3f-cafe-439c-9f5a-424d4e053186", "value": "12288:ocIL8Z53LLLLCRj46NDkW/QwQpGT75z3LLU54h53VpXXQW5r530OdeTLy53wLy5P:Ajt4wQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788883865, "uuid": "b6c6207d-db87-41ae-a4ca-703d60859427", "value": 972454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788883865, "uuid": "07170fc5-d9cf-4750-8034-6c4dd449f447", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883865, "uuid": "a20140b2-2765-41c8-8501-1f4764b402eb", "value": "cotizaci\u00f3n.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f83339d-abb6-11f1-ab4f-4201ac107002", "comment": "Malware payload (OverlordRAT)", "timestamp": 1788893600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788893600, "uuid": "9c177deb-2eeb-44bf-847e-12de203a1b67", "comment": "Malware payload (OverlordRAT)", "value": "c5ec50a1192b42d07999becf34448952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788893600, "uuid": "259efbb6-f5f7-4670-89cf-024577a171af", "comment": "Malware payload (OverlordRAT)", "value": "2da7c151676e991ebee73da26db28e6872f655b5487dc4b424a6024a3381472a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788893600, "uuid": "5879e317-7035-41c1-9fa6-ddb62f8db74f", "comment": "Malware payload (OverlordRAT)", "value": "659a5696359eff19577a80ceb84aca7f95899914", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788893600, "uuid": "e8a75da1-72d4-4b69-99f7-8f063f40eb20", "comment": "Malware payload (OverlordRAT)", "value": "bce7488856efd3d2d71a80a644f77128f10a7263de3e81dae02e5a5dce59d3f7a00ef60116f0e53130c7885fb4191b2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788893600, "uuid": "b37841c3-3382-44b3-af32-050ccf2cfd2c", "value": "T1E7678D47E81509EACA5891B5C9AF8303B374BC041B2667CB2E14B778BDE77C59E7A340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788893600, "uuid": "ff2aa20f-5413-45fb-8934-d505d6f1b8c6", "value": "e2bf3ea500ed6add4b896d96c842dc0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788893600, "uuid": "443f7cb8-9c51-46c8-ac1c-32433c2db0ca", "value": "196608:Vdc5sro/5O2HxDVMAmeH5K0QUObJ9GADJPEHrYwuKUxVnQmhbP2cwwNTVU7V:VeV5O2fp7o39F8HrYcU7FbPDVU7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788893600, "uuid": "02c874bc-e3b0-49f3-af77-02df53204987", "value": 31751794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788893600, "uuid": "6e8da08b-a4f4-45d1-98f9-c256fd168037", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788893600, "uuid": "a0436dad-ba10-4bfd-b47f-85bfdd5bf550", "value": "agent-windows-amd64-483da288.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa09bb2-ab48-11f1-915e-42010a9c000a", "comment": "Malware payload (Formbook)", "timestamp": 1788846248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788846248, "uuid": "34384a6c-f520-47e3-95a6-324195cf8fec", "comment": "Malware payload (Formbook)", "value": "32ce6be2690e06880778dd50dd8747c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788846248, "uuid": "9d2ad35e-8339-43a8-b748-c774cf1ae488", "comment": "Malware payload (Formbook)", "value": "2ea9924d172719ebf9dbf3e5edb2c87c31e4e3f740b877e8af2454c6dc93d8d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788846248, "uuid": "40308414-c056-41a1-831a-a1eb4eae17bf", "comment": "Malware payload (Formbook)", "value": "5806e36da0f28a3c9c96e87c31c2e55604429152", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788846248, "uuid": "a9f953a3-ed13-4f44-ad8c-ccf74ddf9036", "comment": "Malware payload (Formbook)", "value": "45cd6395b699d0e82f75f21869bb993dc4b55f21355cd405940293797affcebdd947de64c3163ebe2ad967241273d143", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788846248, "uuid": "ac17d4e4-611d-4733-8f7b-3da56ffbd8f2", "value": "T1BD25DF686617DB37C5657770CA73E2F406692EA9E810D23F1AE97DBB7F31E300914282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788846248, "uuid": "7d15c310-0bb6-4c4c-ba8a-dd2c4dff4b7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788846248, "uuid": "c75b28f2-a32a-45b0-be99-dafff8471175", "value": "24576:yVpqe5CPXiSRF5KbeSt5hYOoorVI6U1IqPC23liPgWcsFeP:yVB5KSSQbLt7YOdrWpK23lshFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788846248, "uuid": "ec53bda5-7f9f-4e13-a69a-d0b527d4738e", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788846248, "uuid": "2a2a214f-e43a-4664-aa32-4046d6916319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788846248, "uuid": "fb8e3cf5-504b-4ad9-acb6-f2c624da0546", "value": "New PO-0095.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45da98a1-ab28-11f1-915e-42010a9c000a", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788832488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788832488, "uuid": "2f7516d5-a726-42f1-8920-74ca209dbc7f", "comment": "Malware payload (AsyncRAT)", "value": "457371960d83375e5c805ebc7b99932b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788832488, "uuid": "7f6903e8-9850-4bdd-b9bb-0d7f976b872f", "comment": "Malware payload (AsyncRAT)", "value": "2eea097e689004e05f44f04ff22909c96d43d04fa7e5936f3709cf0d3a36c041", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788832488, "uuid": "3eb51446-6d9f-4f7a-bf24-002b3edfb202", "comment": "Malware payload (AsyncRAT)", "value": "9bd21215d9551af44e0230d281efdd16218313fd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788832488, "uuid": "23d29bd7-0433-452d-8852-a8f0cf702fe1", "comment": "Malware payload (AsyncRAT)", "value": "e819c2c5f0814d420994e1b8ada546563fd355dfd8ffde9818c7c72643a3ec8fc7a17a47f8991a9e762a39e795780852", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788832488, "uuid": "d7256b2d-36b4-4e49-afe8-76161504fde8", "value": "T1CA034D087BE44226C9FE6FFA3AB375020770E6075913E74D58D5896A6B77FC085007E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788832488, "uuid": "e729ff22-56ee-4ef1-ad96-50638e0669a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788832488, "uuid": "f70dc255-9ee2-4b67-8485-949971e23b08", "value": "768:Jcq50224u+jTIerM6tQ6BD0TFU9Y/OMhnbJ:Jcqm224P4eOgDMFU9Y/OMVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788832488, "uuid": "957f2ac7-cc74-40f1-a717-2bb0f91ae5f8", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788832488, "uuid": "52987d4b-f9fd-43ae-b93c-0bac2be373c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788832488, "uuid": "6750151f-4dcf-415b-951c-27fd4587cb96", "value": "2eea097e689004e05f44f04ff22909c96d43d04fa7e5936f3709cf0d3a36c041.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f1eb8f-ab20-11f1-915e-42010a9c000a", "comment": "Malware payload (RevStealer)", "timestamp": 1788829134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788829134, "uuid": "93f50126-6b4c-464c-a8f5-066e4d52e2a5", "comment": "Malware payload (RevStealer)", "value": "611abe6d8c01613f95f2009c214e7811", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788829134, "uuid": "eb7df4e8-05b0-46aa-90b2-da6d90770518", "comment": "Malware payload (RevStealer)", "value": "2f7484cc330e2550241415b1cafed7814bccef729d49d0c892a0283218915a0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788829134, "uuid": "ded1aa70-c197-44da-91f4-b546c13dd9c0", "comment": "Malware payload (RevStealer)", "value": "3e91623c156e9f5a5cfef37a7a8851dc2cc5ac52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788829134, "uuid": "038a245c-0f82-404b-82d3-c8c3b76ad21b", "comment": "Malware payload (RevStealer)", "value": "6a34921284a2044f8db7aadbd5950174d17debbc81a8bafa73a0804913ad158e8bb82152a440063bac8d580d5c315260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788829134, "uuid": "f41bb812-9935-4d53-9997-beced4c9d77f", "value": "T1C5E523A5BDC63DB2E036C3F367A7A4BE30293F5986648C4E36C91B497E429242C37745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788829134, "uuid": "7decf8d1-fd86-42ca-bf70-f0a8937b4071", "value": "5a2ed47d8c6c6433dbc831d38c92042b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788829134, "uuid": "37c83e68-7f19-4228-b774-4d305f5f6ad6", "value": "49152:f5jSXDCIl+64aruRbVLkqrPkTesMTyXXV9UcP0k2SxYFJxBEN9iFGH51OCQgda+W:heXDC0/4QuRbVLkqIes0c8a0k2Syi95s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788829134, "uuid": "4cd87654-25c7-4d44-991e-83953a1047ca", "value": 3062784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788829134, "uuid": "51b4a173-3a1d-4c8e-9901-efedf02748fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788829134, "uuid": "38f0cab8-753a-4b04-8a65-66a074d59f67", "value": "2f7484cc330e2550241415b1cafed7814bccef729d49d0c892a0283218915a0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f1232a6-ab20-11f1-915e-42010a9c000a", "comment": "Malware payload (CoinMiner)", "timestamp": 1788829148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788829148, "uuid": "471baee0-963e-480d-ab99-adb5f580ab9e", "comment": "Malware payload (CoinMiner)", "value": "c31c66f9b536783c959ddf2a5bb69043", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788829148, "uuid": "ae395478-467b-407d-867e-4cbb29ab559c", "comment": "Malware payload (CoinMiner)", "value": "3176555d9ac8b9ab01a4ed79a829f88df55f278c5f8134b53f0819542526b4f4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788829148, "uuid": "24e22d86-143e-472f-88d6-c244e1db6123", "comment": "Malware payload (CoinMiner)", "value": "b23f2cf3d485a7ac958e4dc63c9c698066fa64ee", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788829148, "uuid": "780cbd97-5baa-4f94-8094-6108544b98fc", "comment": "Malware payload (CoinMiner)", "value": "97f497d7cc1b0ee4b26d5098b69da33aff904658770cefe1978d9ad9d5fb53152506c8847820bb7e1f8290af41b0c47e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788829148, "uuid": "a49ddb97-abdf-4c8a-9520-86128c2728d0", "value": "T175865C03BAA504BDC0E5C470875FD5A3AD35B8445221797B7A84AB203F76E309F6EF62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788829148, "uuid": "3d48c68d-7bba-43e4-9676-bdf8ee9575a7", "value": "98304:3FVto2YP66c/CtywhqjmfWj9HXForXypXttjtUCiWAPZHHJwrsLwRqR:rASTmywgH8X6xyPZHKrsLwRqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788829148, "uuid": "eb06ffe4-d989-4ed9-8158-1f46f89866fd", "value": 8041376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788829148, "uuid": "40e40ddc-1a48-4653-b43c-e4e3cc2bd3df", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788829148, "uuid": "1288e15e-780b-4774-91a7-beb6c5f0963e", "value": "3176555d9ac8b9ab01a4ed79a829f88df55f278c5f8134b53f0819542526b4f4.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6ef158-ab3a-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788840257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788840257, "uuid": "78e1ba4a-ed2a-479f-bec9-7a03e9419a9d", "comment": "Malware payload (Mirai)", "value": "b68b00eac2d647ab2f4abdeb5bd4ce6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788840257, "uuid": "7132b134-e253-4d68-b4a6-e5f1899607a7", "comment": "Malware payload (Mirai)", "value": "31a7ccef0d26c71a9239119993a5325bb6bd8da2339586b2f7b352457fdea85e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788840257, "uuid": "9f7cba13-a65c-42e3-a599-8b5a2df82b8e", "comment": "Malware payload (Mirai)", "value": "5d6a1ba87b76d242d0ba7b5e3a3824a70bad4d5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788840257, "uuid": "845bec59-683d-4d5e-8960-9d3d5613bfb4", "comment": "Malware payload (Mirai)", "value": "f80f0733d55e117ccc16a3b3da7e95c113c6bbfd04239671c4e547094481a65d36adb1c838289900184d7a06ede1fe3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788840257, "uuid": "22342e0f-9fe6-4e74-8f49-d8b57dc21e4a", "value": "T172D312CF1DA5AE5BCF780974B79B0A8D5BA7F68712AF811233008142D57036FF4A162D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788840257, "uuid": "0b1013a6-4462-4649-a31d-405c1328252e", "value": "3072:zyheyiFtdfw53FIqkCiHcuqzVn9Hh9UgaJWaOSODeV4D7qMxovP75zpr:mTiFDEF28vN9B9Va4aOXyODOMxM5zd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788840257, "uuid": "d597c773-6981-493d-95d6-35567b123d07", "value": 140264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788840257, "uuid": "0efd2684-8b88-4fe0-ad76-d80167d836ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788840257, "uuid": "170d0057-a77e-4199-98c2-cc19ec5bcea4", "value": "31a7ccef0d26c71a9239119993a5325bb6bd8da2339586b2f7b352457fdea85e.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6dbefd1-ab23-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788830530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830530, "uuid": "bf961a40-2fe9-4c18-9156-254656140303", "comment": "Malware payload", "value": "acb65c5de47dd5e4234c3b30393d3d3b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830530, "uuid": "6bc6df59-c5dc-4e3c-bdd3-5098211a2609", "comment": "Malware payload", "value": "31d753eb195c7b13161d5e6aedfb23ced77a98b64549e5e65064d5202cc13761", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830530, "uuid": "01f859b8-01bc-493c-93d2-5a547abb20de", "comment": "Malware payload", "value": "4a500ff8c64d2eea8c25ef1617307b5c62d73dd2", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830530, "uuid": "f3818f1b-c70b-4012-9f8a-55f908f421f9", "comment": "Malware payload", "value": "b3d41e02f967521e910f20373f9e49e1b363a2f52e491aec1fed39d7aa2633c8d41b32738ab499df582fa72c77262692", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830530, "uuid": "c0412d0f-b811-4c30-a587-21fa2d62e591", "value": "T127F05C45D8B04919523016542EC0F9095EA6EA4793496D4872EA61B90FC4BC5CECF97C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830530, "uuid": "24e953bc-f36c-428c-9403-04280dd79e68", "value": "6:qTIuJzhqIwGiY63fAbplilAl3t11/+SR0AqIbR2AWHwlP49NV4LKTjawlu7iAxFa:qTp0JYyg9193R5qsPWdNVS7iQqAEd2QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788830530, "uuid": "4812ef06-15de-4a41-941f-c554074fa1c5", "value": 446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788830530, "uuid": "dfe54891-2347-451c-9c65-c80f8109b9c0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830530, "uuid": "0901b6b6-076f-4f65-9352-dde664407839", "value": "goodthingsforbestpersonforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f395d53b-ab31-11f1-915e-42010a9c000a", "comment": "Malware payload (ConnectWise)", "timestamp": 1788836645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788836645, "uuid": "09789938-742b-4763-9830-74dfd07297e5", "comment": "Malware payload (ConnectWise)", "value": "83235e61c6bdf0d75a1777e0478f2362", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788836645, "uuid": "1265c161-1f7a-4167-bfa3-3cb362354c7b", "comment": "Malware payload (ConnectWise)", "value": "32d22a5e42b2b9fb3d5782103d63b90dc0346358fbaacc1a78102f0d89a277c8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788836645, "uuid": "5a9dfa5d-7684-4678-a808-9295427580d5", "comment": "Malware payload (ConnectWise)", "value": "948500daeb086212459505ff2df662610b4ca554", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788836645, "uuid": "357ab1f8-73b7-434f-bda6-7e37f42834da", "comment": "Malware payload (ConnectWise)", "value": "5d06dd0dc59d7316368abaca7e5df0b6985561d98bc8d8310a29ce8a4a9661968d24c8f01a2af4afac4011c2c7605982", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788836645, "uuid": "3b21329b-37dc-40fb-b27a-16da21ad2e88", "value": "T1DCD61211B3E595F6D0BF1678E87992655631FC044722C2AF53A4B96E2C32BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788836645, "uuid": "c9df9c88-bada-4fdb-93b7-af458cab4778", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788836645, "uuid": "89c0428f-cf6f-4430-ad5b-2f726ff5bc5e", "value": "393216:rCXvI5MvHxyJNCXvI5MvHx6CXvI5MvHxZCXvI5MvHxw:rZ6HxuZ6Hx6Z6HxZZ6Hxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788836645, "uuid": "d74b1a91-39d8-49a7-bb62-5be44ecb01d8", "value": 12762168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788836645, "uuid": "8ba72978-bfc3-4c33-9669-24f07f07f3a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788836645, "uuid": "b6f0d2f8-a003-47ef-8838-b1ae42b66c8d", "value": "32d22a5e42b2b9fb3d5782103d63b90dc0346358fbaacc1a78102f0d89a277c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe8a0bb-ab58-11f1-915e-42010a9c000a", "comment": "Malware payload (ValleyRAT)", "timestamp": 1788853382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853382, "uuid": "66863fc7-80ae-432b-98c9-f47b6109aa86", "comment": "Malware payload (ValleyRAT)", "value": "060ce5bf594cc9dcf7b9785a2fa6a175", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853382, "uuid": "59dad450-b058-4a21-b1a0-4f1b99992527", "comment": "Malware payload (ValleyRAT)", "value": "33203c31a18282afd44f9f2681ad37daeab76c6d69cc6827f921d6c88890594f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853382, "uuid": "8c8b7d94-4a87-4c25-844e-9357b7c886e0", "comment": "Malware payload (ValleyRAT)", "value": "da0e32ae93b9443a3e0e9ed8846164229324d553", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853382, "uuid": "6ea0b976-379a-4cf1-96be-7fe296b27f4c", "comment": "Malware payload (ValleyRAT)", "value": "54e35d28e82d24582ae1ee17a24e43364ed9614604f49e1413b5635c4631e09b4280430b9a4f759cede12cd96110ac67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853382, "uuid": "1439e70f-cadb-4cfa-baf4-9e69d640c916", "value": "T138754A077CD158FAC0AE92328966A1927B72BC450F3227DB3A90B73D2F72BD05A75750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853382, "uuid": "f476a9f3-14ee-4db0-aae1-889d4c142554", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853382, "uuid": "d2b958ef-290f-4d90-8720-16ee86e46ae3", "value": "24576:gIp6is+0bSJ4/3KHjbvQRrX+jbj89qVsh:gIk/9Y4/3Ej8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788853382, "uuid": "202fca7d-a509-4f4e-82b9-a1d97944c1b8", "value": 1694720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788853382, "uuid": "9323cf47-56b0-439b-b8f9-bb152652a68d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853382, "uuid": "bae5859e-51b5-4b60-9068-1d583c6b591d", "value": "060ce5bf594cc9dcf7b9785a2fa6a175.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d1acdb-ab2b-11f1-915e-42010a9c000a", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1788834072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788834072, "uuid": "b7ceb4e5-7be0-4869-9e11-4aa3ad542ac3", "comment": "Malware payload (VIPKeylogger)", "value": "0e8e6035525273fdbe044a337aeff61d", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788834072, "uuid": "d4057322-b2b3-4bca-b3dc-a73defdefeb0", "comment": "Malware payload (VIPKeylogger)", "value": "33256269f89069122c73e6e4bb0e2af65428cc80bfe19282637c4e6765602629", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788834072, "uuid": "3229a293-9d6c-4c8e-9e42-39e893293761", "comment": "Malware payload (VIPKeylogger)", "value": "4c8916f50ee372ba1d46ec5e8d4fbfa41a3711a3", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788834072, "uuid": "ca1cecd3-0115-4f17-be5f-127545128ad9", "comment": "Malware payload (VIPKeylogger)", "value": "293d0a44d4594a7a512fb45157c86e04d701363e005853f843cb80bf08114b9c304d58b70f1485f329159fd80064b813", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788834072, "uuid": "b4425af9-0e1c-4be7-b5dd-cf5cade5c422", "value": "T1DB4423E72408C5C2648FE9C1D370E0F7AB5C3D758EE1653AF68B8D557B28AA9CD3A400", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788834072, "uuid": "91512c2b-6dd7-4ba2-ace3-bfba741a02f9", "value": "6144:OWWWhZEC8T7VwMa99/qgj+Njv11OOMjjBzefgQp:l9YhU/tydbwsg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788834072, "uuid": "86ac3d81-e1ab-46c3-805a-d01fe966a961", "value": 255566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788834072, "uuid": "8dc67f3b-bb55-4671-a909-f923cde03b59", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788834072, "uuid": "837c68f3-53ec-4105-b40d-59605419256c", "value": "virud.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e1c51d-aba6-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788886628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886628, "uuid": "f55260b2-faee-46fc-94c9-5ea2ce349dab", "comment": "Malware payload (Mirai)", "value": "0e87a503e736cf059b3443606ef1df7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886628, "uuid": "6c3cbad5-c9ce-4787-a8ed-f302220c30a6", "comment": "Malware payload (Mirai)", "value": "34307d43ad3de41e8913fead533bc27f33e458b83f0107053b822fbb5a6f1c57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886628, "uuid": "9e4fe470-46b2-4876-be14-89f17b6bcf4f", "comment": "Malware payload (Mirai)", "value": "9ce609cb39c26a90303c96ae46facb4ff120544a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886628, "uuid": "545849a1-a5ce-4171-8c1c-86e5b5e77b3e", "comment": "Malware payload (Mirai)", "value": "c3efb9883ab1686dd79ba0e54711c0e69ea50d1115f7b23017dba6d4f58e63e37209830ae91376961e5501be53666de4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886628, "uuid": "612b9428-63ac-456d-997e-c1779743394f", "value": "T153D34C85B793D9F3C8404BBC30AB9F314977E87F62278AD5E3B86CB25A06541A00776D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886628, "uuid": "d7d2bc80-d081-4af8-a511-e7d711a1643a", "value": "3072:bDVNA6SC6fpFwhJfr7JYucJMCHcQz+nBBWAKta93o5VQl857/:fVitJfjwhJ7OucebQzS/93WQu5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788886628, "uuid": "7af40a9e-6ca3-4d6f-8120-2468a023b507", "value": 137403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788886628, "uuid": "cac60e0b-6d5b-403f-b50f-b78694fab8b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886628, "uuid": "7a70fb01-9b82-46e6-b92d-b197e90319f3", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd9af3b2-ab5d-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855452, "uuid": "34ce3419-8b3e-4717-9599-5e55995e3ea8", "comment": "Malware payload (SilentNet)", "value": "5cfdc919a81c3af16367d14dbcc6e44a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855452, "uuid": "a6830649-881c-4807-8099-963d740cf988", "comment": "Malware payload (SilentNet)", "value": "3508634e36fffda9e52fb256ae52b0db39f97450723dcb29d0d422b9bfb72208", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855452, "uuid": "9847b9ef-b823-4585-9472-30600a42587c", "comment": "Malware payload (SilentNet)", "value": "eccbc8cda1674e672c1d4ee6a35c19e93573e58b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855452, "uuid": "fe486ce0-804e-491b-8f2d-98e9a63f4279", "comment": "Malware payload (SilentNet)", "value": "e79606587e1b2d35c8eac0b657df6ab7a3d10a68ef4d9ca8016d89a589822914dee177ef9587c7113a1ddcb96e1771cc", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855452, "uuid": "fb50ae9f-415f-430a-95fb-8307f9422375", "value": "T19637331E17ECAE81FD476BB6C0569470FBB902A4E197207B2F68056858C2F610F8977F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855452, "uuid": "2733d575-e6b2-44e7-b45d-6d33df2d3406", "value": "393216:ow2tHrg/XMEi6hFvlyh+f2XcMISt+bROSoaGJSBjHbKJnTQEYYtNBLWi115kt7my:cBrgUEinh+f2jtjJ+boTrNlWif5kt7my", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855452, "uuid": "c1615d35-9dac-4d78-a100-4d0a3a77edf3", "value": 24463524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855452, "uuid": "f911af2e-e597-4f0b-bdd9-c56bcec25b4d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855452, "uuid": "0b7af44c-6cbc-4b7c-8d80-fd90ecc24180", "value": "LarpClient.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5077ec-abd9-11f1-ab4f-4201ac107002", "comment": "Malware payload (SilentNet)", "timestamp": 1788908463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908463, "uuid": "47e51e69-ef0e-4451-ab81-78cbe496ca99", "comment": "Malware payload (SilentNet)", "value": "f10daf9d18f4a2f210b2e9d83c892313", "object_relation": "md5", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908463, "uuid": "b761bdc6-e071-4ccb-a5f8-e160ca8c5d61", "comment": "Malware payload (SilentNet)", "value": "35222d50b11bc02bfb6bcb3127b5a55179bbd1112042466d26799e7c08d86287", "object_relation": "sha256", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908463, "uuid": "80c599ef-54de-4fa3-8f19-b476dd9f2a2a", "comment": "Malware payload (SilentNet)", "value": "d404583ffb6f888ccfcd8b5dd5d18a1c6cae2651", "object_relation": "sha1", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908463, "uuid": "cc1d72d2-b4be-421b-b03a-5f4d634dc314", "comment": "Malware payload (SilentNet)", "value": "58a482ff5eacd3d11a196355b64eefad31f54d3b2f7645a9dbf96c7b7e6e8cc5df682d06dc74f6e1db5856af4b6972c2", "object_relation": "sha3-384", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908463, "uuid": "6b916867-439a-46a9-98b8-cb0eb8defbac", "value": "T1B0C40166D84CCC3DE54B327510AF2F63901992B598C6A92B0670F78BC152ECA5F3E61F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908463, "uuid": "dcd447a5-2e63-47ef-af42-3611158b6e20", "value": "12288:eZy4bnePWquIofzcb6tNYluUkx5JfJarWFYIc16NgU:l4iHKwmo87ao6SgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788908463, "uuid": "a2e466ba-85bf-428d-ae56-e9ae3c082560", "value": 585088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788908463, "uuid": "32f8465a-f6ed-4fce-8f0a-5e2ae1190178", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908463, "uuid": "168635b9-1cf4-4b0b-8daa-5a4f73cb861c", "value": "novowareclient.com__inline-payload.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0601554a-ab2d-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788834528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788834528, "uuid": "f294f709-3b70-411b-96fb-bfae4a797376", "comment": "Malware payload", "value": "75aa778068ba2f1e76a1077a109687a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788834528, "uuid": "12785f87-702f-44fa-ae33-b9f582a553f9", "comment": "Malware payload", "value": "36e02a63b313e479eca63d8d05d3e6ed1d42409ae3a316e8e500a93e5596f8f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788834528, "uuid": "5ee5069d-1ea5-4983-bcbc-5e3a85d3073e", "comment": "Malware payload", "value": "3f95a1b45a4f380215a184d03116747f3bd90339", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788834528, "uuid": "d7ce19c1-03a7-429c-8d25-a28aa1d9d58a", "comment": "Malware payload", "value": "7504191652675f286fbda7cdc1babfe75924519c486bb91ccabec9da8c24775c6cde43c22e62baf3239f1b9a0c4d9710", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788834528, "uuid": "4e4dca8a-6471-4d05-9c89-06839f378eef", "value": "T1C1B312EC74D748B0E2A069F7FD629D8491AD38400F8AC6C624D40D9A5CB2FB49E947D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788834528, "uuid": "b1572cc5-0962-459c-bc25-710f93317716", "value": "3072:YtV0lEiildL/VqExAxsvfLSqAKZ4oqrxy031lYf:Oi+dbVqEQXaTgr3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788834528, "uuid": "693ae946-80ef-48c1-bb7c-48a1f8852b8c", "value": 116370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788834528, "uuid": "c727222b-70d0-45a2-a76e-5ea58d338aae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788834528, "uuid": "61cc19ea-0de0-47ef-91af-516366ad74b9", "value": "36e02a63b313e479eca63d8d05d3e6ed1d42409ae3a316e8e500a93e5596f8f7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6089a8-aba9-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788888198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888198, "uuid": "e4841a74-db16-4355-aa84-24cfdbe2cee8", "comment": "Malware payload (Mirai)", "value": "9d0725e62f1c1d8072e7ae4c819f8387", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888198, "uuid": "90beba49-e6ee-466f-8c82-98f70831c579", "comment": "Malware payload (Mirai)", "value": "384bc17a18ae871da6b187aced5e28c37b0b15b7b09a02d7429157e8e692961f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888198, "uuid": "25212076-dbd5-4835-9cfc-b5be62600298", "comment": "Malware payload (Mirai)", "value": "3a636e3cb49e78b430ddf0c717749a4bcdb7d408", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888198, "uuid": "17c6befb-9937-4395-ae3e-1117738c5787", "comment": "Malware payload (Mirai)", "value": "aa8a365f57c9bd5fad16488360f84014d0f39a05b292ab0bb94b8644e528f7aca4df78269da59daf10cfd3610f1bd137", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888198, "uuid": "380870e7-2370-4606-8dae-f3cf3dc751d4", "value": "T17424C70AAF510FBBDC6FDD3702EA0B0535CC651722A42B3A7578D528F54A94F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888198, "uuid": "dc9cdc81-cf32-4fc6-84e0-9519819c37f6", "value": "3072:Vd74LgKMY9mjKOf6jlyteQfmjtXpJqC8:VdEglYFVjltIa54C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788888198, "uuid": "4cad98d4-0dff-43c8-8026-7fd20aca9bab", "value": 211780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788888198, "uuid": "d089dc60-9048-4eb8-8119-bb9c04e38d18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888198, "uuid": "49550b28-98a5-46a3-ac64-a31589758f16", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df4d571-ab7d-11f1-915e-42010a9c000a", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788868928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788868928, "uuid": "42a74d5b-70b2-4b7a-bb37-10259ad1b8c3", "comment": "Malware payload (AsyncRAT)", "value": "82a72a9e099cfc8d9e347140c92ef4de", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788868928, "uuid": "655101e2-a16f-468c-b09c-c0e6e295c438", "comment": "Malware payload (AsyncRAT)", "value": "38bcae03ba14fbc3e03b79b68dcc609f93dfd3a58e2fa9ed3a7cd0e29fca4825", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788868928, "uuid": "c7784e8a-c55c-474b-bda5-1571411bd4b1", "comment": "Malware payload (AsyncRAT)", "value": "9762047bea7037ad3e1d8d90ab36f896591623db", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788868928, "uuid": "e7a2666c-a616-477d-8cfd-cce8517e334c", "comment": "Malware payload (AsyncRAT)", "value": "489604bc7fb2a2dcf26eb5265cc44400e8cc9c19618990d446278474411fb1887f01b1be67c2d7c72b2e7c6dd442fbe0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788868928, "uuid": "f8e15481-b548-46f6-ac19-cd3ca75402e2", "value": "T17114F17037C069296379CF187A7EFDDC19DA88603C0DF98E6466FBD52A486894472F0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788868928, "uuid": "75167a57-47a1-439d-9004-5c408162a6fd", "value": "6144:Ow0t47Y4w4Q75fpYx9tZqzg0HoPQl8iZPKZC0+cjfn56zNyDyJrmE9:O9GG75B0tZvQiI0+cjfn56zNyDyJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788868928, "uuid": "bb148946-d8ef-4a04-b5e1-b1bebe8c5ca1", "value": 205780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788868928, "uuid": "8bd00452-dce5-4b39-88f3-c60a056c1f23", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788868928, "uuid": "47482e9c-c2d3-4121-8f87-9eaf35dd92fa", "value": "Cotizaci\u00f3n BanBaj\u00edo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a32df46-ab8b-11f1-915e-42010a9c000a", "comment": "Malware payload (SaturnStealer)", "timestamp": 1788874989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874989, "uuid": "eb6728f0-976b-4c43-9bc2-a93f1b07301b", "comment": "Malware payload (SaturnStealer)", "value": "ed7e50fea560352ac0973294098d0011", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SaturnStealer", "colour": "#295340", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874989, "uuid": "7dffa0bd-9b64-40d3-9c08-140135534bf7", "comment": "Malware payload (SaturnStealer)", "value": "39240700758321242861256f3fb39386a9f7f1b29ac4c69acdc774b5f45a139c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SaturnStealer", "colour": "#295340", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874989, "uuid": "53d0861a-c9a6-4347-bf0d-ceb3b8571147", "comment": "Malware payload (SaturnStealer)", "value": "6520b6d79b658946608e0b87da2b401459ae819a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SaturnStealer", "colour": "#295340", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874989, "uuid": "21f1ca88-7cbc-40de-be96-4b2dc8c61212", "comment": "Malware payload (SaturnStealer)", "value": "68eb81b1d4a13aadb287690890602f2d7cd52af15050a8a2f5461752185dce870f7ac3a1320aa17ae3d4ab1681076030", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SaturnStealer", "colour": "#295340", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874989, "uuid": "6d0b4931-8dc7-48f7-ad1e-be3360ec5e1d", "value": "T184D5D05AF3A440F8D067C5B4CF169513EBB2B4061334A6DF57918E962F23BB26A3E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874989, "uuid": "dae3b564-d205-4e6f-a658-27107a1d9c60", "value": "482376bc49dbb897e033716666955d5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874989, "uuid": "e7114be1-2f9e-4108-8e00-df921bbe98a8", "value": "49152:ST5Wj5hMKtPZQBbo2BiIQEZQLA9IXDA8mxHYlU8+BODtqthO5YFTkRWIDxb0w3Cr:T1hMKdZEN/EDFiYcBK5iToWku5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788874989, "uuid": "9a53b98c-5551-4bde-81a1-973c558f2c3c", "value": 2890752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788874989, "uuid": "6cdc5e62-edfa-44c0-b5b4-e8200255f6eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874989, "uuid": "d8da53e1-3bb7-45ab-94e2-87370d536377", "value": "39240700758321242861256f3fb39386a9f7f1b29ac4c69acdc774b5f45a139c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcdf3032-ab36-11f1-915e-42010a9c000a", "comment": "Malware payload (ConnectWise)", "timestamp": 1788838754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838754, "uuid": "6f3d52a7-dfd3-4855-afdc-7d43dc626511", "comment": "Malware payload (ConnectWise)", "value": "5a92673c0a40f6c71844dc5337c7d50d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838754, "uuid": "3a99317c-36c7-4865-9e1d-6ea3638b671d", "comment": "Malware payload (ConnectWise)", "value": "39bd8e920636476e5816985e8f363966ff76c66dbbfdda45aa967d29b14e539c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838754, "uuid": "65aaed1a-03b3-4c84-b7c7-df0e8dac870c", "comment": "Malware payload (ConnectWise)", "value": "7b588d2368c059cb884e3f12f4b96c27987e1f47", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838754, "uuid": "a1add81f-d600-48c2-940f-b03e409d9a76", "comment": "Malware payload (ConnectWise)", "value": "d3dac32bd88e680610081a9fbc709f7ff9ffa8f7560411851e265bd54dd98d0c449fe9964d444776dfdd13095a78b621", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838754, "uuid": "2cb59635-ec4e-40fd-8740-b3bf3607a271", "value": "T1AAD6232523FD401AF8F75B79FD3682A45D72BE68CF21C11E9228B90D2A74D4096727B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838754, "uuid": "42e7b57f-6f68-4b54-b810-3705c9cad916", "value": "196608:4Wh0cGwTWh0cGZWh0cGPWh0cGiWh0cGaWh0cGzWh0cG8:4WacdWacoWacEWacpWac3WaccWac5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788838754, "uuid": "378e95df-4488-4ff5-be4a-cce340e98488", "value": 13389824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788838754, "uuid": "4929e6df-2f49-47af-a560-367e46555a8d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838754, "uuid": "05fd8578-4502-4f58-a4a9-78dda19c7888", "value": "39bd8e920636476e5816985e8f363966ff76c66dbbfdda45aa967d29b14e539c.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7a8b60-ab72-11f1-915e-42010a9c000a", "comment": "Malware payload (RevStealer)", "timestamp": 1788864228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864228, "uuid": "927bd88f-539f-4958-9a89-2add65e739a5", "comment": "Malware payload (RevStealer)", "value": "b4f589f170c297cfcc9b6634ee1fda29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864228, "uuid": "6432977a-e43b-42e9-9136-0a870f5da06b", "comment": "Malware payload (RevStealer)", "value": "3a1d4399d6a48caa8b521dfb3b0d01684d1469cf50e2fb9e5391f8241a86c080", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864228, "uuid": "b9526818-27fe-4105-a362-bdd88e1b734f", "comment": "Malware payload (RevStealer)", "value": "34bf069154c547728640835c2f9f424400bf8cca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864228, "uuid": "984b399b-22d7-4384-90a6-1118d8d3e4df", "comment": "Malware payload (RevStealer)", "value": "1a143557db4d8e144faaf413e1bd3903f8adf63bb679f2b70668b3c93ee1c390d93bf297866ca4bb67f1974200aef0f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864228, "uuid": "0e2fdcea-0c4a-427a-bb67-648ea05fa286", "value": "T139D52386BAF31570E476C7B68C43B47DB1B9BB8485608E5F7BCC5B500EA2A142C36379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864228, "uuid": "c8ce9d64-8224-4d5f-b13d-bfac6024d8da", "value": "fe230628262faec735b6f015758b7519", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864228, "uuid": "6b71feca-d2ef-4665-b33b-3183f89b5751", "value": "49152:LI3Ju+QY6y2N6vabZY8CWyhbIaVLRiRtWzN2Mjh8zBMHhujbQNvk:Ls/Q8MWab2m+hRoWzN2w6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788864228, "uuid": "18f7302c-17b3-46d2-9c6e-4a2fac39cecd", "value": 3008512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788864228, "uuid": "ca465bc2-1571-4e05-a458-438c9acfaf6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864228, "uuid": "e1c739b4-5251-4e0f-97b4-3fd5646eb444", "value": "3a1d4399d6a48caa8b521dfb3b0d01684d1469cf50e2fb9e5391f8241a86c080.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10cac0fa-aba9-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788887804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887804, "uuid": "4e25782e-b8ce-4cbc-9a75-ae54e3db3220", "comment": "Malware payload (Vidar)", "value": "fcfda692c84f930191c2b8b1adbcddb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887804, "uuid": "d066f353-6b90-4ae8-ac7d-ce8816972a5e", "comment": "Malware payload (Vidar)", "value": "3a95e1c2c599e7c27537e42713451e862dcd318660bbc11bbb45f1432f68499c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887804, "uuid": "7d425714-1e4d-4b2e-8a05-f7646892e0de", "comment": "Malware payload (Vidar)", "value": "cda8edd09090da67fc542a4f839135fc156363f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887804, "uuid": "802553ad-f217-4573-9e9f-c971ab8b96f3", "comment": "Malware payload (Vidar)", "value": "8fef9ec650e872fe5fe58d573823fa8b336573d4bfe44fc405e20ba8d5c3c3103ae42a72337d7e8d888bfa0881745e49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788887804, "uuid": "f68ba524-5b34-44fb-8ea1-b5185666f308", "value": "T1F0B58C0AACD008B6D46A53328CB752927B39F8180B7327D72E26A7782FF2BD05D75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788887804, "uuid": "93b6d035-2171-41e6-9458-6bf54a34c899", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788887804, "uuid": "87a0588d-35ec-40a4-b9b1-01b95cf004b3", "value": "49152:WxurMreHHztGyjwxm/pzVuSI5wy+PYN633OlSR9mTeQi+O3d82AUsa:WAnj+0sa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788887804, "uuid": "03b1b87a-b30e-47ae-9ea3-08050b5fc306", "value": 2284960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788887804, "uuid": "3ae3eafc-86a3-40c6-be5a-a527deaf2761", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788887804, "uuid": "f8fd2583-b4c1-4527-a8c0-c3f9a294e33c", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95bb7096-ab89-11f1-915e-42010a9c000a", "comment": "Malware payload (KhaiDiGrabber)", "timestamp": 1788874283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874283, "uuid": "ac1a5da4-768e-4d76-97d4-2f713876f3fc", "comment": "Malware payload (KhaiDiGrabber)", "value": "fe861c24d40347b837a7b57b56d3d4f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KhaiDiGrabber", "colour": "#AEBF74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874283, "uuid": "a32c3e5a-d03c-43aa-b9e5-9f697cce502b", "comment": "Malware payload (KhaiDiGrabber)", "value": "3b80c7da6b7f5198660524dfa5e0a7a9e9e1dd94dd351f98c334b06e4cf0fa94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KhaiDiGrabber", "colour": "#AEBF74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874283, "uuid": "b5b6b1a2-4ed1-4b6b-8903-f05788b17fa6", "comment": "Malware payload (KhaiDiGrabber)", "value": "bffabbb1dfc9b60f697157737a9c0398e9b2f90d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KhaiDiGrabber", "colour": "#AEBF74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874283, "uuid": "cf2304de-b03a-4237-815e-0ca3227c1c27", "comment": "Malware payload (KhaiDiGrabber)", "value": "37a2320b2d39896ba6e037c457e727ef6e701c39a39fad5e5a20c1e1f4afdd314a4b15f4adfb51738be5ebd430df6dff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KhaiDiGrabber", "colour": "#AEBF74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874283, "uuid": "2900490e-537c-4a32-b1c5-e5d0deef3163", "value": "T17D470186A2C64717DF92BD3EF1119253E562FCD6221146D35F8E0F2ADB0AAF0847DE18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874283, "uuid": "8e24986b-9674-4dec-82f3-fe9dc4d126a5", "value": "3f6555c2fd0de5690eb8f87ec1d726a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874283, "uuid": "35a161fb-01a6-4b7f-b1a5-17cf3ab864b1", "value": "393216:RVvOIcdcSG4F4N6DdvhN/i18EczA7nfoPDpwQSpQoV:RVvBcdclNJNfSpzAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788874283, "uuid": "d747f226-f005-4d19-9349-06bf9f8eb12c", "value": 24685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788874283, "uuid": "1f389860-8836-4701-bfd4-bf4df3613ccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874283, "uuid": "49efe380-edec-45da-8333-b1786f1008e2", "value": "3b80c7da6b7f5198660524dfa5e0a7a9e9e1dd94dd351f98c334b06e4cf0fa94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ddb0538-abd9-11f1-ab4f-4201ac107002", "comment": "Malware payload (SilentNet)", "timestamp": 1788908442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908442, "uuid": "5910c302-43f2-45fa-ade8-ba6bece70114", "comment": "Malware payload (SilentNet)", "value": "411b2c1202f7b1e51089b9fc186e6e22", "object_relation": "md5", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908442, "uuid": "ec58dc32-fc94-43ac-a76a-4f1ea965b103", "comment": "Malware payload (SilentNet)", "value": "3dcc6c98de31c5100a71f6ccc21597ca80ec40ddb11a21f3b924cde42816c622", "object_relation": "sha256", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908442, "uuid": "c5063d15-25f8-474a-91c4-3e92c530d35f", "comment": "Malware payload (SilentNet)", "value": "149da2f2d7b801380e6ab1f7c4d4df5478392688", "object_relation": "sha1", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908442, "uuid": "593142e4-0bc6-40cd-9e24-6b3842481955", "comment": "Malware payload (SilentNet)", "value": "03798786d8da734b88d1e61b5094ef2abf4f895cbbe995a5cea2f423ca42475f97ff96551ccb2dcac36682e6a4e61be4", "object_relation": "sha3-384", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908442, "uuid": "07071e18-35cc-4d11-b618-4bdeb5c68e69", "value": "T11BA4E0E79A4AEE9BD03F167945630FC1B5143381E806706F0E64E24B847B98F2735E9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908442, "uuid": "c716e0bb-24b1-4a19-8612-aeb397f5b6a5", "value": "12288:117nvGBmwspYR1Dcfk+aN/dt2khzFNtFHSY:r7neBmRpYRMk+alAsFNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788908442, "uuid": "5d00d565-83af-4211-91e6-78d402085e5f", "value": 454109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788908442, "uuid": "06f9e34e-d923-42f5-8dcc-1c9cb07ee4b0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908442, "uuid": "73787ccf-818c-4b4b-b8a2-38da8c072db1", "value": "meteor-gui-addon.com__Meteor-GUI-addon-2_2_0_mc1_21_10.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588a42b2-aba6-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788886636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886636, "uuid": "a853abd0-1296-4794-8478-0104eb4ab209", "comment": "Malware payload (Mirai)", "value": "30a67938cb8988cd2398ec58afaaa9f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886636, "uuid": "1d6744a7-8e1e-4fc0-b039-9a7928ae6cb0", "comment": "Malware payload (Mirai)", "value": "3e64858dced7a1eea58505529e3cd3183cd60697e160af45b8f44acb3469657a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886636, "uuid": "7ee60af5-6cfe-47c9-8fa7-caa648776cb2", "comment": "Malware payload (Mirai)", "value": "62652731ba7b1786db9e545164f401fb3c5153b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886636, "uuid": "66305484-62eb-4d5c-b896-46603451cbf8", "comment": "Malware payload (Mirai)", "value": "0b1f55886d728a72c5ca302ca465f2a05907b6d883d0fdfcb980ed2d0c48840bc641b8ce243edd87c3dd378b29cc632c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886636, "uuid": "8d5aac55-5ef9-49c2-8e66-a7cf62236a9a", "value": "T12504D80E3E21AF7DFB9DC33447B78B209684379626E0D2C5E15CEA055E7028E741EB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886636, "uuid": "8a0c9c78-abf7-4f45-8e18-49c052308b9e", "value": "3072:obUqrzFONbl94QFhr+FJZXyq/KAl3DHtXdg+QP6y5mt0iyENIs1BIbbgj:6SRHPL6rrvVD/iP6y5mtqMIsAMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788886636, "uuid": "6b4d1e26-4894-418d-8959-eafd353f3b8f", "value": 187285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788886636, "uuid": "4d4d0ee6-0915-45cf-8d71-fac93898cdcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886636, "uuid": "57dac405-f01d-42c5-a747-425e4f2e3d40", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfcc5f94-abd3-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788906163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906163, "uuid": "573edb78-04ff-4f09-914f-245e406b027c", "comment": "Malware payload", "value": "e7373db6a7862a132cd6775578dc13f4", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1337", "colour": "#8AC3DF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906163, "uuid": "028f805c-d31f-411c-9dff-077267af5a41", "comment": "Malware payload", "value": "3e7834229ec2359bd079dc08736aefe31c67a9a2a15e90016e371e1416c39d19", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1337", "colour": "#8AC3DF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906163, "uuid": "0be6f79e-e555-4205-a312-7097a695e4d1", "comment": "Malware payload", "value": "6cf93d6d90fee5df0cf1982a675f902444156c55", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1337", "colour": "#8AC3DF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906163, "uuid": "f1309a2e-6ee0-4bc2-9d2b-c978f341c82d", "comment": "Malware payload", "value": "d83ffd38969f28b7c41a2deae574345753d6683e136dbf013659579294b3864be9f75bfcc103ebc59da30711623b59cd", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1337", "colour": "#8AC3DF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788906163, "uuid": "0c30a405-0acd-41ef-b0e4-80d68d3cdd49", "value": "T11718334B1433F88A1437A37CCC65FDB9A2595952978ABCC93B503C201669D32B7C68BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788906163, "uuid": "16ad38d8-1485-4cb7-a524-a8a47814a00c", "value": "1572864:phIGkHiwiexFQYNbqUNKveU3j2lmXZuKQDWcMt3JHOhNRHgz:rIPCiQY1xFl4DcM1JHkdgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788906163, "uuid": "4945e59c-ef09-45f4-a520-4d7568734a5c", "value": 85056630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788906163, "uuid": "f2c57255-0ace-4619-872b-b89c7e14acdb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788906163, "uuid": "07b74f76-d61f-4824-92cf-22a1d649c937", "value": "Simple Cheats Client.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e174287-aba2-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788884981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884981, "uuid": "a17b9620-5973-4473-a93e-80d2c0e1f350", "comment": "Malware payload", "value": "159199d5c718a48c71be5813a1696eda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884981, "uuid": "54005b68-dffd-4ecb-b067-56dbb9e5e5f9", "comment": "Malware payload", "value": "3ee0c2308832ad543df4d64cdaf834bc27a09750e662cc889e56e203eaa50f92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884981, "uuid": "d111baa8-cf84-49fa-97b5-ef5c95147fb6", "comment": "Malware payload", "value": "c34a2f4ff1bfd2165ac5485dc964af7fc181b39f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884981, "uuid": "32f8048f-ee3b-4e81-b801-96c1a1f24ff7", "comment": "Malware payload", "value": "d4cc72de21741f4a834a8d822930adfd256b074d3bf7572aa8fb32e029979b786d8ecf2558c86f8ce643824849a91ba2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884981, "uuid": "613ad547-e036-4adc-863a-8bc04f0329b9", "value": "T1F9F733C2B67B404EE510947F531456BFF20ECB31C64E7C5795FFD6AAB214A102628A8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884981, "uuid": "300c7926-2b53-401e-8356-b67a0d7e887f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884981, "uuid": "bb260329-8389-46a4-b3ac-aa316571d4ce", "value": "1572864:lejOYf6gLntt1+mbzEJE7jc1eaGTvXLy5YeG8+OqdYOY7:l4CK/1jAJ4YwdXm5Yj8+vdJY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788884981, "uuid": "caa02ecd-4916-4e5d-9b42-02b341012b7e", "value": 72251347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788884981, "uuid": "5b9f3664-1686-4fe1-b74d-180d366e5e38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884981, "uuid": "9f410c17-4c2d-45b2-8408-9cc9bfa98ebb", "value": "Setup_app.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6762074-ab23-11f1-915e-42010a9c000a", "comment": "Malware payload (XWorm)", "timestamp": 1788830610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830610, "uuid": "afb05a6b-4688-499f-8f90-a9499641a04e", "comment": "Malware payload (XWorm)", "value": "6f6cb5fd8c5696bb42cec451906324ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830610, "uuid": "09ce4f0b-14c7-4dfd-9cd3-861fcce7a883", "comment": "Malware payload (XWorm)", "value": "3f980de6bd0581609105f594ba932e5e54a9eb1afac81d7543a3a4da8aac9a6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830610, "uuid": "39944ebc-8d77-4aa6-a351-26d4d6129261", "comment": "Malware payload (XWorm)", "value": "90c8155599407305a6bf1105a80232b89400a212", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830610, "uuid": "1365192a-e474-4b63-9bc8-7bda37d5d37d", "comment": "Malware payload (XWorm)", "value": "4245e903b5bfc8b13e4c697e247b88fd9880b436958c8182628779a0587329c46332988f46f5c8bf9b0003fd3e624d44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830610, "uuid": "f8e3d80d-09a9-43fa-8315-5c38fa9582e7", "value": "T17B034C45BBE44626D5FE6BF42A72AA060770E613EE23DB4E1CD845DB2B276C0CD007D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830610, "uuid": "e8b86081-68ee-4d02-8611-13451653cc96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830610, "uuid": "d0f82bb7-60ee-4c23-ad16-9d438469a67d", "value": "768:W2hAZblrKkmlkbFcKJt8YlkBwoVd7NCxF5Pq9j/A67OMhb33x:Wv1lrfxcbs/MNAFc9zA67OMFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788830610, "uuid": "c49352eb-c0bb-4d79-89ff-2708f97331f1", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788830610, "uuid": "b428dffd-7d83-42de-a9e3-3e6b10e6b551", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830610, "uuid": "d949b0f7-9b38-42ac-a9ed-6787957a69b6", "value": "3f980de6bd0581609105f594ba932e5e54a9eb1afac81d7543a3a4da8aac9a6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9aced9-ab5d-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855429, "uuid": "c0d35546-ffce-486b-bc38-c9e221c3a28f", "comment": "Malware payload (SilentNet)", "value": "6784da088072e382e958a8f5084fcfc3", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855429, "uuid": "79d5288d-038a-44df-9dc7-680a2b538409", "comment": "Malware payload (SilentNet)", "value": "4018af387ce8303ea128122bb80f06454d682bf73ded510dc36fbf16dcffe18d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855429, "uuid": "fd0d9927-815b-4e20-bc4e-22a253434d88", "comment": "Malware payload (SilentNet)", "value": "eabc95d6476c94e91719cd101b1598ece8902c03", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855429, "uuid": "ffcec2b2-325f-4253-b321-1256a734b328", "comment": "Malware payload (SilentNet)", "value": "5901ccc9a415a750e95e7a44adf468cfd4155d8af412a1d85f21fed767527d64659138d997417d35e97ccf3f44245a3e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855429, "uuid": "6ae16fd7-5431-4e14-b4b4-e5adef1ef601", "value": "T1BBF533E0286B0F7AD561F139E6520D51AF9E03C9C855729BC6C32FDB358998B0F3D286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855429, "uuid": "7d84a148-3590-4251-8ea8-feb2233614ea", "value": "98304:deKKjFtGTJHrhGFPzOXv1aQswZuonRVQjT4UiS2x:3K5A9r6PzOXdQwZfR6sUin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855429, "uuid": "fe5de873-6b37-4f2c-afce-1357935d170f", "value": 3567254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855429, "uuid": "f70fafd9-cbc8-4496-b6d8-c5a7bd39c98e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855429, "uuid": "a77fb737-e372-4bbf-9250-ad6882beb3b8", "value": "fastclient.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7376b90a-ab5e-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855757, "uuid": "6e3d8cee-f8e7-402a-a302-e9d01ee85785", "comment": "Malware payload (SilentNet)", "value": "14532f9be82835d21191a442b2905f46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855757, "uuid": "262ef4b0-2d12-44c8-87a6-c5531adadda3", "comment": "Malware payload (SilentNet)", "value": "443863fe8aa8b41124569d0b6fbe6ac4c39049652a7ea70bcf82198d64927737", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855757, "uuid": "b7fa584c-7123-4ee3-81fe-b599a80970b3", "comment": "Malware payload (SilentNet)", "value": "84e49a3f8159268207878ee896bbccca754d16bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855757, "uuid": "cd410eea-f48e-4748-8efe-58c67e85e6b4", "comment": "Malware payload (SilentNet)", "value": "fea662b13ed5dd5e6c5604e73453cfa07db7024807bbc60d0e2db8c20b48d74cbfa488e37b7ead6b55fe531c789c941f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855757, "uuid": "36a50f16-1c1e-4384-9977-ba49814999d4", "value": "T185A42387D2A2155CD2DCC0762563DAA5E0297129135A91F70F8973AEFE3EDD8023F4B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855757, "uuid": "a74fb777-5bb5-4bd8-8d4c-cc8897a8f5d3", "value": "e6c6166959e9db1494bb9a620affb282", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855757, "uuid": "b5b3a5cd-d439-4023-9a5e-5e9d06f0132a", "value": "12288:olZgf4pl7u6knOt5+124vnZeCfZpD7POhbJLVm76BN:oHggCpAo11nZee9bOhbtVs6BN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855757, "uuid": "0016854f-1301-404f-837b-7d39722c3199", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855757, "uuid": "aa9f4d37-8b89-4687-be3e-ae128f5d2080", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855757, "uuid": "bf1bbddc-bbf3-455f-a35b-a4fcbb63d7ec", "value": "OverwackLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65479e83-ab9b-11f1-ab4f-4201ac107002", "comment": "Malware payload (CoinMiner)", "timestamp": 1788881933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788881933, "uuid": "3aa07e4c-f3e2-4bbf-99aa-b46e81db3dbe", "comment": "Malware payload (CoinMiner)", "value": "0cfcec18fb50d45746ac6c1f61ff7042", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788881933, "uuid": "b81cead6-56b3-40ce-a4a1-9381a0791514", "comment": "Malware payload (CoinMiner)", "value": "44593e8065a0f6c19d3a8fe2c49f13d1d202c2f78cf8a6157e01ca6d15164298", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788881933, "uuid": "a5163b22-5b9d-4d1f-bb9d-ae96d8a7acff", "comment": "Malware payload (CoinMiner)", "value": "0e2b3dbb34bed7582f07c6d0431d1c8bdef90086", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788881933, "uuid": "651f49c4-5b0d-43f2-9fe2-54213b42e610", "comment": "Malware payload (CoinMiner)", "value": "c30af8a2a35500d5a21cdb7bcaaf963936a625b7f43cd9749ecb5dc1124c6584972d99ba32fc95393c8d0bfe96ddc773", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788881933, "uuid": "1e2bc900-1747-4abb-9dd3-c063bb4911b8", "value": "T16D3633A7A8C71138E486C374D642B4ED71B6BB901E71BC0E36CFAD15CD96A58243E3C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788881933, "uuid": "4929050e-5f34-4d60-b183-e50d194be2db", "value": "949ec789a5933fb6051c9013a550fb57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788881933, "uuid": "1aa28fe2-f5c5-42cf-8651-5c13d045646b", "value": "98304:9IrqiABifc5YZl+3iEw5pQD9juGeHG5Y49OKWeFIespWFLPtuI:6rqZGc63+3Pwcf52dKfFpQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788881933, "uuid": "a45c374b-3f2e-4339-8753-c1885bfbed8d", "value": 5231616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788881933, "uuid": "efe02c94-dd50-4140-9c85-a6622e03be83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788881933, "uuid": "daa9837d-5390-4eab-a172-041cf1063723", "value": "44593e8065a0f6c19d3a8fe2c49f13d1d202c2f78cf8a6157e01ca6d15164298.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b608712-ab59-11f1-915e-42010a9c000a", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1788853543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853543, "uuid": "9fd069b2-b26a-4648-bcb6-8976bd48c852", "comment": "Malware payload (PureLogsStealer)", "value": "850fb35e2ca5fde86ba19efc6e44a491", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853543, "uuid": "50362f53-79e3-41d7-b817-e90d2cc1220e", "comment": "Malware payload (PureLogsStealer)", "value": "459d18252cac848ceb07cb4f509251b3b23c6fcdf12c4c95261a7f28e6b85517", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853543, "uuid": "676cf06b-9b1b-401e-9c64-fbaddb9ac913", "comment": "Malware payload (PureLogsStealer)", "value": "97777a04a2e0a2c7be3835aa818d9dbb5fc376ab", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853543, "uuid": "d46edf6b-ba0a-41e0-b79f-68eeb2349013", "comment": "Malware payload (PureLogsStealer)", "value": "33413046b1bd749a9832c1f568472594315159117e790cbc2743d89f6308c3fa3d3c836fcb60b793da3bb68c23681ff4", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853543, "uuid": "88f96a1e-b705-452c-bb44-f2b1fd2fd518", "value": "T1B905137782FD2E6EC4275558CE7A3C0C9CF054A20B4EF47AED3B64C5D87CBAA66A0150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853543, "uuid": "9321bfcf-c61a-4b81-985c-9891d8961cd8", "value": "192:z2ettbCcqRX6E1pHa8a2WwyoI3bLzvTnppwzEtBRBE7mgbz1Hjax+WmBg1gIEKwb:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788853543, "uuid": "aa53bb08-e431-496a-a469-5efe7149cad3", "value": 813728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788853543, "uuid": "1f3df167-7d24-4039-99ea-485437427f8c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853543, "uuid": "3a33741a-e205-46fe-a889-5812b20cd036", "value": "Signed POs for 500kg and 100kg Shipments.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17316db-abb8-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788894623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788894623, "uuid": "7d1b1498-0951-42e6-941c-56bafd0c2c91", "comment": "Malware payload (Mirai)", "value": "6e992a213a522075b1ff21b5e0bdf095", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788894623, "uuid": "11b8e90c-fa5f-49c6-8e85-edfd9338e57e", "comment": "Malware payload (Mirai)", "value": "4610b030d76dab5575dc7497d9017f44c05ae2c9480882f6fee3ae55c4a28fb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788894623, "uuid": "752bb658-61ce-42d3-8e57-355c405fa310", "comment": "Malware payload (Mirai)", "value": "1f59bd8ebe841c27d318096e3de612a0f0fc0c59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788894623, "uuid": "e4863e26-d0b4-4309-8a0d-b0257df0b88b", "comment": "Malware payload (Mirai)", "value": "a462d7ec22f988cdda4e33ba73bc3eea2f457cbfe16d5d1299caec95aa10cb9541783aa26b99dd7bd3fd79c10077bf32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788894623, "uuid": "472d1c51-0701-4e43-8f75-b6d590d2378b", "value": "T1A2C31745BC81AB15D4D626BEFF0E528A33231B7CE3EE7212D9249B34278A95B0F77501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788894623, "uuid": "e44b8b2f-2963-48f8-9508-c1fc8ae56881", "value": "3072:nl9/1TL46LKyZMal5dMuznp3YVOmFmf1YMr5ySMqg5j:D1Q9gMalfMuznp3YsmC11ESMqg5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788894623, "uuid": "263a2802-47cd-4b0a-b842-dd16c769fe50", "value": 119440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788894623, "uuid": "ed0ba82a-f4bb-48c0-a266-2b2cfa33aba5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788894623, "uuid": "d13ddf0b-47c0-4ea6-a9e9-8f355c27fa63", "value": "705a7fb8baae3f0aabe0145461e774b139db35bcc94b99d9378fa31d787f2e3f.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f43488d-ab8b-11f1-915e-42010a9c000a", "comment": "Malware payload (QuasarRAT)", "timestamp": 1788874997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874997, "uuid": "8126f754-9d02-40dd-a062-7489ae23ff80", "comment": "Malware payload (QuasarRAT)", "value": "c6fa433638c26773708cb30d81b98aef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RedDelphin", "colour": "#A5D251", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874997, "uuid": "e473f9ed-4560-417f-b792-483872df01f1", "comment": "Malware payload (QuasarRAT)", "value": "46bdc54ed6ca8f9200d5445880c687d0e3730ec8adb9b5d57f420b951aa2be68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RedDelphin", "colour": "#A5D251", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874997, "uuid": "ae996b36-fda2-4021-829f-2e4d7638c555", "comment": "Malware payload (QuasarRAT)", "value": "1f45ca0c3e317b7483c031f95806d407a80faabb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RedDelphin", "colour": "#A5D251", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874997, "uuid": "729b7448-46d1-474d-b047-b50d50a97b36", "comment": "Malware payload (QuasarRAT)", "value": "1a21b98dd916147972e0256de21f92f446a74cc749857e9c9d21a033c2983791f718126d796fe6d20729be80e6b52845", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RedDelphin", "colour": "#A5D251", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874997, "uuid": "e0af98f3-a6d4-4ba9-91f6-a546a33d2694", "value": "T1E26633194BD11D98EB7301399CB87041CAE5B662FD43DFEC4746220E48AABCF5A2B375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874997, "uuid": "0637f374-85ed-4a1d-b653-835194980d6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874997, "uuid": "e492075c-8eac-4e4b-8fa1-dc5fde5b023f", "value": "196608:usSbk9fcCkbVN8iNIS8TkSIviB6tQJmUci4gFx:us2CkbXWkS0tQGiTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788874997, "uuid": "d75d50ce-be4a-4ce8-9afc-df718e341f68", "value": 6574592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788874997, "uuid": "1bc66e5d-bd78-4588-a006-cc1eea0acd01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874997, "uuid": "c65ba2b6-e597-4384-8c89-158f04a5416d", "value": "46bdc54ed6ca8f9200d5445880c687d0e3730ec8adb9b5d57f420b951aa2be68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ed9c75-ab58-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788853376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853376, "uuid": "b018b751-c502-46a1-8183-c19babdac2ff", "comment": "Malware payload", "value": "03bfe86efe6099a28a6c823f8fc2ddab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853376, "uuid": "9aa22f25-def4-4b89-8f3a-d6c7b95519be", "comment": "Malware payload", "value": "46d971c67b100586766b5384bfa4025dfecff8b7c2abf172180895007728d46d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853376, "uuid": "1a8fbe92-1067-422e-a803-2f472db25f3b", "comment": "Malware payload", "value": "08a88554d1d8398a03757784be4342a2fbb1ffe0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853376, "uuid": "8181a400-21a6-44a5-acfa-a1d49b7aa1b2", "comment": "Malware payload", "value": "0ccb4c7d901a53562394475daf554b1a123d9f116d40d6545793450bda6cfec421095d9da748110757b1bf9093197271", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853376, "uuid": "6c545fb1-29d4-46ea-8db9-4ba66679d339", "value": "T159F54A07FCA519E5C1AAA2318966A152BB717C482F3123D73F50B7B82F72BD06DB9710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853376, "uuid": "226f2ce2-a7a4-453c-933f-efe4faf03553", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853376, "uuid": "6964a82a-da9d-433b-a6df-d759f3045795", "value": "24576:ltn63fpVjCUZf3NEb0hXxmCZ9mxALL8vynrcS+csboKVWXP2eleyE9Dl7c2ctO4H:lJ6PptCK3NpjmCPmxEYvyrmH9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788853376, "uuid": "7a10fb4e-3b03-4f05-8c2c-39a0e2382a5e", "value": 3372032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788853376, "uuid": "cd15e784-99db-4b50-bf92-77ba340bdcb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853376, "uuid": "4a853e44-9776-46fc-a386-2d8c39424a15", "value": "03bfe86efe6099a28a6c823f8fc2ddab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e121f795-abca-11f1-ab4f-4201ac107002", "comment": "Malware payload (ConnectWise)", "timestamp": 1788902327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902327, "uuid": "f170b3a5-2867-44c3-8d17-52b5ee47062e", "comment": "Malware payload (ConnectWise)", "value": "d4e034ea1611529957c22092a8a5d2d9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902327, "uuid": "fad3623a-46c7-4d6d-b046-e329926929c4", "comment": "Malware payload (ConnectWise)", "value": "474187ebbc6b0dce7ea694222581f40e23971023158fb74e8404e04180254e11", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902327, "uuid": "1beccbab-4b95-4403-97e1-9f723c7f844d", "comment": "Malware payload (ConnectWise)", "value": "e1b712547c0cb095e5ffc4aebe2f5ebd702e3dd9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902327, "uuid": "a3f4c456-9944-4cba-9684-ccb21249f8df", "comment": "Malware payload (ConnectWise)", "value": "535ec7a3f11de0e7bf0b73e837b5e22ea9b1d1753b9b587eeb521c12690af463dab3c467291d3b1b845636841e07f4ea", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902327, "uuid": "00b5749a-10ad-4bea-96c5-3e09de8aeec3", "value": "T1EDD61211B3E691B5E0BF0638D87A62666631BC128751C7AF6794BE792D327C08E31373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902327, "uuid": "de1f0b35-6051-4496-a94f-1d72ee8bf3c7", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902327, "uuid": "2bda997a-c013-4bf1-b5ea-07b47e94acdd", "value": "98304:C3GF0s6efPzMn1Giy8E1PqhyG6ztZNK9aNGrMn1Giy8E1PqhAMn1Giy8E1Pqh1Ms:kGufefPyZWiEz3I96bZWijZWi0ZWiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788902327, "uuid": "54b2f66e-0e60-47de-b829-06e16ee3680c", "value": 12828216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788902327, "uuid": "35682a78-2214-48b2-8e0f-e4557b2d9434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902327, "uuid": "18e575ae-89da-48ea-9c7e-c2f7b49fd2f7", "value": "474187ebbc6b0dce7ea694222581f40e23971023158fb74e8404e04180254e11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63961006-ab5e-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855731, "uuid": "3cd69563-8e05-4eb5-91bb-0fa6d9bdd5ce", "comment": "Malware payload (SilentNet)", "value": "3f8e305d60b90f5b2ba5534ba345da38", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855731, "uuid": "812fbf55-ba61-4f29-8c7c-890aa872249e", "comment": "Malware payload (SilentNet)", "value": "4826a0542af3e1bd6706e2472a7d511716a013d997ed613e0c7e4f49fe7dded0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855731, "uuid": "06eaf836-c643-49c1-a431-664b802d3107", "comment": "Malware payload (SilentNet)", "value": "2d472ba0114ffeb3aa06617c2ff11934089c7283", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855731, "uuid": "de66cde2-fbec-4763-822f-a8477c4e49e7", "comment": "Malware payload (SilentNet)", "value": "2b7e27694c0d5ab671c536c5b4e2c98658d5de055e0fcd4cb2064a147e573815c21711d172b00c1463b80b1646d3bb74", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855731, "uuid": "cd80ab43-a6dd-4617-9f4a-96cc5c776c58", "value": "T17075339E0D6A66CBD3571DE250290CE8B1FED12A6E6B8A3A907443DDC338CDD05C35B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855731, "uuid": "689298c5-caf6-40ed-822c-5c9bf5d0d808", "value": "24576:8hbvJCHSE5ZvJxPJtBDtryX8W0XC9ZyAgyXgf89yDP+4BHWhQgMfbxNy0PDl:IhEPJxJt3yMTC9gASPVJUD0bx40rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855731, "uuid": "5526bc87-3f65-4c26-9fea-6ea62069ddcf", "value": 1582561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855731, "uuid": "aa422c64-fae1-4ed2-9d84-b7f2c81fc6da", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855731, "uuid": "2d140a37-033e-488b-b46e-ca316c6782f5", "value": "Flot.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23234aa0-ab98-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788880533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788880533, "uuid": "61482009-b89f-4865-8423-d4d19a26fb84", "comment": "Malware payload (Mirai)", "value": "cdc637c982ceabf71269c6b34ab2baef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788880533, "uuid": "63feb517-e59e-414d-bf3c-0c36b3a4e568", "comment": "Malware payload (Mirai)", "value": "482b132bcb8ead87a7f13c3441d76a1a14cfc27c64ff85783bb0ccb4c7e5a9dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788880533, "uuid": "47a06440-a4b9-4c85-86c4-2dc1a5af67d5", "comment": "Malware payload (Mirai)", "value": "4511e4d6964a48e0b837121c03b1aab5ff681bd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788880533, "uuid": "33dcd89e-2bcf-4ce2-b902-996c3ac1179c", "comment": "Malware payload (Mirai)", "value": "4838f01806b77bba0355545d07be91980554ad7a2d2baee0ea5092f0050e68e55941af38bc7039c8bcea98c55a0462cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788880533, "uuid": "212813ef-418e-4446-967c-133e91778b1f", "value": "T10F23184AFD805F00D9E525BAFE1E424933934B7CE3FE7111AE219B2523D6A2B0F76911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788880533, "uuid": "916f20be-34c3-420d-961f-b4eb5f62e838", "value": "1536:plngqambuDyyyyyyyyoPoF/pym1hiC2lHMiLcpWpfS:7aga/pym1qZcpWpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788880533, "uuid": "4c07a474-5c0d-4ec4-b98a-66a6ed3d7751", "value": 49564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788880533, "uuid": "24e525a0-3255-40e5-b2ce-5dd8bda7b583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788880533, "uuid": "506cbebf-6991-44c7-86dc-b3abfc742aed", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd684c4-aba0-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemusStealer)", "timestamp": 1788883930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883930, "uuid": "f3c97453-cef5-4415-9554-37a0d7641b6a", "comment": "Malware payload (RemusStealer)", "value": "114017d961260d5e8b019bea325dd276", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883930, "uuid": "0aa639f1-0cf6-4c14-84bc-e995776d77f4", "comment": "Malware payload (RemusStealer)", "value": "483ad5006dff93965227094ad8547f8128313c8c4695b9453145e6978fa863d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883930, "uuid": "abc5b18b-b5cc-40aa-bd51-8c08707c556b", "comment": "Malware payload (RemusStealer)", "value": "53d8743214bcae8decaf409f8089d13d4415e278", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883930, "uuid": "242b2713-045c-47da-97ba-05f50d26de37", "comment": "Malware payload (RemusStealer)", "value": "c782f7d3b57a4a18c8887d2d7bdb6582457c53d5cdcf70a1fb5d5cf13b70342b92f0da51a11e39ab0f9dc02520c75121", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883930, "uuid": "f5e6e15a-1334-4c56-87aa-b06b8bfdcc43", "value": "T1C0751252BEC045EAC33A0630C4F290429AF1FBC4DB65F3DB21DED56A5AA20D153EDB46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883930, "uuid": "6c10bf2c-493b-431d-9141-53590947be3b", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883930, "uuid": "7cc8e376-3e40-45c1-bc04-4fe41de524a0", "value": "49152:YOub3YX0wGxsoJXAqmxbTNmesiRtqANC:Ylb3YXHoBybTNmevqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788883930, "uuid": "cf540875-306f-4f41-81eb-364d9dad37e4", "value": 1699840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788883930, "uuid": "347b434a-e7c1-4eec-8d9a-547ce42074dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883930, "uuid": "419fdf55-f8f7-4203-901f-c22304a12347", "value": "Helper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5634612-aba8-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788887704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887704, "uuid": "75221430-c1d7-44f1-b60d-c5e42a098ff3", "comment": "Malware payload (Mirai)", "value": "68850b695d12651b25e9c64578d34b8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887704, "uuid": "5c9bc443-f6cf-4692-beb0-c5eb6ad206fc", "comment": "Malware payload (Mirai)", "value": "49be8673c9b97042288974db65266e3a55f0823d4f2e2b2537940cf889249267", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887704, "uuid": "e5ac957e-fdb4-4f29-8bd1-694b2b23b032", "comment": "Malware payload (Mirai)", "value": "4be50e05c387b90747ad02f9a0b7099ed5af4e7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887704, "uuid": "de9c36d3-cf3c-46fb-8248-c4a0f439185c", "comment": "Malware payload (Mirai)", "value": "f1b3778cf699077895a1aece12696b8d1a2a139cf7c1eb74535588c3f74934719985502efc3abc39786043b1036ecab0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788887704, "uuid": "f409dd8e-b5f9-4635-8961-5b2963b7bd27", "value": "T14CD3BEC7F74B25A0C82306F44BCB8BDE2A9731119F4BD9E6AD1E663F19B51DB0906381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788887704, "uuid": "65788e1b-51b4-4003-ac3f-3a69e6b181a0", "value": "3072:/3f3LZNP07OiJfmB5Zy0XEX5OnPElg0q:X3LZNPuU5jWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788887704, "uuid": "78ad7d4c-f37d-4748-bb9b-1f94de7654d6", "value": 132640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788887704, "uuid": "15cefc8f-9f48-4f93-8253-bcfec6eccd59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788887704, "uuid": "e729d325-632e-4c7a-8dce-e4e02ce224cd", "value": "49be8673c9b97042288974db65266e3a55f0823d4f2e2b2537940cf889249267.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c365182-ab39-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788839800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839800, "uuid": "a5207ebb-be0f-44c1-8372-c729de00f839", "comment": "Malware payload (Mirai)", "value": "ed0c29c9fd62885f8b867f52711ef7f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839800, "uuid": "efb9c47a-bed4-438e-b052-0ff3c0669b41", "comment": "Malware payload (Mirai)", "value": "4ad8732fffcf1ea9625a77ce3e0da3601f383095ad09551f2b6008c35e7d0dec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839800, "uuid": "ae628865-a32a-45dd-a0f5-db98a3b3b0d5", "comment": "Malware payload (Mirai)", "value": "6e2b64224defd33922d55ecef8befed0114945a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839800, "uuid": "bc60bd69-5120-42e5-b60d-4f195e60028b", "comment": "Malware payload (Mirai)", "value": "1e1dbd628793a05a49ecd834ba7950e241170da5e2b37a9599963953a137826c6bb62b9bef77b96c84e18b1b03044630", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839800, "uuid": "6090b57c-12ee-4dee-b1ab-cc9477ede569", "value": "T1C0C31272007735016CE546C0E2B68882F5D089BABFDA3C7F760ABA9376266C4DC75D17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839800, "uuid": "30cb40f4-c21b-489c-9ce2-99f6ff8a8855", "value": "1536:ch5DY0Sd3O3qQj0ksR959SuzsSC1PRFS6Xv6osJlc3DwNTVyIPuNUct87aDq0tvU:MVSY6Y09j93MK6Sp4uoImWd7a+0tn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788839800, "uuid": "5eb2aa81-3d98-4fe0-9430-36c8e6e6f8ef", "value": 118856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788839800, "uuid": "78ffb17d-6bb1-473a-b228-311d69a7befc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839800, "uuid": "2be73b43-5701-4e4d-8c5b-658d5c9cb3fb", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c1cd33-ab8b-11f1-915e-42010a9c000a", "comment": "Malware payload (LiveMicRAT)", "timestamp": 1788875005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788875005, "uuid": "8b2b27ff-3442-452e-9d94-b56ac04ab6cb", "comment": "Malware payload (LiveMicRAT)", "value": "50b486503a7d7a841f60cbaf332565c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LiveMicRAT", "colour": "#FF8234", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788875005, "uuid": "aa8e96f1-9d37-434f-b2fe-12de76412ba8", "comment": "Malware payload (LiveMicRAT)", "value": "4bca90b8e1a515ed06eafc926d845c0af49caa7ef82e94d92f73607fd38a01ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LiveMicRAT", "colour": "#FF8234", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788875005, "uuid": "a04454c9-f7ff-46c1-b114-2e0adc29745f", "comment": "Malware payload (LiveMicRAT)", "value": "e0d3ae83a9d9f161a45e9f92568b34b96276b27d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LiveMicRAT", "colour": "#FF8234", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788875005, "uuid": "ca68752a-cde9-4b5a-87cf-5b7be9314e06", "comment": "Malware payload (LiveMicRAT)", "value": "a585766c95bff428d43ceef0c08337d967c3d54613738178a32fda9da37895c0e314894320ed7e15b8fff0843436c250", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LiveMicRAT", "colour": "#FF8234", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788875005, "uuid": "ec436dfd-228a-46b8-b73c-46db55c0d479", "value": "T118352A57E36385ECC52BC078476397B2BA70B45942387E2E1A94D7312F32E905F6EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788875005, "uuid": "1681194f-98f3-4309-90b3-9fd934939794", "value": "f642e3d1da22be91a6b1b78ffb897150", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788875005, "uuid": "e16c0fc4-f650-4941-859c-0d325f21f3fb", "value": "24576:YHLNsfemHw4Yoy66+79ZBgLwtH97qSqhbG+XqlZt:YrNsfrHyslFH97qSqhwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788875005, "uuid": "6bbc6d4d-1a70-426f-bc6b-373931fb1547", "value": 1143296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788875005, "uuid": "50744257-d98e-4a1c-bde6-43f477e43d2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788875005, "uuid": "3001d07b-ad7b-47c0-ae42-7dd226dbea68", "value": "4bca90b8e1a515ed06eafc926d845c0af49caa7ef82e94d92f73607fd38a01ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7901cc9e-abc4-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788899575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788899575, "uuid": "903e919f-f783-44f8-ad48-617320f4f276", "comment": "Malware payload (Mirai)", "value": "436138c2c9bfff63623d7107e08840b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788899575, "uuid": "f1388419-b885-474e-9bd3-1f536ce7ef5d", "comment": "Malware payload (Mirai)", "value": "4bccec3aec8dbdda25d35e893921a5f5fcf02ed2145e0c34841a529654621919", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788899575, "uuid": "3f6d584f-73c0-4a54-bb31-38d1650dfd94", "comment": "Malware payload (Mirai)", "value": "05d63029519ee08906520704f363f4022e0165b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788899575, "uuid": "032bcd97-b863-4dc2-9c66-e020f44be804", "comment": "Malware payload (Mirai)", "value": "47ef60fe838386a63f91697aabefed5b09a33d6af9ce9d85524578037bb7c365dd92b47b5025f9808b03b867a62770b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788899575, "uuid": "3e9c11bd-5c83-4bc7-b2f7-e231c90b99e3", "value": "T16244184AFC41CA61F98106B5FB5E82D83B2303FBC7FE75019C064BB42BA751A4A77952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788899575, "uuid": "2b9553ed-07df-4350-ac92-470df741db6f", "value": "6144:XQbNkgJTxfkxsuvTs5PLpmw/uiQwxc6cW8NkyhTQOmw/Uqe:X0NkyxfkxsuvTsnmw+wxl8NkyhTQOF/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788899575, "uuid": "0eb0531f-d14d-4b74-b15f-0039519326fe", "value": 267976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788899575, "uuid": "e2f56477-733d-4091-a428-50a90b3eab77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788899575, "uuid": "8b850125-6ad8-4df9-8c05-66ee69ad2289", "value": "titan.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d202c120-ab5b-11f1-915e-42010a9c000a", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788854627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788854627, "uuid": "c306a3f9-0e89-4d9e-b817-d4a38f5066dc", "comment": "Malware payload (RemcosRAT)", "value": "f97f392261c3359dfd7d2befac571746", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788854627, "uuid": "b29fa80d-be08-4757-9144-58c024a1597b", "comment": "Malware payload (RemcosRAT)", "value": "4c2dbbe1d22ee66b3135939a0da598e8555c57c5442321b67cb27ad04df3b679", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788854627, "uuid": "b189898e-4ffb-4623-9c79-22aabfa93de1", "comment": "Malware payload (RemcosRAT)", "value": "7ac161243106c7599d62cff42f50c006ceb563b8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788854627, "uuid": "95678afc-ef24-4fe4-b493-07e41b72dcee", "comment": "Malware payload (RemcosRAT)", "value": "b18ca26cfdf03f329ffeaab8f4dd08797e1377f2a9a0fedfa0897fc9ce08283c661c06fdaa770a8341c8fdfb495f7853", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788854627, "uuid": "72fb88dc-864e-43c5-990b-cad63410cfff", "value": "T17836E7A3BBCA9547B90C7357E84E6A964F6A8830568776F570DF0AC0430B58A3CD0E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788854627, "uuid": "4b9f852e-56c2-4b7c-86c4-7e959a3185cf", "value": "24576:qi/oGMf7KYzXXq4E6tLt0e+dkpBySRy2JIe2gn//BXsyxDErylNmu9tas9B/7ENE:gzrz5EZYnlas9OWXG8hQ9AOY1Sk33p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788854627, "uuid": "89dd1244-35f3-4e33-a2a7-b2780ef209a1", "value": 5285241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788854627, "uuid": "3b8995e8-a1e6-4bf7-ae63-21d536d24477", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788854627, "uuid": "dc5054f4-8764-44b3-b3c8-5d790e0f2be3", "value": "Emirates NBD Bank Confirmation Copy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79481765-ab72-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788864357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864357, "uuid": "1fb0acda-9b7f-4f64-ab6b-8dfeba950de0", "comment": "Malware payload (Mirai)", "value": "97b9d7d2962f1b94a0a5dccb4b37b969", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864357, "uuid": "3f2f57d3-a8a4-4e38-ae0c-e859695b4a9e", "comment": "Malware payload (Mirai)", "value": "4cd58e3e5f8517759dde5bfa06fc4a2578d8b182f74d8648134d71d2c8f12ab6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864357, "uuid": "28f891a9-820f-4ff6-be5f-667384ae3262", "comment": "Malware payload (Mirai)", "value": "5d46877f245c2b141485ee1a59e63d2ab6646311", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864357, "uuid": "202b9f30-01d4-4f88-be07-0b5cb0ff8a1a", "comment": "Malware payload (Mirai)", "value": "17f4056a00c86097897f4e3adeb64f3dfa8b06395c23b2a81620f09723dedf1af9ee5b67d7ffb2393d54fe3abdf4a971", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864357, "uuid": "820a91f8-858f-4be9-8d2a-5cff9717437c", "value": "T159B2DF3C2B111B98DA1EC0BD839C0B503DB82F2595829D4B6206BDD7AF968B47453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864357, "uuid": "52ba618b-d68a-44f6-a98f-72cdf1cf939c", "value": "384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiLmdzJgGlzDpH7uNj1JA4r:neD8ZSWvZHZbs1row697qohQvg9LizJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788864357, "uuid": "8ccc6a99-dd8e-4c4b-bd36-65e01a77ed01", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788864357, "uuid": "99a9d1ba-9755-4e21-a94b-b0932128d822", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864357, "uuid": "9f82dc04-553f-4e20-bf3b-77c928271150", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "212311d5-abd1-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788905011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788905011, "uuid": "ebd3ada7-2956-4e91-ac8b-9deecef9c453", "comment": "Malware payload (Mirai)", "value": "4c88c0062570a85faa4c70ece51a5afa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788905011, "uuid": "56ff2f27-07ae-4c44-a90d-e2b73b3f9df6", "comment": "Malware payload (Mirai)", "value": "4d79178fa6d7f0627caef122e3c29a0a95a0802ba5a050041660f4d6e11adbfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788905011, "uuid": "f5548e0c-13ab-4fcd-b0e1-2d59e3d42048", "comment": "Malware payload (Mirai)", "value": "a48c734178ef1ba024e8bf2607615d08c09a1aa0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788905011, "uuid": "c86e9e3d-1e9c-4b2d-aada-48bbc0ce5488", "comment": "Malware payload (Mirai)", "value": "1efbe1efb21a6c4d5920db1ed170c9a317a17f70f88f633bab64bc22d539b24a89a3fd60d1351a9b36c77341487feb37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788905011, "uuid": "ebe9be23-5aca-43b0-9e19-918992a0e662", "value": "T1E9447C0AF802BE3DF8820A36C16F0AA53F7452E36B761E59D112A5F25F33165589BD32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788905011, "uuid": "94e28599-9bed-4ba5-897c-ba23254ffb5d", "value": "6144:cW4yv2JjSpl5hi/Bq3AIi8DTkyhTQOKQ02W:cW4yc4iw3AN8DTkyhTQO3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788905011, "uuid": "66065d93-870d-4075-8014-6de3a20b53c0", "value": 256312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788905011, "uuid": "742eb9c5-97a0-40e5-aa74-77db5f3da79d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788905011, "uuid": "9ef893d8-3d7f-462f-be54-0c9fb076cd58", "value": "titan.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d40f6fb-ab2d-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788834540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788834540, "uuid": "10b7bda4-3892-4de6-8794-78169fbb9b9f", "comment": "Malware payload", "value": "6f8a4b2139f1885c7360e4403887ce6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788834540, "uuid": "2d1192c8-d90d-4fde-8535-514c2b9fd7f0", "comment": "Malware payload", "value": "4dd45bb7168a5588749f95a8e9c2e2d4ea658f23bb19233506ce52a552ae148a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788834540, "uuid": "7e9db3f7-8c43-4e4e-9421-3658e32dad66", "comment": "Malware payload", "value": "f1a11bd30d67c9b0972cf90743e4362d2b531fbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788834540, "uuid": "f508362f-a389-41ed-b9b8-27d81cd462dc", "comment": "Malware payload", "value": "5b471d10a128af2d89a171fc64b2ee2884f43d8370acf17df069e9434c8674c52cc9d798d3f0f6243936f1062c3c892e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788834540, "uuid": "f33ed0c9-5065-484b-925e-8942f8dfc5bf", "value": "T1FE8533852B85AF03246E3B3FBE451273A4D9A7287117CBE609FAC3D499550743CC7EA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788834540, "uuid": "fc37701d-cd9b-4034-95b2-7cc5144621b0", "value": "49152:P1ezngtG/cBShej6OVzaGzKKDGgu63JTWIVKY2uIfiRw:PAznEGkB0QdKKDXL5xMF+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788834540, "uuid": "92589b26-936f-40e0-b1bf-f31f50a62dc0", "value": 1789695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788834540, "uuid": "bb66b3f5-c6d3-4993-8e39-77eff7d22b88", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788834540, "uuid": "a07a0cf7-5f20-47d7-bd8a-2c83a7d004e1", "value": "4dd45bb7168a5588749f95a8e9c2e2d4ea658f23bb19233506ce52a552ae148a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65d7719-ab4c-11f1-915e-42010a9c000a", "comment": "Malware payload (AgentTesla)", "timestamp": 1788848165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788848165, "uuid": "359f3793-9f0b-4d54-a7c7-93fe543ac285", "comment": "Malware payload (AgentTesla)", "value": "0fdd9cf02bd7896f5c2da15f6095200b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788848165, "uuid": "5b7509ac-4d5e-45c4-bc49-e99f78f3909d", "comment": "Malware payload (AgentTesla)", "value": "50870e9c32f31ead4505cfa3ad61f797b5a8d0a85b511c7e1a3810b7476a55c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788848165, "uuid": "ed9fc0c0-87ea-4f98-adef-88c1c483e98e", "comment": "Malware payload (AgentTesla)", "value": "f297993a5d419d521cc613fe7c357368b251969c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788848165, "uuid": "b3c35f63-dfd5-46a7-bbae-546d038544c9", "comment": "Malware payload (AgentTesla)", "value": "bbf1004f40434fef7f2b87c49de46ea20f0e5119417efc3201d12a5c5a33e672dcb119aa15c39418c625e531886ecf87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788848165, "uuid": "6c1afb41-765d-497c-9ccd-de43e37a2cdf", "value": "T132152256B254D19FDA420A7169F4CD2E521DAFE63C25073737A3734C3E34BA6AE0A708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788848165, "uuid": "3e9177d3-b176-4028-be0c-f9a374013ddd", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788848165, "uuid": "a60e972c-5b15-485e-ad2c-b137cd0cc679", "value": "12288:c0dG9H63cQWyMBD/+U9jEAHTYqEZ6AklJfkUYHk8ZaeDWljHCecCvcppyd7:c0dh3dWyyjP26ACJfGnZaeDWhnc1yd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788848165, "uuid": "3b1fc243-2d56-4fff-b3ee-623fb0d8c4ed", "value": 902904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788848165, "uuid": "9c7f41f3-10eb-4d63-a4d6-c2a569fb34f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788848165, "uuid": "9c94d238-248a-4e0f-9282-26bc049a7360", "value": "PO 10266_08-09-2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188ceb9f-ab34-11f1-915e-42010a9c000a", "comment": "Malware payload (Blackmoon)", "timestamp": 1788837566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837566, "uuid": "f2904035-02a2-4588-af50-ad2ecba11149", "comment": "Malware payload (Blackmoon)", "value": "60ba84a175e034a539c49d265e3865ab", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837566, "uuid": "a6aac8b7-55ef-4174-a82c-e01162bdf441", "comment": "Malware payload (Blackmoon)", "value": "526e532170acbc980bf41c48d1886b592a871c852d5ea86f98db4296bbbe85b6", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837566, "uuid": "a7ca9cae-3d3b-4afc-8deb-68f06d5c83c8", "comment": "Malware payload (Blackmoon)", "value": "7cbae0769cbc8c0f511cb7aa3b76271b4173a1ff", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837566, "uuid": "7f96cce0-eff1-43f5-90de-e74a55a99038", "comment": "Malware payload (Blackmoon)", "value": "3c95c3797a11bb4355fc1185e3ad7395ac413f6907cd635cffa08de3edda19c2171161bbeb9dd2b5c534f39e3babed88", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788837566, "uuid": "b2841059-f101-413a-877e-4796fddbc3b0", "value": "T187146E03BEA481FAC16B72BF29A21F35BBFBE5005F6A4913A724CF5D6C209105717786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788837566, "uuid": "95adb5c5-53d4-4bb8-8c81-eb493028f54d", "value": "3afb9c71cc6cbcb8650a38995c3c7e0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788837566, "uuid": "284a0da7-787e-4db5-b6a0-321beabe9234", "value": "3072:C2z1Hc7uK3JYS6pr8VE28RaOUbtsftb7y:C2zmqK3JtgkOgtsRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788837566, "uuid": "e944f376-857e-41f6-80e4-993245d7b269", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788837566, "uuid": "7826e8b6-c0f5-45ab-8b77-8a30daaa33db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788837566, "uuid": "40af415c-d00d-476d-9560-262e91eb635a", "value": "526e532170acbc980bf41c48d1886b592a871c852d5ea86f98db4296bbbe85b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153b5024-ab6f-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788862901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788862901, "uuid": "3131e456-4781-450b-9de5-6bd302cf1b62", "comment": "Malware payload", "value": "2eeb71cc9789a3ff0f8d872f634fc346", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788862901, "uuid": "a62d0570-07c6-4cb7-9a2d-4fd82d5a1606", "comment": "Malware payload", "value": "52dba06b61623b8256b774370dccce28ead47994ebb5c45f7674ca56f41007af", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788862901, "uuid": "b0eab94f-cedc-4125-a2c0-33aec4635185", "comment": "Malware payload", "value": "4361f84f2cea499e82a59ffd6d80c83a5c612040", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788862901, "uuid": "f23446fd-dfbb-4c68-9120-884b9cd961eb", "comment": "Malware payload", "value": "160fcde179ebcaa00de81e0d39a77307bde8739bc60eb12f6e00cbe6adeb77047ea0cf94e1be6babf1146feff9836db2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788862901, "uuid": "8d362532-21c5-4b77-a7e9-3b2c17e31e25", "value": "T1943147DE41641B315202CA4DB767394CA28E91FB2C5FD7D4D9180EE982886CDF261F4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788862901, "uuid": "dbbeb0eb-5f6c-484f-a2a3-5efd337d557c", "value": "24:TJSLBBvSZGOGdHBSJ6Jizh0a0uxSRG+wuD58ESA:ArqGOGZBSJ6JaSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788862901, "uuid": "a4be7ba3-d97b-4b40-bccb-9eae391ed13d", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788862901, "uuid": "f68fedd9-ab56-46c5-86d7-78631591e871", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788862901, "uuid": "b7a0028c-d2ae-45fe-a72c-414da10f0970", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "695ffec1-ab36-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788838560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838560, "uuid": "d2593bcd-146a-4505-afe9-dac3369a0a44", "comment": "Malware payload (Mirai)", "value": "51ebccaa83fdd40402526e99027f5f58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838560, "uuid": "0a9f1657-402e-430a-8560-42be34e67397", "comment": "Malware payload (Mirai)", "value": "5478cbc19129559bd58329a0ce9e2953ca0b349e19240e22b5d8446b26d2000a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838560, "uuid": "48297171-3f3d-468c-89a5-0b8cf90b20ab", "comment": "Malware payload (Mirai)", "value": "5169cb2e31d50f09a8e59f5e374fbac1d48f7348", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838560, "uuid": "f4a6975d-403c-4388-97c7-aba8c7b23206", "comment": "Malware payload (Mirai)", "value": "c7b81461d2e104969f9c1ab2cfff45e397450a9c646f22bc93f4bd21c5325b1f0a8745d98658a746c49bf88b3b0dde26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838560, "uuid": "f674e83b-7154-4604-b9f1-6ddd7ca399a1", "value": "T14074BF66F5477E2CF4BD99B78337290A71B7E0924E42FCEE0142F733DA2B1564A10A94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838560, "uuid": "1d04a3ac-a674-4796-b786-584288e20055", "value": "3072:b4DSKlVjw/K9WFuQX8wthVWXhov//auKr7ZkvfVg93aroTvGn0HgsCALllvg4nnH:b9KlqCYY48+kSBKreKPxFllvgwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788838560, "uuid": "487dbc89-e739-4fd0-a7bf-105aef7f2359", "value": 346556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788838560, "uuid": "c120a1ec-962c-41c4-a3ac-b1bb43c9646f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838560, "uuid": "736d8b93-29ea-4809-ad9e-22ddf4f09140", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7213bf9-abb7-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788894069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788894069, "uuid": "921ee0a2-6eaa-4340-83da-a3887d6ac1cc", "comment": "Malware payload (Vidar)", "value": "8d0fa8795f3b4e43459ebd14a8c15c1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788894069, "uuid": "5c388faa-f69a-4f3e-b1e9-861eb4c8323d", "comment": "Malware payload (Vidar)", "value": "550b393f4daf05fc157782cb6e6ee783a7cbe88b958c29192afc554c5ce0ef64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788894069, "uuid": "16497203-b294-4f77-b8f0-552c673302c0", "comment": "Malware payload (Vidar)", "value": "b67aa382fbff44677a279b84d613d9d2ed6f9811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788894069, "uuid": "63c79211-ecc2-47d8-8f2f-36aab0973291", "comment": "Malware payload (Vidar)", "value": "ee15014f25bf2ebb96c2b27cf956be5541ac710ba01efc51ba73a5a667f9d9cf29cdd584795cb4847658e6eb48eb507c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788894069, "uuid": "516c9460-db25-467c-b93d-f605a494e5e3", "value": "T18D667C07B9A505E8C89AC634C47B93437A78B88D4B3573D71E10B6343FBA7D899BA704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788894069, "uuid": "3e436637-ea2e-43d4-a871-8ff6c141b657", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788894069, "uuid": "bc19d8c8-e01f-42df-a00f-ca8f61aa0e78", "value": "49152:AQRQDEAs+c9yhakwV5jXO79FZIWo/ECtlmOVr8JHnfrttOy6h5+8mlzwirpcWmRk:Aq4iVrMnzt+jPWwir5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788894069, "uuid": "98f84f53-54a7-4d6b-aec9-3413eee8d2ba", "value": 7008256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788894069, "uuid": "24ae189e-060a-4254-ba54-d39edebac5c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788894069, "uuid": "99efa62f-80a6-494a-885b-02b30c73996b", "value": "550b393f4daf05fc157782cb6e6ee783a7cbe88b958c29192afc554c5ce0ef64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb7834c-ab5d-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855476, "uuid": "f7c0ec19-b25f-49f1-be9c-a9119202574c", "comment": "Malware payload (SilentNet)", "value": "d0f551da319977f9ed18fd3bd597c346", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855476, "uuid": "41227434-8c63-4881-a67b-ee563dcc9ae6", "comment": "Malware payload (SilentNet)", "value": "552b53b0072d4e14c710268c84ea10842787e31b64f13375e267e2282262b9a4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855476, "uuid": "a2f58bb4-cbf5-4a23-81b1-07b27ffef22f", "comment": "Malware payload (SilentNet)", "value": "ccfb961a3532f5614420688abe826066f2aac7e4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855476, "uuid": "1e4280a2-2d10-4c60-bfd7-c9a027c44423", "comment": "Malware payload (SilentNet)", "value": "4bdd499e579044acb4631f1bcb81866ca69e0772296c7a37177678b836affce3d3c44e6cfbe54d5e90521aa975c288db", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855476, "uuid": "5eab49a6-1d99-4f8d-8c4b-a5f405e808e8", "value": "T18993123778044E69CD8F3F709B448102FA2AC342CA466D56869586CE30E396E7B15FFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855476, "uuid": "f0f88d30-27da-4eaf-b02e-45958d42f728", "value": "1536:f8uqFv8msf/KJv9KtJvwfbLxE2UDlaFMzyKhUYEzq+elzM7QJoL5:0wbav96vwJERO338s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855476, "uuid": "f4bff721-9751-416b-b699-d6799c896e2f", "value": 89120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855476, "uuid": "c8261bf9-a21f-4044-832a-6af598a1186d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855476, "uuid": "26613b09-625b-4d66-8ff0-dbf30883e002", "value": "Zenith Client 1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7be9cd-ab5e-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855771, "uuid": "1321e312-9d33-4373-82f4-31d9b926da04", "comment": "Malware payload (SilentNet)", "value": "ecbae5869a9e0f4f9a86107bc837251d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855771, "uuid": "41f59312-1f86-4ee6-8d31-be545f4f4a37", "comment": "Malware payload (SilentNet)", "value": "5641e3a896a7f5ce8c1e707c288c87c7f52d1f325de7953e4631cc6d742a4dab", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855771, "uuid": "db3d5a5f-d397-46a0-bf02-c1fe29162e8f", "comment": "Malware payload (SilentNet)", "value": "c7fd5a98017b095152052f7c3ba7c54385b99e0e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855771, "uuid": "df9c585a-af9f-40b9-ae91-50b1b8f10e71", "comment": "Malware payload (SilentNet)", "value": "75ec70b3dafc808b102ae843d5218e81fbf15504198a82ce16901855e1f0441e65e743f8464d3751f3d7b4a16b016fde", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855771, "uuid": "ec030bfc-8d68-4915-8f9d-51c7f0ee0cf4", "value": "T136D533D4B77BB90CE4903FF88A46BBC5212340C0E9EBABF25226611566DFF7E1409C95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855771, "uuid": "dc35f01d-9631-4561-b82d-84d362627331", "value": "49152:D2g8NX7eOKeIf0+YrALvjt8hlqU6X7EYTVXe4fhQTqwT8h:DupBI8+pvjszYxTVuBqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855771, "uuid": "e09abf70-0375-4cb8-8310-39df3a73748c", "value": 2762876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855771, "uuid": "235d28f3-9db9-4c16-998a-1044e641e695", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855771, "uuid": "e11a5da0-eeb4-49b7-91c4-ddf40ac1ebf1", "value": "Vape-Client-1.21.xx-udpated.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f82606-ab5d-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855434, "uuid": "c9115919-c4cf-4abf-89b6-bbc859179653", "comment": "Malware payload (SilentNet)", "value": "b69b1bf674fc52c8b381be99db8d6975", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855434, "uuid": "4d5db4e1-8d81-40ae-bd04-91b4a0ceb81d", "comment": "Malware payload (SilentNet)", "value": "56587cf84aac586b6653e2a0a0d4bca9a645e1897d50b232831fa34964d1baa9", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855434, "uuid": "ea85b4a2-271b-4723-9422-e6b8a464c18b", "comment": "Malware payload (SilentNet)", "value": "5accdbe83748a415468cc94be2155d89c2d9ed42", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855434, "uuid": "60071ba4-d54d-45c9-816e-1d42ef340fb0", "comment": "Malware payload (SilentNet)", "value": "dcf6d94255f70c4097910d12ef1348eff611f8e55487b7a959bf78bcfa8d9ee3d022b9c8918eb8fa2f54af2331a414cb", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855434, "uuid": "f3e4f35a-b25c-49f9-97db-1d43362d44b8", "value": "T131152273B34D1136D897B33131119F216A2E63F09457E2AB6BB808961ED98A91F0F73D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855434, "uuid": "c9415910-bade-45a2-8724-005f526b3389", "value": "24576:NyCQx67RDARl6quP9M2j2hWS/vMFfefrKcnh/FrcmaX:oaWRl6tdyhZfOMFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855434, "uuid": "a69bb93f-0943-4cbe-a49b-2436ee307efb", "value": 935440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855434, "uuid": "82deef6d-04cd-4309-a537-b84db0691e4c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855434, "uuid": "cbe63ce8-6679-4135-86c4-faea39f51886", "value": "Krypton-Cracked.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0930f4b7-abcb-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788902394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902394, "uuid": "7689d83d-7808-4bc8-a9be-84948a2e69c0", "comment": "Malware payload (Mirai)", "value": "b73139c6103d3c771ccf37100f4eb798", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902394, "uuid": "333af81d-c76e-4f70-b044-66fda67b2cd1", "comment": "Malware payload (Mirai)", "value": "56ee76316c9c8d9561cf318fb1d1439d069c7fe9da91214ce976e8c3beb8cd4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902394, "uuid": "21bb3f5f-ee90-4dcf-b2d5-714d9b366920", "comment": "Malware payload (Mirai)", "value": "ec65e4c353059d49c6ea3c0ef53f9c4fba9bfc69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902394, "uuid": "8af6aec6-a752-4fe0-bc20-ffb1941d69e3", "comment": "Malware payload (Mirai)", "value": "fe656b6672b3db7597b41b8e95086f5697d35f89b8d65e774226b6b5c612c86206104feab1f0ebabd916bf3a5cf6a09f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902394, "uuid": "e83e369c-aa5e-4b9c-b933-6b2cdc11f901", "value": "T1D943F126F26E0B16FE7BEF721E1BC2C233C15E693C4726E910E46E568B56E30395149C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902394, "uuid": "ae854141-4134-460a-9904-2b2dcf7e1526", "value": "1536:UePC1bgW0E2ZCO15rXQ/54dRgaAUIUAXnjz69JxPuo3OOUC4u+qgw097:Ue61cW0rV1e8RhAUIFXmP/Oa4u+qgwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788902394, "uuid": "a6dd582c-2984-4155-87b6-ea767ba85871", "value": 59916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788902394, "uuid": "48c683b6-9bfb-4005-b59e-99204b4ddf7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902394, "uuid": "c69a736a-a357-446c-a1c7-5b0dc4487fa8", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2700dc-abcb-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788902669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902669, "uuid": "44920e49-ad05-4557-a962-d4e9b8f91378", "comment": "Malware payload (Mirai)", "value": "bace0b81444df5e4d41d42ffd1d23cb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902669, "uuid": "e37fa1be-adb5-410d-a054-621fcba8ca20", "comment": "Malware payload (Mirai)", "value": "57130207e60dc0596100e86cc67e288dd092fd3ffaeb230f8a1fd975797b56d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902669, "uuid": "cf1885c3-d2b0-4406-8e19-99f56fb6eff2", "comment": "Malware payload (Mirai)", "value": "0b8f3763e8eef5c02bace7dd8ef2862c66afdc09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902669, "uuid": "6cb5d251-505a-4d97-b7f5-0ee1a5ebd5fb", "comment": "Malware payload (Mirai)", "value": "a81f5b2b20cefd55432efd77cf1fd835e81a2b24b95f43f73f9f870ce1dca52510a17c44eb43057105b32d33dc97fb06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902669, "uuid": "7c827ea2-b39c-4243-8437-52edea8a7fbf", "value": "T179742A167A21CF70F615C1314ABBC9917EE411D32BF14895A32DCB683F3225A684BEF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902669, "uuid": "687e248e-43cc-4aa2-adae-79d2b61ae286", "value": "6144:8Cfu+IkN0cg68Mj5jsZrHFSZt9NQJlmIen/Wi8/8fkyhTQOm4Sn:b4VILjQ2Rn/Wh8fkyhTQOPSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788902669, "uuid": "7c13e1ca-0b1e-4733-8791-c0c548bbec9d", "value": 348796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788902669, "uuid": "c17d3e1e-87c3-4ef5-b837-53b7fecf56c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902669, "uuid": "5c5ef065-28f0-4115-b966-1a32c2d4afbf", "value": "titan.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15f4a6b-abcb-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788902757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902757, "uuid": "9312ec71-4975-42e6-b412-d467b7c8678f", "comment": "Malware payload (Mirai)", "value": "e79cfce0ac18fa17646ac5d4983b108b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902757, "uuid": "a65f9f18-1afe-411b-b759-243f643c99b0", "comment": "Malware payload (Mirai)", "value": "57a8965812e8f5bb8f9f0abff20e77333c8072f530adc970ccabbaa9ccf6e1dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902757, "uuid": "1737b3b5-fac2-43f1-a087-a078b42b12f0", "comment": "Malware payload (Mirai)", "value": "3659a9229bf51fb8d30bc9b6d6ebda768ec35397", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902757, "uuid": "b1294553-9f5e-426d-b483-58f30985a12a", "comment": "Malware payload (Mirai)", "value": "28e1b76e6bd7037e8e10fe973417b14b6d7b557c60b2ebbae32bfeb60ee6682383546c8e4027e919274e24243979e326", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902757, "uuid": "d003a33e-3a06-42f1-b7ab-3220538b1a68", "value": "T11444084AFC41CE61F98106B5FB5E82D83B2303FBC7FE750199050BB42B6762A4A77952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902757, "uuid": "f6cb16e4-6d61-4ff5-b95e-6ed291463b11", "value": "6144:c04ZsN2VnDf/l5zWsyNCKPJgJpK8PRqlsw8nkyhTQOmw/Uqj:cjZs2f/PzWsy/JgJ9PRY8nkyhTQOF/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788902757, "uuid": "70a3fe57-40be-47bd-9d1b-96cba8149e17", "value": 267976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788902757, "uuid": "1b576d07-ea5d-47a9-be70-a129c8b30da4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902757, "uuid": "b187e066-43af-40fa-81ae-bdc5133ded88", "value": "titan.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1981e018-ab2f-11f1-915e-42010a9c000a", "comment": "Malware payload (ConnectWise)", "timestamp": 1788835420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788835420, "uuid": "1e885f1f-9d28-4ceb-8a18-4e7deafbe946", "comment": "Malware payload (ConnectWise)", "value": "6934255b1ba10cde7a761574d72d4dee", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788835420, "uuid": "9c5c3696-d360-4e36-80a8-c40a9cb9ca76", "comment": "Malware payload (ConnectWise)", "value": "57cf81533546785a6340b393330eb5cad02d8a27a95241f6940a702a42e3b4fd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788835420, "uuid": "04b03c43-4a39-4953-9790-2ea71a082bc9", "comment": "Malware payload (ConnectWise)", "value": "a53e7fd746f8b4ccf27f017ce4a56257cd4f9a4f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788835420, "uuid": "ea243e8c-2d6a-49e3-a28b-404c4d45966b", "comment": "Malware payload (ConnectWise)", "value": "90ab208e15709fccf5441b28045c26bb9078fc9d7228f0e81ab1d24cffefe0b26a210e11b31d3c860a96bdbf3d4a487e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788835420, "uuid": "7a852e62-9aa2-4493-97b7-bd25fce4dc37", "value": "T144D61211B3E691B5E0BF0638D87A62666631BC128751C7AF6794BE792D327C08E31373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788835420, "uuid": "5a05a1b7-0788-489c-a488-9ccd619327c4", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788835420, "uuid": "9c9094e3-3699-4009-9e3d-e853ac363fd8", "value": "98304:T3GF0s6efP2Mn1Giy8E1PqhOG6ztZNK9aNG6Mn1Giy8E1PqhAMn1Giy8E1PqhfMY:DGufefPBZWigz3I968ZWijZWi+ZWiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788835420, "uuid": "7fa3c0db-9705-4c81-a1d4-d8fd70671ba7", "value": 12828216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788835420, "uuid": "622fba81-15dd-4d06-bc43-d10858b8f903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788835420, "uuid": "d326e2d2-6f55-4cad-a962-141b53c65817", "value": "57cf81533546785a6340b393330eb5cad02d8a27a95241f6940a702a42e3b4fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd518b8-ab72-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788864368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864368, "uuid": "8c8f1183-2bbc-49fa-bb50-39e9781c0a13", "comment": "Malware payload (Mirai)", "value": "eecbb7cdf8e0a8b67baee99985b73f30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864368, "uuid": "211aed95-215e-4eac-8b25-4477240fb83a", "comment": "Malware payload (Mirai)", "value": "57d549a23f20996bf2a64d9dc03ccfdd5e600ef6b52fbb35051e31bb02439721", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864368, "uuid": "57985402-b4fe-4bc4-b024-e2569e790fd1", "comment": "Malware payload (Mirai)", "value": "219d5e7caaf0ecd804634c799e5378dd3d46f863", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864368, "uuid": "3405eee5-5224-4cef-988f-b71774c8aef9", "comment": "Malware payload (Mirai)", "value": "e6285f0db0b3203053d260b499361ec45e9f5b36fb27d7df74c677eebb02d6c3c0bb0b37ce906ba11df0778818111eb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864368, "uuid": "9ca28fd0-fafa-471e-a99f-7807c7af1e27", "value": "T11AC2D0E07726FA31C4206C3EE52B4D8A3951067C91FE353764258C399FC169A67F84EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864368, "uuid": "977170fd-0777-467e-86e0-d8f208088b07", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrY9q3UELuJ:OKy4qfqoeJdXWgBLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788864368, "uuid": "ca0e26c3-7dce-4cbf-a32d-b2f6d8549d90", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788864368, "uuid": "ea4def63-6d0d-4926-b69a-5a6c86b01d3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864368, "uuid": "4007b4fe-8006-4075-a704-7a01b12af453", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98335c22-ab68-11f1-915e-42010a9c000a", "comment": "Malware payload (CoinMiner)", "timestamp": 1788860114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788860114, "uuid": "0dba3ef2-8646-4871-9f2a-5b1b5520dc4c", "comment": "Malware payload (CoinMiner)", "value": "b073e0c863b9afc1b2452e9c5e3b18a6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788860114, "uuid": "d2d6b5a6-7a1e-489c-9aef-6f47783cfe0a", "comment": "Malware payload (CoinMiner)", "value": "5a18581269a2765d6772d1e483bd5abacc1e3112edf53e0be6432981010c33f6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788860114, "uuid": "f772e371-d075-4028-9cb9-aeef0ca667f7", "comment": "Malware payload (CoinMiner)", "value": "26b1800ff08f6158e0a236e58f10ebc1a9e309df", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788860114, "uuid": "fe5f828f-4435-4440-b61e-27b879aa98dd", "comment": "Malware payload (CoinMiner)", "value": "47580645e77a745676ad4a366161acffd1759dc294a0cfc751ee2e30854e7ce14dae44c0a75b2343ad790f48a84e597d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788860114, "uuid": "8f3210c7-7dcf-4713-8400-f80492a97c4d", "value": "T1963633AA68C7A1B9D517C3F98143947E72BE3BA104617C0FBBC86C109D67A18B43F746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788860114, "uuid": "f12f6ced-5c6a-41ca-b4c9-7a14c05acadc", "value": "949ec789a5933fb6051c9013a550fb57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788860114, "uuid": "96876e5e-d176-44d8-bc7d-54f9791667e1", "value": "98304:wVm7seV7647Uvs3iVpvvr7PNVtiogxAbWIefiUo89+KpUqS0nPF580L:wANtFgEspvr5VtL1xIotqT5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788860114, "uuid": "3552166a-5184-45e6-b10f-c9d6dbd23170", "value": 5324800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788860114, "uuid": "76e57ec3-f386-48e7-93fd-7c031e23f9e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788860114, "uuid": "99a4a9f0-285c-4035-9279-7e907a2fc5db", "value": "5a18581269a2765d6772d1e483bd5abacc1e3112edf53e0be6432981010c33f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0e27a4-ab46-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788845388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788845388, "uuid": "d4d1f926-d896-4182-8449-9de1e1c58626", "comment": "Malware payload", "value": "65007f119c55fea2b2af9b0c08166118", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788845388, "uuid": "8a27c2f7-18c1-45f4-b1f0-4757e5291fcf", "comment": "Malware payload", "value": "5ab17ffaee90af78c5fb986a9b673bbd4fc8d5a7fe5e846a1333981e96a60730", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788845388, "uuid": "522d62dc-618a-48ec-9e0b-380588a32754", "comment": "Malware payload", "value": "3d80d5d21c8dc14fd526c27e2045f44adf2c0f95", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788845388, "uuid": "c55ae01f-9d9f-4760-97ed-36bfb5420961", "comment": "Malware payload", "value": "d0a7c08f543d926a8e391fce396ffe4e2228c985d4e551301268f7c68d3f97dd729fb40e87a29a0c4e57a7ee1fe7c5c2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788845388, "uuid": "ecce3cdd-18f6-4002-930b-366e9d1c3853", "value": "T13731A4AE045406321253DA8E73B3754CB19DA6F7289FD7E4D84C0E9982C968CF271F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788845388, "uuid": "23f228b7-6bd5-4fa7-8ac7-428120edb0c6", "value": "12:UG6PWa6+py76peo6LQlNkECr6NkEAmwNn6N5l11bE1qlLL6LauVXc8Z6WSKHr6Ke:d2ERP6ZNElRxFAWv1ZYDBHINxcR7M29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788845388, "uuid": "cb9f6989-5d8a-467f-aea6-8f939e75155b", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788845388, "uuid": "0bd73328-33c5-44a0-ab68-2b2fc14d589f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788845388, "uuid": "35f89cac-e1ec-41ab-943c-669d412470d1", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17e5b02-ab36-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788838708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838708, "uuid": "0d559254-1287-423a-96e9-298a8d2a7165", "comment": "Malware payload (Mirai)", "value": "d6c2206a2f99de2c3ea0b0aa1baf0d24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838708, "uuid": "188ccf4c-1b29-4b14-8822-447de7521ea2", "comment": "Malware payload (Mirai)", "value": "5b35e644be1e8e43a1fcab04c7b9b656e18c573fd9d519e431f9a2f52987e71c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838708, "uuid": "91dbf3b2-a682-48b8-9376-2b7c63169f2a", "comment": "Malware payload (Mirai)", "value": "318152ac9e94ad529f9dc567d7536b0cec13daa6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838708, "uuid": "c86728ad-c69f-4dec-a94a-0d09d44b3d5b", "comment": "Malware payload (Mirai)", "value": "58900cf7158c0610272816e2b09bfa221c2d7ad9b92234d8e248893ce9332c03dd97581281bb76d71144365e66a268c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838708, "uuid": "4467a261-02ce-464e-94fb-ecb37453e271", "value": "T1F7D3127FB4A9A7B4F219427C536D1B11ED9C262CC51799CF80B4D606DA80DE32FE11B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838708, "uuid": "61e86c28-e03c-4726-b93e-7e7823de6f43", "value": "3072:DwQVYzHRS8ilcHXDV2izAciAZsmlUPwGDORVR:Dw/H88scHXDdNilIonDOHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788838708, "uuid": "43986e93-f16f-4372-ae60-79c19943a9b4", "value": 133596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788838708, "uuid": "7bb9585c-8b46-4017-b404-7fb42b86cdc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838708, "uuid": "c32f8ae9-40fa-41ce-aaa0-a9e7487e919f", "value": "5b35e644be1e8e43a1fcab04c7b9b656e18c573fd9d519e431f9a2f52987e71c.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46f06cf-ab72-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788864483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864483, "uuid": "0331f3f1-0469-4a5b-8610-3ef9aa92b91c", "comment": "Malware payload (Mirai)", "value": "a7560d027a94604272db94683666c676", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864483, "uuid": "5f29cfde-098a-4c85-a8eb-3d88cc675335", "comment": "Malware payload (Mirai)", "value": "5c1accc7486fb03bd560c5d9be9ee4d915251344eff01b9a78f9038ac36b74dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864483, "uuid": "e520254a-94e2-47db-9f1f-51b188b48b66", "comment": "Malware payload (Mirai)", "value": "fdbcf295f48c70febb141c5235a38e00898587ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864483, "uuid": "f59abd13-de19-44f6-a800-1e3648f5fd68", "comment": "Malware payload (Mirai)", "value": "f82693d338eafc5fc50f854e74497b0dbde16d0e1e51d17958de420a945c9981c3ec08170a5b2e14e3c3ce505ad4fcd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864483, "uuid": "e4c1c357-1c36-4e2b-9337-975aaf08ee18", "value": "T1FC82CF30619B74E5DBF14435EAADCEC6971A0BF8D1FC36E316586F78894210221F93CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864483, "uuid": "23b4ead9-71b0-484f-825e-3857435f0388", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaXhymdGUop5h5lM:6GV0P6+kom0tVAoNvm+to1Xs3UoznlM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788864483, "uuid": "b6772d09-bca5-48dd-bb2c-ac2a3efc8a85", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788864483, "uuid": "13982eea-f6e6-4ddd-b56e-b4091be77ea0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864483, "uuid": "2eaa616e-8483-48cf-a3fb-a2df573ca467", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e37441b-abc1-11f1-ab4f-4201ac107002", "comment": "Malware payload (MassLogger)", "timestamp": 1788898349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788898349, "uuid": "7fe6b6dd-b76f-40b9-abf7-847b898d4692", "comment": "Malware payload (MassLogger)", "value": "7451b3a1606a367820736159fb221715", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788898349, "uuid": "0eb08d5c-19cd-4f88-9817-c5b82fa94583", "comment": "Malware payload (MassLogger)", "value": "5cdd04bc74bc8d2c3ff82508009ae2d94adb7ae1619bfc258190d6a242fc45a0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788898349, "uuid": "f80ef2c4-e7cb-4943-aa05-7a8d7c20b861", "comment": "Malware payload (MassLogger)", "value": "f8aa1504dd47ce144b71e86f4890c24b465345fb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788898349, "uuid": "e213bd9a-1d02-46eb-9b98-39bb2ff8cc55", "comment": "Malware payload (MassLogger)", "value": "16a1f27aad53e0863faefeeae06ec72e7e59170b9adf01593736de0f4086c92ac8f093698eb731ccd5c02ee904a60546", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788898349, "uuid": "b3ab575e-5669-4560-bc21-38dcbb8f684d", "value": "T1B925BC2DBA39B0588DC97526A22967B1D48B4EBF23375BC72C11FF80A542CB6CC61717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788898349, "uuid": "5cc160ef-f28e-4fe8-afb3-41484f7c53a5", "value": "12288:occjU15DjjjjqHfWZuZO6ND1y/Qmh7pOTB5nHjjE5Qp5DpNzTc6575DQKZCnj+5N:yWIZw4mh70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788898349, "uuid": "8a97f287-8095-4654-aabc-f5c8d3705aa8", "value": 972454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788898349, "uuid": "6076f43c-4864-44be-a44a-c87255224698", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788898349, "uuid": "11735134-5744-4a1d-bece-88c69e01d8ef", "value": "ORDEN DE COMPRA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d6b176-abd9-11f1-ab4f-4201ac107002", "comment": "Malware payload (SilentNet)", "timestamp": 1788908435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908435, "uuid": "90418abd-1c98-4f3d-a88f-b7065556f71b", "comment": "Malware payload (SilentNet)", "value": "d7f14e87142705312a5fdbe4390b4e95", "object_relation": "md5", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908435, "uuid": "42fade79-04a8-4297-b65e-535bebd9a624", "comment": "Malware payload (SilentNet)", "value": "5d5c3836211ea4d757334687b12105d4e9f842ad9f6ee7ef655185e98c02e12a", "object_relation": "sha256", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908435, "uuid": "baa7afb5-ee26-447d-9c67-b0d3f2131bdd", "comment": "Malware payload (SilentNet)", "value": "a55537af0badd2a23de6749da1c776724379c4a5", "object_relation": "sha1", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908435, "uuid": "907e0c09-cba4-4acb-bf40-8c8c3b25c3a5", "comment": "Malware payload (SilentNet)", "value": "98ac2b35f011850e03343de034147b4e854741bd04ece9dcb3ae2b26df51db10435c2b8ebe9ae52ac0c18272e4494773", "object_relation": "sha3-384", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908435, "uuid": "7f1ebeb1-44e2-42f1-8695-0ca5c326fca4", "value": "T1FAA4E0DB9B4ADEAAD12F467C44531FC1B6083391E806706F0E64F24B847B98F2735A5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908435, "uuid": "0dd72e0b-afed-41bd-afd6-51f3133086fb", "value": "12288:DQk97mwspYR1DcjkyzZQh/z+hzFGMlOpfaOvM:kkNmRpYRgkyuL6FMpCOvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788908435, "uuid": "1e0feecb-e100-4d75-95e6-49b9b568fe12", "value": 453253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788908435, "uuid": "f9d18061-c161-471e-9c08-db89cd8d93fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908435, "uuid": "f34947af-125d-4d21-a580-4a88d40df1b2", "value": "meteor-gui-addon.com__Meteor-GUI-addon-2_2_0_mc1_21_4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28b9277-ab59-11f1-915e-42010a9c000a", "comment": "Malware payload (PureRAT)", "timestamp": 1788853769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853769, "uuid": "d4d93960-00db-4c77-844b-9816e34b5d55", "comment": "Malware payload (PureRAT)", "value": "f64c48e0fc10cbef11ac66c68f42384a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853769, "uuid": "5140a6bf-f423-4909-be3b-15af10391464", "comment": "Malware payload (PureRAT)", "value": "6011c457fe0de19ebda63769587a15ec35ee77414691809407c3acfd53737cb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853769, "uuid": "d0b482e3-6d56-4554-95d0-44bb8eb63aca", "comment": "Malware payload (PureRAT)", "value": "27bf23f30268346bb905a1a7b5c98a79a6d02dae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853769, "uuid": "8dfd2162-5fc9-4c7d-94aa-f7d202e885a3", "comment": "Malware payload (PureRAT)", "value": "27bff8d1ebd2c86569bb8a5c20dfd5fe49bb23a4cdf292e87e140566de6839013502b1e68fd08af55729ec6a7a73839c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853769, "uuid": "eb625c67-96bc-4c20-84e8-0e80eab8ff13", "value": "T1AA15CF09E60305F6D12382B189DFD7BBD220BA5D8222AE7FFF4ECD45F1727012A5519A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853769, "uuid": "3d4d29d1-28a3-4723-a401-fb8c7fbe9c16", "value": "e4c04f87b5acaa936cf1801d668fa506", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853769, "uuid": "c7b13b9a-bf5f-40a2-b224-7e52627a17af", "value": "24576:H9MIzrq+QfdcbtlqUr1V8jcNLukph+hgkuKb/EIyNOekPDZExH+wfYK87O:dMKlqk1V8bGM9EIkO5lEJ+m8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788853769, "uuid": "939a9b0c-cb41-4f58-8772-8b97332987fd", "value": 910848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788853769, "uuid": "a9cc0493-9047-4434-9383-d4f08dbd8b39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853769, "uuid": "789a8ca4-7c6d-4b95-a01e-88d8d476ce20", "value": "f64c48e0fc10cbef11ac66c68f42384a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a6370c-ab38-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788839620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839620, "uuid": "499c303a-aa89-46ec-861a-19af866f4495", "comment": "Malware payload", "value": "43f015c80249b9ab54696aa9647eb708", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839620, "uuid": "2cbf2524-67b8-440b-9cfd-79311290e229", "comment": "Malware payload", "value": "6223359c0d6326bc037e92dafddc3261d521271a745ccb2abd080300994ab47b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839620, "uuid": "5b6a2b9c-5355-4d70-9b2e-6bd0f9097d9a", "comment": "Malware payload", "value": "93059d76009c9d8d2f608a02467a318a84b123ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839620, "uuid": "d49efbdd-3357-4f1f-84e5-6853df1dbb11", "comment": "Malware payload", "value": "47cb2e2994277b5373a085e502d861cc75e60eef81b8ff2ee1d40f43869563a0e47ea522ef1cefbaeb8efd07e2f6702e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839620, "uuid": "3ea10c0e-eb21-4a85-9b80-7ca642eb3b5d", "value": "T130C312214354DAF3F7FAB9F214E3115A82580D276D6FB0A8D010EB5DAC526C58E7D02A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839620, "uuid": "aac55f1e-0a38-4010-9589-9d8b4d404fd8", "value": "3072:NEwSEEku11Xp7Uosj4c28Kdt+FyBLKjPHFnXdTvXAR:NvEN1Rp7UGc29dlBLcFFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788839620, "uuid": "dc996972-5982-40e3-a498-5e96f8a25700", "value": 129816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788839620, "uuid": "c9bf133e-ca6f-4b5a-9052-271898e75cec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839620, "uuid": "c9780a90-4ec6-4079-b97e-2e2397338167", "value": "6223359c0d6326bc037e92dafddc3261d521271a745ccb2abd080300994ab47b.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b52c84-abd7-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788907832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788907832, "uuid": "2431aa59-1675-4f4f-bf9e-c27a4e4fec23", "comment": "Malware payload (JOMANGY)", "value": "b909051ab654021745cd505216f4605c", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788907832, "uuid": "3523609b-a74d-4038-a3ad-c55fc18c5f5c", "comment": "Malware payload (JOMANGY)", "value": "62c07b174de63a5035ce50fb11a9c1636e26fde96a0f368df1e71e7789f73230", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788907832, "uuid": "a8a0c864-43f8-4150-83cb-e2f8a53e0a66", "comment": "Malware payload (JOMANGY)", "value": "cfd738aff1b3f9eee031b1442c49b7ae3dacf62f", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788907832, "uuid": "3c9c61ef-5c73-4c77-874d-75eff4b459be", "comment": "Malware payload (JOMANGY)", "value": "8b52b586654e4741e450289af28a3f6bc9259cd5abdf7ab8ed078b7e706d899ec000057638fb33786675bada7841db50", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788907832, "uuid": "cabd710f-18e7-45b0-b276-44e6fd47dc8d", "value": "T19DC28D966E867C44BEC98A3E4CBD2B1D6DF5C3D1224942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788907832, "uuid": "6b244586-482e-45ad-8351-20e18c0bdc34", "value": "768:O8vCB+25j6es8R29FYpMSUpi+20qUpi+20YQX:O8l25Jgd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788907832, "uuid": "454840e8-dfbe-4d4f-97bf-f98bb3809df3", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788907832, "uuid": "00b05ee0-a25e-4b6f-8e33-b76933704635", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788907832, "uuid": "e56e6b1b-c97f-4e70-8b20-da15cd788757", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ed3993-abaa-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788888586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888586, "uuid": "8624e96f-5f89-49fe-8ae4-41e130330031", "comment": "Malware payload (Mirai)", "value": "6ffd1ce5b8705c06cab96bd57e485af4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888586, "uuid": "1c8cca7d-a4a2-4184-b1b8-5294a9b505fe", "comment": "Malware payload (Mirai)", "value": "647836d5995d0b9a9edd844ca1110b3d0a137e31421c64c683215c5f958782ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888586, "uuid": "92e6dcc8-a94d-41c4-8f70-9a5424d879c6", "comment": "Malware payload (Mirai)", "value": "e31314c54562e5aae49d0a1962a4be18f4939e5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888586, "uuid": "f1a2633c-c87a-44e4-9064-6168f9635d95", "comment": "Malware payload (Mirai)", "value": "130e81bf3b181f3510388d4bcda09f5694f90fc684ab682d75a3b6fb119c8d242570ccbd5978866bf766487d4e674071", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888586, "uuid": "fa0465b4-0ce6-4d96-a199-59106bf76209", "value": "T1464302E3D2BD51A8FAB1E076C034F481522A5FC85353707A67BF58461C11818BBF96BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888586, "uuid": "445506b8-a34c-4b72-8cdc-dabc54664fca", "value": "1536:hEtdPYSV9GgiwnZBC9gPzc+HK137FKY+cnOI:hEfNV9r5bC9gc7FUcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788888586, "uuid": "ba05af92-e2db-4af0-a85d-2d9eb70cd6d5", "value": 57664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788888586, "uuid": "950e3acd-3bd4-4ef0-8629-f140f955a48e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888586, "uuid": "d9086f2b-5487-46dd-b807-c9199c829f3b", "value": "647836d5995d0b9a9edd844ca1110b3d0a137e31421c64c683215c5f958782ac.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90482b16-ab89-11f1-915e-42010a9c000a", "comment": "Malware payload (FlowzifritStealer)", "timestamp": 1788874274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874274, "uuid": "45c2f132-7e01-499c-a284-591876f283eb", "comment": "Malware payload (FlowzifritStealer)", "value": "afd2c927893f26aa914e36a416701cbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlowzifritStealer", "colour": "#3480B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874274, "uuid": "2138c73d-394c-42d7-b8a4-39143f919e71", "comment": "Malware payload (FlowzifritStealer)", "value": "64df9bee21edc91b35948ec9fe215dcbbdfe194551e826dc9bb9b24ac3de5d2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlowzifritStealer", "colour": "#3480B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874274, "uuid": "2992836b-d40e-4798-b80e-2077381b611c", "comment": "Malware payload (FlowzifritStealer)", "value": "5fa3e17f4b9905968d5d23c2e95bf0b2094cec9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlowzifritStealer", "colour": "#3480B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874274, "uuid": "24346310-e748-4410-871c-673161452362", "comment": "Malware payload (FlowzifritStealer)", "value": "f478c76a8c7c34deca05b670770343d8efc288fef7d9f2a29555fb5d2c713ddd330d88ff8036eb8530e5e4a92c942b86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlowzifritStealer", "colour": "#3480B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874274, "uuid": "cd4af91d-91c4-44b6-86f1-25e89ac6f14d", "value": "T144558E06A3B900ADD5A7C1B8C9174A07EB7274451334ABDB5798CE662F23FE1667F320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874274, "uuid": "5a9b3ba3-f3d5-468b-914e-0602c6ca9cca", "value": "44f115f516941eb89718efcf722303cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874274, "uuid": "f654c382-adec-4d7d-838d-7528c0355bf2", "value": "24576:mTQxeXxpSzHQNgjQrZrsyBhaRYk2heYEPRwK6:mT+eXxYzwNKE5BhxeYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788874274, "uuid": "34c97438-bfd6-46ca-9098-4548e1c4d26f", "value": 1315840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788874274, "uuid": "fdd91757-3d24-4c93-aa4f-0f09766790a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874274, "uuid": "5d0b03ac-a4d8-4418-9fe2-2149684c26b7", "value": "64df9bee21edc91b35948ec9fe215dcbbdfe194551e826dc9bb9b24ac3de5d2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4c38a8-aba7-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788886961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886961, "uuid": "abcdffdc-b897-4078-bdcd-13965076586a", "comment": "Malware payload (Mirai)", "value": "af91a16deeb7699f57b87318dd2b61cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886961, "uuid": "25815587-c602-4a13-8313-a8a969cc4002", "comment": "Malware payload (Mirai)", "value": "654af773cded239c857900896dba786a64b567cce93d12019244bb7de7341555", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886961, "uuid": "f47024f9-a289-432e-a28d-39019835ab97", "comment": "Malware payload (Mirai)", "value": "2137e83eb8ffd370aa1dd1169662a7599dee2bdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886961, "uuid": "c7a1a95d-8a4d-44e5-9271-eee9dd7ca273", "comment": "Malware payload (Mirai)", "value": "67ef8b031ac2a752ae792b1ba7e4da573637ca31cb7b5686120c7f3af63d58f57b87331f532ce5cb336cce70e4f7c4b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886961, "uuid": "32c99234-997d-4dde-a194-70c7a038dd72", "value": "T19C43F232855773E252710A30EC2EC89874DA15D0E2EAD4F7725D0C6D4CB0B8F4AA9F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886961, "uuid": "93572a15-7991-446d-8232-826ad8dd7d11", "value": "1536:Vp2UsTPp00lLgoTsGwBHdFIyVDhrBzvIPh:VQrq0R/TsGUf2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788886961, "uuid": "e0da26be-eca9-4a61-adc1-0ce0843b65bc", "value": 59404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788886961, "uuid": "b022d7a8-13ee-4b61-a4d6-fd16b215c9f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886961, "uuid": "639aeaba-ac91-42af-89c3-d8615e5afe63", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e56a1fc0-ab34-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788837910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837910, "uuid": "716e1ae1-4018-43e0-b350-8f2ec0093986", "comment": "Malware payload (Mirai)", "value": "7fb17cce630bdad23a9958707f514802", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837910, "uuid": "f71fb863-4282-4e9b-a096-42bd76ad880a", "comment": "Malware payload (Mirai)", "value": "655278a2cf5382b7cf4097567cb979aedca341a659e2088cff946c83ba8ede76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837910, "uuid": "fcaccdd3-1caa-41f3-bd67-4fd12fd31895", "comment": "Malware payload (Mirai)", "value": "cff59d50cc39c9f1ee346c881f97de6ab2d16bd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837910, "uuid": "1e0ddce2-ab06-4799-8384-54efa9716058", "comment": "Malware payload (Mirai)", "value": "60f86add1339d17bd9e0cdccb4fda11cbe9083178dbd05b19c44577cef141bdf4c8f64e784c43ad7c72349293805d17e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788837910, "uuid": "8d8d773c-fc3e-4afc-815a-09d50b685d94", "value": "T111A47D1335760D2AE4C5A57551FB03A2FAF593CB20BC4B1AF9900CDABF1A7A071522F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788837910, "uuid": "0b4f9cc2-dc0e-4270-8d8f-1d873f330709", "value": "6144:6ESWnKAqYLqeHs3bCOMu2ORZALY72sxfmQZB0uEatHg+aV:jSWnKD4qLbCOrZrOM2sxfKR0jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788837910, "uuid": "e45198af-b762-4f36-b640-e2982b7f11e6", "value": 460444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788837910, "uuid": "d113d816-12dd-4671-a107-424d6f386df7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788837910, "uuid": "c1375996-06fe-4bf3-82e9-e0e9ff32c594", "value": "655278a2cf5382b7cf4097567cb979aedca341a659e2088cff946c83ba8ede76.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27d1d8d-abcd-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788903564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903564, "uuid": "764ad3ee-6493-498b-ad45-18a58eaf18cb", "comment": "Malware payload (Mirai)", "value": "3edfced2e21761e60d6271c235f39f58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903564, "uuid": "4c1fd604-4287-4216-9577-b073e9d20299", "comment": "Malware payload (Mirai)", "value": "65dd73ff6820fdc0aa1b7d449a1979592bc6f46a9d7a91bd6800c31268503fd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903564, "uuid": "9bba72db-d5a5-4819-9cde-cb755e2440a8", "comment": "Malware payload (Mirai)", "value": "371584688b216dc536c756a444900fc38a266b89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903564, "uuid": "4d06f89f-42d5-43e0-96d4-3105f8a2e9e6", "comment": "Malware payload (Mirai)", "value": "50c3b4888af0ef8c172b32b6b73fa3ad4985e920006894670cc4a4faa0ef985ca5afac5b8e4aff5920c94ebbc3491cd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903564, "uuid": "fb0166d0-5461-43c3-92cc-e92b27777c17", "value": "T1E7158E5AF1B330FCC56BC034476BDB726931F46911216E7B12C4DA392D92EB02729FA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903564, "uuid": "e7e5b847-5ad4-4f2f-a8a3-c5cddf43bbc0", "value": "12288:Q42Mcyj/OK4HYPdbYLcm1wlrdy4ZRTdJBOmy3L8GSFE5k:Q42MceGK4HYPdScm1wlrEMRTh8xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788903564, "uuid": "623e21fa-208c-4845-8504-97c24c3620f1", "value": 884808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788903564, "uuid": "4c8be5ed-379b-4ec1-80cf-f17909f5ba0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903564, "uuid": "be042d41-45a9-44c3-8755-1733c430dc2f", "value": "65dd73ff6820fdc0aa1b7d449a1979592bc6f46a9d7a91bd6800c31268503fd4.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74cfed5-ab2f-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788835712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788835712, "uuid": "804fb55c-14b6-4362-b635-968e99095636", "comment": "Malware payload", "value": "3163b83d0fb90d7b6779852a57c84421", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788835712, "uuid": "ded913f3-347a-4f4d-aff4-09256e571296", "comment": "Malware payload", "value": "66cfbb0aaf99a4856547cca14d817bedf2ae48f6d3ece72dde556f89c0cebb19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788835712, "uuid": "f6530999-1df5-4390-b50d-e4b1b41f43af", "comment": "Malware payload", "value": "be79c74836ed3383cfbec89f4e68484a2733ee21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788835712, "uuid": "5be74cbd-918b-4a9e-aa54-8a078448a995", "comment": "Malware payload", "value": "c26facb87319dc0010feaa034502eaf95388f3bf7ecd99306a910d675343ca55d1eb29f543ae64eb058f7c472ab7ca7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788835712, "uuid": "05451f4e-87a3-434e-bac0-b5ac729b04f5", "value": "T1F2E633C92DA7869FDC8567BC0FC143D62F40EB4962A12F4B3E832791FC505964E298B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788835712, "uuid": "c1dbb19b-63af-4da8-b835-63aa0acab366", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788835712, "uuid": "24fea74c-7230-41a9-a69d-5d8534671aba", "value": "196608:xHrQm/ark1mERay3ajm5dSFkZJbt6huE0ApRCrG1T/hZs4GbWd/P:xLSrcmAW6NkhuE0iB04hP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788835712, "uuid": "9adbd25b-3ff7-486c-979e-900214031120", "value": 14586928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788835712, "uuid": "1c0d4dba-42b9-4580-a6fb-d21b77e86f12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788835712, "uuid": "81a4d355-515b-45d0-83b9-9be92fbed065", "value": "66cfbb0aaf99a4856547cca14d817bedf2ae48f6d3ece72dde556f89c0cebb19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372639d6-abd9-11f1-ab4f-4201ac107002", "comment": "Malware payload (SilentNet)", "timestamp": 1788908484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908484, "uuid": "11d907bf-2f83-48ca-b95a-b1ae598d7db0", "comment": "Malware payload (SilentNet)", "value": "3438b3f2931dacc62d3cdc47b1ba05ba", "object_relation": "md5", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908484, "uuid": "2cf9e39b-4c49-4e30-8a62-6291e9c0d69a", "comment": "Malware payload (SilentNet)", "value": "67c4c5ac61391f6faa60aa021e66b7fed80aab9f9d3f2cae1f6b008b42b126cf", "object_relation": "sha256", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908484, "uuid": "b41364a2-b2ee-4f0f-a0a4-bd12ae8e6275", "comment": "Malware payload (SilentNet)", "value": "30aaca096b582c3f4a7e50f2c7a7a1450779cff1", "object_relation": "sha1", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908484, "uuid": "e0d3f4c4-4d55-4a3b-8e44-4994edf8674b", "comment": "Malware payload (SilentNet)", "value": "1f147ea86bacfdc3ad35ef0e8a0469c6994570b10730fa213bdcfdd3b44427342947d8ab86987a583aad1ac8161ce33e", "object_relation": "sha3-384", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908484, "uuid": "b389bd0f-6b35-48e0-a40d-b42962204dac", "value": "T1C2051216662B162FD216F239B4578DE1BEF94AE4710D64EA02FCC185C0439FF1BA16BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908484, "uuid": "c3eb0c1d-d29e-43dd-9a9b-36d2b17e5d7b", "value": "24576:YufI6NiPsvImGbKKzIEi+2m2WhA4QFtd1OKIIXfn0y+tPjx:EMzKKKzIEi+2xCwFTKys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788908484, "uuid": "00ea9ec4-0b56-4ec2-b1a3-aedee25ef642", "value": 845520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788908484, "uuid": "34c693eb-2adc-4c99-94c4-b47f0404bce4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908484, "uuid": "951c1ed0-edab-4b29-85ba-9e06be0a3aae", "value": "trouserstreak.net__trouser-streak-1.6.1-1.21.4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b763c7c2-ab74-11f1-915e-42010a9c000a", "comment": "Malware payload (JOMANGY)", "timestamp": 1788865320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788865320, "uuid": "3236bbc8-87f8-4f12-9560-f62d69e0c23b", "comment": "Malware payload (JOMANGY)", "value": "8559614bd6bebcdbaa48ffa5d9ecb9e7", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788865320, "uuid": "a5e8d20f-7e2a-423c-a7f6-cab791f26943", "comment": "Malware payload (JOMANGY)", "value": "6a0724b87621c265141c166c7549cf1f637050fa225582a34d0e344761a7bf49", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788865320, "uuid": "eb099702-ba39-4673-9c8c-09f605324bc9", "comment": "Malware payload (JOMANGY)", "value": "66b2dd9c520702c015e98ea6c3a9c0a168516695", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788865320, "uuid": "78661a2d-a2a3-42dc-a3fd-94d80e9027ee", "comment": "Malware payload (JOMANGY)", "value": "637d46b4e8b726e2a977b1a1d3008f54eba07a415e648c7cb6bcd7752a86f710a74660d302fb567c96c03dd1a741d06c", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788865320, "uuid": "93887ecf-7e8e-40eb-872c-bcc5ee484718", "value": "T12CC27D956A867C44BEC98A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C15FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788865320, "uuid": "364f5021-680a-404b-aa43-6867c5138696", "value": "768:g8vCB+25j6es8R+9FYpMSUpi+20qUpi+20YQX:g8l25JYd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788865320, "uuid": "ca63beec-e048-456c-9b6e-83a4c286acb5", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788865320, "uuid": "4fc3516d-c990-49ee-a38d-6901438f02aa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788865320, "uuid": "0b450c0c-4079-44db-9e2d-91335a4fdf11", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c456480e-ab72-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788864483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864483, "uuid": "472aafcc-c7b3-4a30-9e99-ffb557fdab5d", "comment": "Malware payload (Mirai)", "value": "437c9cfc75a7f65636014f947bdeca46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864483, "uuid": "2c43589e-2e21-48a1-870e-5deddea69da9", "comment": "Malware payload (Mirai)", "value": "6b79b3efead94a406e2bd7c1fe0d007d403a025cfda9bd6c1af988a3988649ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864483, "uuid": "59d6e6c4-6d44-4e4b-9d0b-727b204d16ea", "comment": "Malware payload (Mirai)", "value": "4dbde2c9db1e4e168662336a6403e461e7770d5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864483, "uuid": "285871a6-abe6-4b9b-8b3d-ce29a3fd942c", "comment": "Malware payload (Mirai)", "value": "65e8bb217d3626c1126aaa2c0790de8e7c7d50fe8acfb515d1728ae3891c3b8cdd400e26ea47e8bcef13586206d872d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864483, "uuid": "6e368def-6086-492d-acec-3d7931923e0a", "value": "T150431891BC819A23C5D4137AF56E56CD372433E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864483, "uuid": "69155044-8b0c-4b19-9e0c-fe65dd3df8a7", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788864483, "uuid": "a914ef5f-ca76-42b9-a935-49769aa2349e", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788864483, "uuid": "7fb8025e-1652-4328-adfd-c70c16dd268f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864483, "uuid": "8f1790eb-cd5a-43b1-b775-a362b12a71d1", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072dc7be-abb1-11f1-ab4f-4201ac107002", "comment": "Malware payload (CoinMiner)", "timestamp": 1788891224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788891224, "uuid": "9bf87c36-5e19-4214-a56f-30738e71ab9d", "comment": "Malware payload (CoinMiner)", "value": "651d9d369075532739800d049aadd487", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788891224, "uuid": "f91b8bda-4a07-4689-9270-cbf042f2e83e", "comment": "Malware payload (CoinMiner)", "value": "6b98a99832d5a501cdb2b578dbacd255205b781078b24aa7f90240bcddba4bd3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788891224, "uuid": "81701867-3206-4cdf-8761-8086e60c789f", "comment": "Malware payload (CoinMiner)", "value": "3c840fa3c0c949494ed67ed6b0af9f453093107e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788891224, "uuid": "6706ab34-07f7-47e2-bd82-cb2f4f283887", "comment": "Malware payload (CoinMiner)", "value": "6f82c48cb39847747f0d67a17229470b2375787034c0f20559633d3b5c1114251d57e8be6a7759aad92a6ee28cb0db52", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788891224, "uuid": "7d96bff5-096a-4d35-b8fa-7cfd1ec9ab0d", "value": "T1212633B6654D6CA8E1980635C47B2086C7F7E9025319EA26063ECB3DBD4F1109E7BF36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788891224, "uuid": "bbe59e99-1d27-4b7c-b39a-161e8b93b799", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788891224, "uuid": "eccda65e-40e1-42b7-bba3-c89cb92f4153", "value": "98304:joNqz/BC/2k5D8aaV8LM6GnJNnBA4tHc231AthQPkSYg5Trp35szVf8D+fzowfst:jQqz5C/54dV8LMBAaaIkS15fpJsg0Uw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788891224, "uuid": "82356e09-84e5-4a9c-8e58-6081f87efbe5", "value": 4798289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788891224, "uuid": "814eac9d-cdf6-48d2-904e-d0ba22ce9af7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788891224, "uuid": "221e35ce-3764-45b6-ab71-9a952743d508", "value": "6b98a99832d5a501cdb2b578dbacd255205b781078b24aa7f90240bcddba4bd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505b7559-aba6-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788886622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886622, "uuid": "7811779b-373e-4c70-80e6-493ce387a2bc", "comment": "Malware payload (Mirai)", "value": "484827950743abb12b067a7875d8adc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886622, "uuid": "93f8f29f-9495-4552-908d-802aadd10344", "comment": "Malware payload (Mirai)", "value": "6c8a287385b29abae710af6b755b8a5a5ad56ede36b3b0d4ca31cc167bbecea7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886622, "uuid": "61044ca8-bd97-4c92-9092-6c3dec0b4193", "comment": "Malware payload (Mirai)", "value": "ac01dc24f73928ff51a2a132b7a87a75528fab00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886622, "uuid": "d49e5ea2-6b78-4f74-b4c9-32a39fc0125c", "comment": "Malware payload (Mirai)", "value": "29c27ee2871e6d9fded79b2c4d62ed67c12ade513030dd6d9417a69a69333fea375619274d060ea019968fa80a740f2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886622, "uuid": "6b6acfb7-6238-4dc6-9719-1eb7f0d6df61", "value": "T1D7832AC25A42CAB3D4921BF915E75B320632EC2A1B2E9F56F77C7CF49E02688711635C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886622, "uuid": "389e2159-a15e-480e-9d6a-518b051054e9", "value": "1536:0cmo1ouFVETMnVvIiN+9Nn1f6ndfwaQy+vjKdUoNXoPEh1V:0TuFVET8VvTNMN1f91y+v2dUoNYPEh1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788886622, "uuid": "b44fdcdb-6e94-48ce-9c7d-61b99e230384", "value": 82279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788886622, "uuid": "f5b5d445-056d-4154-93cb-8cd06235188e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886622, "uuid": "59f2c672-c92f-4403-94b0-68534ebd6ae5", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96400bd1-ab72-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788864406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864406, "uuid": "58afb6ae-f5ad-4648-bb83-c50f73b6e372", "comment": "Malware payload (Mirai)", "value": "dc549d2fe0f0e518a5737bdf2c25a7dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864406, "uuid": "945e8115-40f2-49e5-b23d-ca325a3440f0", "comment": "Malware payload (Mirai)", "value": "6d5c8c504122fa391a42334e3361b721b5ed0750acba9635e1c7a04cfeb52d38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864406, "uuid": "3b2e1807-ae4d-405b-bbb6-a602159340d5", "comment": "Malware payload (Mirai)", "value": "8bf43dd84649b19441c2c03f9c815a7b0ec76f12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864406, "uuid": "468ca10b-48bd-4be2-9845-d2c79ae32125", "comment": "Malware payload (Mirai)", "value": "4e3a6f92dbb1304f7468d5238ee5a9c7ea3780b339bf79846e234c434b6efd6ab0a2346e115c26b4edb949b70ff558df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864406, "uuid": "354b7d81-2f33-48ff-a980-dc2af90c20ee", "value": "T15C432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864406, "uuid": "90c08a31-73c6-4b00-91c0-09c7e309175c", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwu:RqtmZPuutfbltZFBSJsBcfDSTFI+BEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788864406, "uuid": "2ad24485-f8fb-4eed-bef5-cea19034347a", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788864406, "uuid": "a1556b64-842a-4177-b978-35f9c964d509", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864406, "uuid": "6a05a1c7-fa6b-47c4-af6b-81b1353a2e42", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c869429-ab37-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788839022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839022, "uuid": "6c3a1869-2300-439f-8d02-eb379539e247", "comment": "Malware payload (Mirai)", "value": "50a7b657e5d2332dd6fa263aab80af6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839022, "uuid": "30635168-878c-4b0d-80f8-f8d0a47c1b9f", "comment": "Malware payload (Mirai)", "value": "6dab1bd1df4eb32dcf41a8f6bfa400bf08ecce1fb0803f5b9ffa09c8ebef4ee4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839022, "uuid": "a1a9b990-799b-46c9-922b-79acf1b2c8dc", "comment": "Malware payload (Mirai)", "value": "23ad0880dfcb524ea6ce9a8798d0188d7f6ac9d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839022, "uuid": "5a925947-be8d-4866-8ac6-7f15fa8bfe9b", "comment": "Malware payload (Mirai)", "value": "02a2a04a8419a727129b8b14f1ec0a6207884348b95cb3dea87ed2a82dfdf1792033140542179ae25c0f50a91a0069ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839022, "uuid": "d7f66470-71f7-43ba-9604-10b1a8724e07", "value": "T197C3129FFFADBBCFC2DF887AE55334028A51C1642723E9E86738303A475569A5008756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839022, "uuid": "53934e7e-4af9-4017-b6d4-4ba02882ae5c", "value": "3072:tTNbBGyEoxrm4tJ20pwwbw4FJDDhgurvEqErHFLa5OzIoutb:tTLHCRj0w4FhhtjwHFLa4zIoSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788839022, "uuid": "f3d928c7-63d9-4788-a443-6928016c4f2d", "value": 121816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788839022, "uuid": "2ed36251-3088-4dfc-afea-7b95043df3c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839022, "uuid": "1de57d2c-1b2b-4267-b098-dbe1191f8198", "value": "6dab1bd1df4eb32dcf41a8f6bfa400bf08ecce1fb0803f5b9ffa09c8ebef4ee4.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7ccb63-ab5d-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855422, "uuid": "8542c87c-d607-4d0a-9d6c-3da9c20f8a7a", "comment": "Malware payload (SilentNet)", "value": "b6cca65b81bf5d77750538070fbefc04", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855422, "uuid": "f39886d9-09ec-4e46-ae27-b6dc3e149553", "comment": "Malware payload (SilentNet)", "value": "6f43098b1eb1967614f2c261157c3f3c8bfaed7ebc8c624ce2cae4962aed019a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855422, "uuid": "38a25572-6dff-4123-b453-74e2b9fc7ddd", "comment": "Malware payload (SilentNet)", "value": "fec4b259d1d595c224276936894ad58628229c59", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855422, "uuid": "a841b470-230a-4ef4-a337-172e8b98b302", "comment": "Malware payload (SilentNet)", "value": "6b2052ac8f06381c42c2ce6c148348eb4515cc99603973c87cde13f6bdab8e1faaefe15b30a2fe0dc07181504227295c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855422, "uuid": "fd798f3d-2637-4918-9d1d-64ebfb0bbe2f", "value": "T1A0963376E954183EC6E7F136E422DF93A63D2FA1E21DBD2F85BCC0571089C980B51B29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855422, "uuid": "ec1c3bfd-9e78-4802-8c45-cf0f269e5d90", "value": "196608:JzEEW6uPpdnmHrtYY7Y+muXfynJaa7Y/Hk85rGj:JYEW5BOrtplmuvynJaa7Y/Hf5rGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855422, "uuid": "2ed0ebde-8ff3-4ca5-89ea-8dc0ea9adf36", "value": 9365777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855422, "uuid": "fdea2610-6cd0-45f0-a863-b449b5f9eb21", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855422, "uuid": "d8fcaf70-0f08-481e-b43a-fa83a0ca05c5", "value": "anamvmt-1.21.4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "532ddd56-aba6-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788886627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886627, "uuid": "39f087fd-4f6f-4371-bf9c-41c1ae5b41d2", "comment": "Malware payload (Mirai)", "value": "9e1d123511abcb34a4028941da0dbdbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886627, "uuid": "f055e31e-a7e9-42a4-ac65-6e8effb28038", "comment": "Malware payload (Mirai)", "value": "7057e30367a3531968c465b69eb386aa86cf2396d45a04f52a32cf762e998a0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886627, "uuid": "098af530-8e80-452e-a93f-907418c6c891", "comment": "Malware payload (Mirai)", "value": "8de39eff9bd24c84fdc01d46d858a8f57c114ad7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886627, "uuid": "6b424f5b-a9ff-4abd-a1cb-28bbadde1de0", "comment": "Malware payload (Mirai)", "value": "0e552aeda8f289c1cb60ea7d052f6f396177cfb8bf07aae52735ba3d13f5a705d3efa33382485eff4e1b21397c8225aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886627, "uuid": "4a4e6ac3-2631-435c-8f33-b4e209d33661", "value": "T1AFC30803FF91DEB7C45FDD370ABA870124CEE4262660276A7274D9AC761B58F09E3990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886627, "uuid": "218745ff-6606-4c04-b77a-c86b3be38fbd", "value": "3072:w5Fu+y7c2TJRljCKZZC2qqvbYUH/y7WfHn:w5E+y7NJ3CnqvbY0/y7WfHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788886627, "uuid": "673377ba-8d7d-4aa9-bf71-8663e9081447", "value": 119157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788886627, "uuid": "b7e2b76e-8bf8-44d2-98b9-df0e0f5e0037", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886627, "uuid": "6abc9a57-c8bd-4179-8615-40327948d773", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9729995-abb8-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788894556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788894556, "uuid": "1a1cc026-9efe-4549-acd6-b3521904310d", "comment": "Malware payload (Mirai)", "value": "46572c2009554e60305cac86505ab032", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788894556, "uuid": "8b9f9bd8-9e92-4958-9095-ac623078e0c1", "comment": "Malware payload (Mirai)", "value": "705a7fb8baae3f0aabe0145461e774b139db35bcc94b99d9378fa31d787f2e3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788894556, "uuid": "a619ac34-e9bd-43c7-9ec4-9fe8c14e0898", "comment": "Malware payload (Mirai)", "value": "e5c264ae5dd3dbaf2bb1a19c29810f7bc2576fc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788894556, "uuid": "e5d71062-9135-4a1f-be32-489e37ae8c99", "comment": "Malware payload (Mirai)", "value": "7f89a5cdf8eb331815dcf6176891916ec7e2e39a2b38ca4935136ced43dd41288dc7a918dcec80475f7a3fc0dc657e28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788894556, "uuid": "b5829693-4e8c-4675-9b06-8b26e198c67d", "value": "T15533F100A96D49FAD75D1870BCAF9113A23BC9E840E4B1E717511D272FF13477DA2ACA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788894556, "uuid": "8e20d294-6ad6-4f26-ab4c-28977f64b340", "value": "1536:b3OoguMF8XZsT5nhFalYhZA2P7RD3jddJZGwFRqW1NsDQDSg:j5Mka5W+blLjjeIqVUeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788894556, "uuid": "eaf0bf97-ace8-43f2-9d7b-5debc418f14f", "value": 54204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788894556, "uuid": "3fc89cef-5dea-4104-8c47-2f0ba50d516f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788894556, "uuid": "d1007660-996a-4955-a086-81f88e6ec11d", "value": "705a7fb8baae3f0aabe0145461e774b139db35bcc94b99d9378fa31d787f2e3f.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7e6738-ab3f-11f1-915e-42010a9c000a", "comment": "Malware payload (Formbook)", "timestamp": 1788842270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788842270, "uuid": "bcdf5d5c-32c4-4985-90f4-bf4e0347c220", "comment": "Malware payload (Formbook)", "value": "e45854dafbd4ed038beae32400d9a2f3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788842270, "uuid": "797a95d8-b449-404f-8f03-ce42639a7b17", "comment": "Malware payload (Formbook)", "value": "726cab44778287b5eb19330c29f999db13f2ec4df74921e699baca7b3bbcd89b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788842270, "uuid": "63097124-41cc-452f-bd1d-4cf180178b64", "comment": "Malware payload (Formbook)", "value": "09d1a7e3aa978c954e48d8609b5c5db014e0ff64", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788842270, "uuid": "36a5b34c-19fe-4a55-9b4f-0f941c2c1459", "comment": "Malware payload (Formbook)", "value": "c72e57ca93797e824304a467ce4dd1de60db9fafc52e613a4db974b80b661b277189c204172e50aa91b0481d6561f894", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788842270, "uuid": "e603c677-6cc0-48b0-a0d9-ea167f725778", "value": "T170E54BFB35E969C51E24324EC0AE6E1B4787C4140D63F5E438EA4DC8E90F99B17906AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788842270, "uuid": "c4e14ae8-8ebd-4174-a0bb-cd8375500485", "value": "24576:WrArqgHMzw/Jwe1f2eq/UsdJcvZI4/4EhjAUEXW7wn6aB:QArG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788842270, "uuid": "7e43e959-0bfb-4bc2-96ca-0afaae5f3ca6", "value": 3108197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788842270, "uuid": "5eca8e48-756e-41d4-bbbe-2b511c8df91c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788842270, "uuid": "740f43d0-2081-4056-9312-d51a8828ea6c", "value": "MV_SHINNING_STAR_VESSEL_DETAILS SAILING_ORDERS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276f14b6-aba2-11f1-ab4f-4201ac107002", "comment": "Malware payload (SalatStealer)", "timestamp": 1788884835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884835, "uuid": "5f7b6b52-1ba2-452b-98f6-cdda10169ded", "comment": "Malware payload (SalatStealer)", "value": "697277a9582579cb2184475c82064e55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884835, "uuid": "f119b56c-5e34-4d17-9cd8-9f8600d9ff50", "comment": "Malware payload (SalatStealer)", "value": "732416c64e26d9547615835d81dce1b617c8b7f8b7ce04c7931c1b2c96d19085", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884835, "uuid": "e43805e2-b52d-41d8-a862-5f0a470a7148", "comment": "Malware payload (SalatStealer)", "value": "4ae9ed058b6d109b17ea9e308fdb759fc4b04191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884835, "uuid": "64db524e-93f0-4352-bd9d-d389af4769ab", "comment": "Malware payload (SalatStealer)", "value": "769e28b9da3f89ebe7add6a335700d92d13250d8fc44fd1bc1a7189d56824af0ea99ed4c5a8546a8a14c2b156913eec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884835, "uuid": "ef0312bf-4a84-4b09-8939-5e4bd9cc2ebc", "value": "T113258E15F6A918F9E937817CCD424902EA727C164761EADF03A04AA72F277E09E3F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884835, "uuid": "9b56f3d0-a733-4464-ad5b-c408ae8a738d", "value": "2fb7473982051d3615c38155fe72e9a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884835, "uuid": "3ac04a69-fe07-4b9e-9d4b-7fd9094f93b8", "value": "3072:P9wwLK4XWVLlekstK6xpyQ1+yiS8iSSCAdLb3vV/AQo31ylQiGGNHe9JXzrsxvCv:lwEO8NxD5mgLGGwJDQVbwqmGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788884835, "uuid": "00e4412e-b8d2-4492-b549-d63f6a117f4f", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788884835, "uuid": "48831c14-3183-4645-a770-c08ea7067c39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884835, "uuid": "947a7ddf-981c-4947-b417-a9bbd3fdd8aa", "value": "Bootstapsrer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df897333-ab31-11f1-915e-42010a9c000a", "comment": "Malware payload (SVCStealer)", "timestamp": 1788836611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788836611, "uuid": "f4aae2b8-0545-4caa-9065-5f1c5a806db4", "comment": "Malware payload (SVCStealer)", "value": "8a63c713e2a99ea3765da3b394d58d82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788836611, "uuid": "4a979782-3cc7-43d3-ab5f-73cd8c336c91", "comment": "Malware payload (SVCStealer)", "value": "73bc2ee1c189d5798b8006db976f07ea7f21be8c7f8e4d810e1ac5f7aeb4aa5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788836611, "uuid": "71f7e7a6-9cae-471c-8889-fc118af83971", "comment": "Malware payload (SVCStealer)", "value": "3495623275283f50a424883199ea9e3080129e6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788836611, "uuid": "6d37351b-03af-4bf7-ab1f-b20f94be0187", "comment": "Malware payload (SVCStealer)", "value": "639207e825747f8737afb2b7eeeace92c0f2831d3211e3fb5e51068cc7b0d1498737ba5a33ee798791ce6a6ea0d401c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788836611, "uuid": "cdd39587-ba22-40d7-a6cb-b81c7183c7c0", "value": "T1FC43092653D687F9DA369239C9B9A32FE270B5C3B830131F0360D9191EE3A51B55CBE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788836611, "uuid": "780f4477-e713-4720-8064-c87c51b3822d", "value": "1536:x0QtRj7J0UVqkMMV6ITsgXbxyaPUalTqlQaKWi4U2U0TDa:yQtR7J0UVCbIZXbPFDaa03a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788836611, "uuid": "e94e1319-6b8b-41ad-97a9-abfc9b7d07f0", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788836611, "uuid": "41e09695-1f27-483a-87d4-b54ee6801b53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788836611, "uuid": "f1eb8f1e-5598-4a05-aaa0-a26173151f33", "value": "73bc2ee1c189d5798b8006db976f07ea7f21be8c7f8e4d810e1ac5f7aeb4aa5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418c94d9-ab84-11f1-915e-42010a9c000a", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788871994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788871994, "uuid": "f03c13f1-7a38-4679-8e41-b96a73c6a424", "comment": "Malware payload (AsyncRAT)", "value": "bb4d80f99163d1e8700004c0716293fb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788871994, "uuid": "89cffdac-a4c1-46d4-999b-de67bd017b9f", "comment": "Malware payload (AsyncRAT)", "value": "747e7392a25f5ca1b7e3672bc3ebf3db91a79b938ecb476f347b642a939fc981", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788871994, "uuid": "013bc8e6-4b8b-4272-b66e-e93e72087705", "comment": "Malware payload (AsyncRAT)", "value": "ef8c35301b839340e6f5a4e3f6c2c5e932e1c4ac", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788871994, "uuid": "23d3a3ec-2220-4e0a-97a8-6f3bdb6ea5d5", "comment": "Malware payload (AsyncRAT)", "value": "729060cd49d3be305352450447159c8b50674c0032653b87fab5f1ed36ae6ee2366c151851ce7bd6d08c9f11fbd73099", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788871994, "uuid": "92aeef38-b3bb-4b72-842e-7437daba66e4", "value": "T16A834A00B5D1C179D9BE18350868DA715B3EBA10DFE0DDEB3B9506AA4F302D0EE35A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788871994, "uuid": "fa56d2d6-b033-4130-a2b6-80bf0313ddd2", "value": "362f72161661d37142138c8a2e25e2e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788871994, "uuid": "34c19827-1204-48e0-8ca3-5a59b9d19f2d", "value": "1536:6XZ4kckAKCDUOb+n2HLsP5VUNFyHNrgQGPybQyZgvdsWDcdw79bljiJm+:OEkAqOb220VUcMQGPydqCw79bljiJm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788871994, "uuid": "ca741a97-addf-428f-bea0-37c8c2100736", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788871994, "uuid": "3e91071f-c816-4626-b916-bded5fad6410", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788871994, "uuid": "de6db026-5d01-4782-8eef-2dae6c941db4", "value": "TenioDL_core.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e45c4f-ab5a-11f1-915e-42010a9c000a", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788854171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788854171, "uuid": "d09d023e-74e2-4ba4-ac65-5b1f20ef0be7", "comment": "Malware payload (RemcosRAT)", "value": "d47d6dc8386d6a33a854c7c4b2d0b434", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788854171, "uuid": "d744d834-b003-4f8b-89cf-4b696416026f", "comment": "Malware payload (RemcosRAT)", "value": "748657ebfe11d1cec755c3bd9b5b1daed92d830053de3ddb156d2f86545cbf29", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788854171, "uuid": "99aad1bb-422d-4dc1-8427-e4745031b733", "comment": "Malware payload (RemcosRAT)", "value": "0e9d212546913bd4778434f94417b4d9c7d5c9e0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788854171, "uuid": "0887d438-4f73-4cb1-abbd-80ae2067b373", "comment": "Malware payload (RemcosRAT)", "value": "11c8325be69332ca39e15f9da8c1576b6ea175bb3a66dae780063e35905e722eb701503766fad6a62ead4ee0de2db64f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788854171, "uuid": "246946d5-fa90-4bf0-a0d6-fccb834c2f37", "value": "T12725129098D5E8714DACF32C1BA3AA4C473B6AEDE7BCD0CCD95266C60365B0286D5C4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788854171, "uuid": "d71d21cd-876e-49c6-b3a3-97b5ec711da7", "value": "24576:WvJJD1tK5QZVIht6wio2MaZCPO67pS2C0WdYEX:U/jLgZHOK60Vg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788854171, "uuid": "fa0baae5-972a-4d50-b894-5ba68cc55ef4", "value": 977363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788854171, "uuid": "a1988482-b5ea-4b9a-a32f-b7b9e24ec483", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788854171, "uuid": "e242111d-91e5-4fc9-aabb-794869b98a80", "value": "task.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6dc3ae-ab21-11f1-915e-42010a9c000a", "comment": "Malware payload (Vidar)", "timestamp": 1788829712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788829712, "uuid": "51161200-0738-497a-ab17-7624946da84a", "comment": "Malware payload (Vidar)", "value": "25428edf5bd032f05d4e41182452c2f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788829712, "uuid": "44d9002b-7e30-41a1-8d78-fd19ad6b6ca0", "comment": "Malware payload (Vidar)", "value": "753a84b4dbea8e8465de3aefc89b008f96c1d6a25215e8af5bef7676d298505b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788829712, "uuid": "ebb80a95-bcbc-43ae-b050-b2f6a70c92c1", "comment": "Malware payload (Vidar)", "value": "2265f0b568673728c270ba799e912f13ed61ac80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788829712, "uuid": "cff2734d-e8a8-4561-9341-f36461d0b13d", "comment": "Malware payload (Vidar)", "value": "fbea6ca29872aec1d9686dba9a9c468a37223b3c07df99afb973a61b6dcedd93af00f2c4dcdc9235bf6a503841427dcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788829712, "uuid": "8d7176a4-1e63-492d-8826-d8821af14323", "value": "T1E0366A03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788829712, "uuid": "cbc087e1-7d63-455a-915c-876da2feeee8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788829712, "uuid": "51f499c6-86ff-43cb-80d5-b1ff2f7b64e0", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaaD:uc3XND1aJrCOkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788829712, "uuid": "6c686587-4826-48d3-b421-6de28bcd94b1", "value": 5001499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788829712, "uuid": "0fb473b1-52fc-41b5-afa8-595dd5e24f31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788829712, "uuid": "4fe0efca-8b47-4b07-9071-6b182c443465", "value": "753a84b4dbea8e8465de3aefc89b008f96c1d6a25215e8af5bef7676d298505b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b7afff-ab64-11f1-915e-42010a9c000a", "comment": "Malware payload (ConnectWise)", "timestamp": 1788858548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788858548, "uuid": "91d48e1a-7203-41e2-a15c-c4bac31fd4b7", "comment": "Malware payload (ConnectWise)", "value": "d09aef0cc5ea6df8f03d2180db7780f8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788858548, "uuid": "5d2ac4fa-9d19-4ac7-8329-1ed38dc31042", "comment": "Malware payload (ConnectWise)", "value": "758f479a8b141a1eaec3ec5a61bf9787233b9d446096d995400c54ac4c01e165", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788858548, "uuid": "da5ad389-d314-4ccb-97c5-2b10dfa75f3d", "comment": "Malware payload (ConnectWise)", "value": "e39dd3661bdf41cbb252cfb27d20d96f05aa1af2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788858548, "uuid": "bd126fdf-7c3b-4a56-812f-59150967fdcf", "comment": "Malware payload (ConnectWise)", "value": "a45c5ead7cb098b1f851b2fabdc37c54e8e2b447a559625545d9d098da098a24ac701ddd9a6a8cfe5821c8f74323f184", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788858548, "uuid": "be30e556-ad12-446d-bc35-9e8076ea3975", "value": "T125D622136BF89E67E0B1DB74FF365464A7277E055922B1EE1214790E2F70A8089A3337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788858548, "uuid": "687565d0-5165-4cc5-9840-d2b5478e7b2a", "value": "196608:/Hxcp9ym3nltDUJVYHxcp9ym3dHxcp9ym3xHxcp9ym3wHxcp9ym3gHxcp9ym32H6:JGplpLGpPGpjGpeGpOGpEGpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788858548, "uuid": "44ea1028-8a02-479f-b6bd-8ad3721895db", "value": 13541376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788858548, "uuid": "7168a6eb-4d74-499f-9694-b525b124cec0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788858548, "uuid": "5e026a77-a958-4420-b69e-1ba22a133c38", "value": "758f479a8b141a1eaec3ec5a61bf9787233b9d446096d995400c54ac4c01e165.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f182c5a-ab48-11f1-915e-42010a9c000a", "comment": "Malware payload (AgentTesla)", "timestamp": 1788846167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788846167, "uuid": "d33c6873-587c-405c-99ac-81faa0d6d867", "comment": "Malware payload (AgentTesla)", "value": "935335798cef23f623dbe580998e950f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788846167, "uuid": "c39f1d65-5fbf-4dbb-9895-f29ada8f03d2", "comment": "Malware payload (AgentTesla)", "value": "75da0bf66f46e65566f18b468fe3b747b371fb854bf2fedc0b6c77ad3984dafa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788846167, "uuid": "6150baa5-73b0-48e9-8eb1-b4f94c948e1a", "comment": "Malware payload (AgentTesla)", "value": "2ea7000b7ef204bdf1ad10180f0b7598d32a7e3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788846167, "uuid": "81572670-3d51-4f69-aef6-c0404488b899", "comment": "Malware payload (AgentTesla)", "value": "f9a36f57ab04edaddb93a0f363f3cc794e7b9dbe853096ce21503b6932161fa637625c45ad6a5c9e5b8901df2b0c5dfb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788846167, "uuid": "a38c2029-9805-40c0-b979-c6167fe4ecb8", "value": "T1DC35DF946617DB37C46177B0CA73E2F402692E99E801D23F5AEA7EFB7F74E205910242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788846167, "uuid": "887f5df2-2af8-4601-9a88-54a6538abbe6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788846167, "uuid": "307255c7-b4fb-4c6f-ab0d-2c88511ed8f7", "value": "24576:rWpq85CovDkC8I63hFeMhN0ZjxOzBhGGqSoJlGjG6TZ2J:rW35JQ3hFQZjxGhMl8Gi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788846167, "uuid": "64298dbb-375e-402c-b98c-49946dc6862c", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788846167, "uuid": "86c39c50-4e64-4f3b-90ef-99b6fed97b17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788846167, "uuid": "56dc17e5-b465-425d-9ce4-94c9acfbcbf5", "value": "ONE_GZ_USD_Invoice_Verification_12345678901234567890_BL123456789_USD25000.00_2026-09-08.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19b5718-ab5d-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855459, "uuid": "dd68fa79-3eba-401c-8556-05631b7e1404", "comment": "Malware payload (SilentNet)", "value": "ad6f8b11259f5209448e9079e9ce601f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855459, "uuid": "7840ddd8-15a2-49e7-b7fd-0c036c0b3f28", "comment": "Malware payload (SilentNet)", "value": "760437e23a7b1b6f9cc79d3088dea18ec710a29c107be94507331855fcef656b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855459, "uuid": "3be4303a-d373-4f6d-a7c5-edceeba05245", "comment": "Malware payload (SilentNet)", "value": "a1efb42500ba0bf3b0080afc3ba4ba3c8d0ce7d7", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855459, "uuid": "9ac82c68-bd55-4a3b-90c4-82d13ce7273a", "comment": "Malware payload (SilentNet)", "value": "5ee410d643f0073190a1dfc1c4646fca761c7cb7c50d1064e33c43f5b4c39139e50b4ccbe0ecd361ba532c600f188a03", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855459, "uuid": "cef26972-0fde-48d3-8c92-5386e89f5559", "value": "T1D8662352F10CE435E0864272A8454A673A3987DED54FD62266F436BA2ECB8677FCC30D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855459, "uuid": "a6d02b7e-a6fb-47b1-928d-6c1d90180453", "value": "196608:Y1W6a/9rqAwbruPtsi2fSh8nr8PHaaOBgK:Ysh9rqAwbr8tF2fSQ6egK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855459, "uuid": "35991ed0-cab6-45f6-91b1-54cc9554452a", "value": 6742451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855459, "uuid": "b6cd3448-41c0-4178-9c0b-f7b22c5cca79", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855459, "uuid": "1938773e-a8ee-47da-b0e5-2353b63abaeb", "value": "NoxxClient-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47dcb597-abbc-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788896057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788896057, "uuid": "34e1a3d4-f12c-46cc-98ad-536fbea7af7a", "comment": "Malware payload (Mirai)", "value": "9f42dd29a3b5696bfe9bb847a7bcbc24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788896057, "uuid": "46c3e418-b994-44b0-80ba-ece760bf5046", "comment": "Malware payload (Mirai)", "value": "7622ea1ebd1e04d862e1e5a81d574f5cf83d068e8dbb09515489f598b91271c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788896057, "uuid": "d2a9d61e-d394-4de8-922d-7f1d8c4fb674", "comment": "Malware payload (Mirai)", "value": "1f1be63308c5e6c16cd85133bc261d93a8f3bf0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788896057, "uuid": "f9383a3d-a46b-4659-9dae-e26ca630a99a", "comment": "Malware payload (Mirai)", "value": "9481a4ade54813fa543c5178453c9405359f5e857985947ec4bd12961566bb4ebd6e3f36663db05d64cef71deda9d314", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788896057, "uuid": "573b8058-84b8-4266-83af-ffe29243ac88", "value": "T1E3C35B5DEA0FDDC1D2C5D27AEC594F93733A78944360D3B21A00A26DECDBEC98CA1562", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788896057, "uuid": "f806d558-b8be-4239-a04e-5e40270ad59f", "value": "1536:bfJbxYapCcc/iKiVc9Lv7hB1fM1SKgyEUSwwQPI3cK6X5u6L:bfJKlc8i+Lv7hfpSOcKkzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788896057, "uuid": "c1185fd0-b92d-4715-8da7-7f16505e1364", "value": 118392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788896057, "uuid": "648d4049-7dcc-48f6-b3d9-000d6545dc4a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788896057, "uuid": "db08795f-d385-46d5-a683-15870054260c", "value": "aa2ea714e084456216408dc0aa127e920c4c9e2fbca59d203d6395618f6e69b9.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b93701f-ab38-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788839343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839343, "uuid": "73e3759d-9e12-488d-b907-d702f9d6e0be", "comment": "Malware payload", "value": "652932043ac6804e348515fc865a6428", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839343, "uuid": "e3334b1c-ca75-4a50-bb36-19c941567a67", "comment": "Malware payload", "value": "770783964abb973501161bcb0cce94641650d712152d18683040cd5394127078", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839343, "uuid": "6b495c63-27e9-46b1-9afb-8c0ccaac5ab7", "comment": "Malware payload", "value": "b454c0730129e522e4a70b3c957815607b390ebf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839343, "uuid": "7e39a6f0-311b-42f4-9d6b-53c4e8ac0be8", "comment": "Malware payload", "value": "28290a247a56d8f3d361ac3eb7bd54286adaac0f10ba96e1588947cb01abe7cabe04e4769c57cab672079bb618c3a70d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839343, "uuid": "e78a7be0-fde6-4682-a976-d81b30145b87", "value": "T14F84D047799266BCC03380B88607B956693ABC481730C5FB27E27F6D3D769E249B3631", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839343, "uuid": "d4cf24d0-f12d-43bc-b55b-25a1c17e6757", "value": "5a0c2b5994c133b0104c763e63cb8eca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839343, "uuid": "20aedcb3-84ab-4868-8df4-9fd665ed9beb", "value": "6144:9K56J2luf7Zs+iqUccickm8ZDFIZ/SHxBJxwfMW99whpEDDMms/gqlEUMs1209k2:9K56Mluf7/WgRO181gqltD009kG8nkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788839343, "uuid": "e82395b7-fd1c-47c1-92d9-eae906ba079b", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788839343, "uuid": "ed43e320-c72f-436f-8197-96677f4d6561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839343, "uuid": "2a7a771d-7ec1-45c6-91e2-b10d9554870a", "value": "770783964abb973501161bcb0cce94641650d712152d18683040cd5394127078.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f737b0-ab23-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788830520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830520, "uuid": "9875ebec-47d1-4105-939e-bb04657332fc", "comment": "Malware payload (Mirai)", "value": "8f242e579fe4676c9da032003eb8513e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830520, "uuid": "499b57a5-9845-4693-8eea-b530906ac773", "comment": "Malware payload (Mirai)", "value": "772da74caf28a60eac05e19bba793d81d9d9a91e3ff14166fc13958264ee2eb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830520, "uuid": "233ee0d5-0335-456c-a05f-278063782b77", "comment": "Malware payload (Mirai)", "value": "9bee36823f100e5475bdd89a63baa241ba348dc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830520, "uuid": "62f0034c-33c2-4730-81b4-52ff6d6087d1", "comment": "Malware payload (Mirai)", "value": "e4d06ccb1b3e742d54e486dbd13f07ca40f02d59facaebf085c8cf231703807de352fbbd5cf6a68983b2a232c4c007c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830520, "uuid": "29e3f463-8635-4b61-adf7-65e5edb99566", "value": "T10A94494779E1287ED0B257B345D3D33C7273D2274A47858328276FADD982EA69F01AE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830520, "uuid": "91d71d49-52ca-4a86-b18a-fdfd11aedd1f", "value": "12288:VgxHQ1868TylWGSaCx4SMwY7nZnu/03ki:VTjPEnMwY75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788830520, "uuid": "fcc12ea7-173a-421a-b63a-87d3420a4348", "value": 424032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788830520, "uuid": "a09fe116-a823-407c-bb40-ed4ce195536d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830520, "uuid": "e5e2e728-4147-49de-81ce-0248083db7f1", "value": "xtensa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3ed452-ab5d-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855473, "uuid": "3dd9587f-fa66-484e-bd3a-31eac1efff8b", "comment": "Malware payload (SilentNet)", "value": "1baef8fcac5d4d41dcc2e7f444d84ad1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855473, "uuid": "7bf86cd6-b6e2-4078-b0b0-941ba9981636", "comment": "Malware payload (SilentNet)", "value": "77bbdba3166915999780ba8e419d0adce2202a5f22e2e23a49bc387d2c827ee6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855473, "uuid": "d2e8f946-8fa3-46ba-999d-35865cac22ce", "comment": "Malware payload (SilentNet)", "value": "bd10c197a6f335fc041d0b2b597ebefc2143581b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855473, "uuid": "5161668d-1a12-47ec-adc8-f99dd662376b", "comment": "Malware payload (SilentNet)", "value": "6fab62524ef0215a66bdde1cf8fe5bdd598f0aef238553241296a3b242cb54ce35383b17c62f61a58b63a5837e212b04", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855473, "uuid": "40fc670f-8db7-481d-bf3b-92ab0db80136", "value": "T175B5239AA15C85B5CC2F7273B3218EB2D98F058D8509F07602BD05CE04D7DE857AEAB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855473, "uuid": "093b13b2-eeb1-4ca0-b6e4-cbac6caf6160", "value": "49152:e2XAk8j60r+pjcup2YYNy+582DLtpoJeXek9Sre:JAk8PKdKLoaeVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855473, "uuid": "4b325160-2451-4c4d-9b14-bed6c5ccf37d", "value": 2350167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855473, "uuid": "4b80edb4-b000-4ae9-adb9-ba502a692672", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855473, "uuid": "1debadd5-80c4-4c04-83dd-fdd44813a125", "value": "waterclient.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "488dfd38-ab39-11f1-915e-42010a9c000a", "comment": "Malware payload (Gafgyt)", "timestamp": 1788839794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839794, "uuid": "3c3fac8e-34d0-4c25-9202-6369458baff2", "comment": "Malware payload (Gafgyt)", "value": "b85edbe3795e236b12e617428fce1d7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839794, "uuid": "b5c0ffd8-95ad-47ab-81d1-21b93f19449f", "comment": "Malware payload (Gafgyt)", "value": "77d85298859c3d346dcd4fcbc127e6ead3c1f9de68adb5d5bdc732aa6639f8bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839794, "uuid": "3f88c611-3838-4baa-b133-f71a22777ca1", "comment": "Malware payload (Gafgyt)", "value": "d9dd6546c1d1056eae944bdbb1ac277655af730b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839794, "uuid": "34678e02-ce19-4d5a-aaf8-55247beabc61", "comment": "Malware payload (Gafgyt)", "value": "cf64283d23304ba649d164c13f78ba26e4d72833413164644042487fc6a34029721063e7d8cb631b18a2d477696297a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839794, "uuid": "4a24ca4c-6351-4ef0-9d59-c2685e13f9f3", "value": "T114B32B40FD548767C3D327FAF78E469D37356A2497DB33116A346DB42BC2B982E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839794, "uuid": "eddf3f32-4411-4ada-b659-6b1ac3ba2edd", "value": "3072:KSo/d/ERYlkGJA2K8RWoyDVEmEmxlqPX7Bb6Yj/m6ciQH3MhE5r6A:6KKTyhHEmxSh/m6ciQH36E5r6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788839794, "uuid": "7f3f33d9-4f0d-486a-b7c6-90171745a005", "value": 113723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788839794, "uuid": "7426261f-b41a-4d3b-b646-acd2f2e88f62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839794, "uuid": "557d7dbb-c113-4630-b9cb-f7f4ac1bacc3", "value": "telnet", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea932fd-abca-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788902215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902215, "uuid": "88db4f81-8028-431a-8612-b48c68826555", "comment": "Malware payload (Mirai)", "value": "8c6e46e0928fde6149de8951842568c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902215, "uuid": "b5997b11-19cd-4ac6-829b-f46582ce01a7", "comment": "Malware payload (Mirai)", "value": "78c765978a0c2683eddafbbcc6e7896bf7172d63a936c602457034064016f3a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902215, "uuid": "2815f331-3c85-4735-ad02-c93f00c6ab29", "comment": "Malware payload (Mirai)", "value": "f6470b1f94778310ec0b8a3e8c111af3b1f65a6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902215, "uuid": "fa99fca1-fb71-49c7-8142-b54dbc9932bf", "comment": "Malware payload (Mirai)", "value": "05e52e1debaeea62e02dc105fc4d211bb4e28fb97a7db96388a83ed1e14825383bd968543821f0a56a1b79145e64fd63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902215, "uuid": "adcef004-cccb-487a-a694-c7181f702ec7", "value": "T1F9A32C80FD458767C3C227B7F78E479D3B355A649BDB331165386EF42B81B982E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902215, "uuid": "06ca6a26-b296-4de2-a0fe-ecd331f62d70", "value": "3072:U9d1uE0Ylk0t58SU8toJ2ei5RUyZB0BmQwiQmvvhMXWyA:6hU8Cp4RUyj4mQwiQmv5MXWyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788902215, "uuid": "ef566c48-ba1b-422c-a797-a0ad5b240bde", "value": 103971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788902215, "uuid": "18d3a4ad-1fc9-4e0e-9470-4918deca7b38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902215, "uuid": "adf0659f-e2cc-488e-8687-f53e77d7160b", "value": "telnet", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f98333-ab2e-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788835125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788835125, "uuid": "07564ddb-cb07-4503-82d4-1a0566f55c7a", "comment": "Malware payload", "value": "ae248aade44dc657e429583d5f6201ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788835125, "uuid": "c72cc0df-703d-461c-8c78-5f58935759a6", "comment": "Malware payload", "value": "793916987b4cc13771641406e035665da609c5f4a1d5269d879418dda1b71e57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788835125, "uuid": "847e5f20-d19c-4a38-99e0-5c07c31edee0", "comment": "Malware payload", "value": "ae0555272bb67a41e46e2ff4dc49ae0655d17c21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788835125, "uuid": "e2f65d25-0c34-4063-937e-f0cddb3c4fd6", "comment": "Malware payload", "value": "3cb68b4fd5f57764146997909915a0c17ac66fd966497b3fd2b522ca09cb2b853bcc1049575f34d088d691dc6b022cb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788835125, "uuid": "a4da3c88-23f0-432a-b89e-7b0912a6beb5", "value": "T16FC5E03FB28B653EE06A5A367A72E210593B7A6165138C0697F4C84CCF254B11E3F787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788835125, "uuid": "8483b3df-092b-4344-8b57-fe3a3ef5d3aa", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788835125, "uuid": "5541d7ff-8f04-4f56-9940-1b97a4d28d08", "value": "49152:iuI2hYnN9oEdXfJcLpeHoKLD8BMrpW03uzP047w:i5OqJcLkbD8BiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788835125, "uuid": "822c313c-285a-4555-959a-817d72c72ed8", "value": 2588257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788835125, "uuid": "183849fc-de9a-40bf-abc1-88746ca5e7a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788835125, "uuid": "2b7ba021-0bff-4ef2-9ade-9863bbb17b2e", "value": "793916987b4cc13771641406e035665da609c5f4a1d5269d879418dda1b71e57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3a125a-ab63-11f1-915e-42010a9c000a", "comment": "Malware payload (Formbook)", "timestamp": 1788858104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788858104, "uuid": "a892a60d-51f1-47e2-96df-6277b55a3290", "comment": "Malware payload (Formbook)", "value": "3593b9b5c55b89625566a59a1db5d443", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788858104, "uuid": "9a9b0252-9458-4d82-ae12-9e7aa7ce7d6a", "comment": "Malware payload (Formbook)", "value": "794ee65789890d66840d0a6a702fd861310eb8e60c8cd1e699d446968b9bb2ce", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788858104, "uuid": "43a73df7-12af-4328-9c09-37384eaa160b", "comment": "Malware payload (Formbook)", "value": "a94b7a0b18e05db111267d75c767356c9df71442", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788858104, "uuid": "f09a4bb1-97f2-419d-8e3a-ee0521245de2", "comment": "Malware payload (Formbook)", "value": "f9d479e114200eec6b03238dd5c105e89e70dd3b51124591e8d75d83e44ff8ee174441c9bbad07b89d39c57a773e1bcf", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788858104, "uuid": "5c64cf52-4920-4260-8de5-79d9b58c2342", "value": "T17BE5D6E63BDE29025E06776FD90E1584076B84690B836CC9F0EE4D9C071FC976690EAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788858104, "uuid": "ae0202e0-cf4f-4f8c-ba41-e5bc788e5cbe", "value": "49152:cIxSR8yNRlCxUQTXOM+z+ZYDioOidrPYtffO93OIOOeO3S4o/ZHLI8vVkRCLwZrS:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788858104, "uuid": "2715cc1c-673c-45c8-87fa-b9f19bac3634", "value": 3256433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788858104, "uuid": "8aecdf6b-2881-410e-8f4f-c2a16b6f6f33", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788858104, "uuid": "cd1c5eff-ec04-4716-822c-7add91b1baac", "value": "HSBC_BANK_PAYMENT_RECEIPT_MT103.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8541d44-ab5d-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855470, "uuid": "04ea6dbc-95b9-4ae5-bf0a-185c4b0d2c22", "comment": "Malware payload (SilentNet)", "value": "47d850bf1b7a1db6eb2c8e1824aceb7a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855470, "uuid": "835a5c46-afe9-4215-b497-55d638e938fd", "comment": "Malware payload (SilentNet)", "value": "7a850294d5b6f9c2ff477899c31f86105c5b9b763d256c21a4a32b562ade0816", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855470, "uuid": "38dd69c5-7680-4402-8638-b02b65197c6c", "comment": "Malware payload (SilentNet)", "value": "153e2a5ddbc0b3b236244fe29c614b7b5a42dc66", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855470, "uuid": "3d55366e-6e22-44ff-be59-23f4a86c4afa", "comment": "Malware payload (SilentNet)", "value": "bfad7d0036ec4b9b66b538ba2f668d149aa9e94a8243d70c33e7d053879ed06da01e29e4748d7bcbd19c0617ed2b0799", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855470, "uuid": "c01123ae-491a-49db-a6e0-cd41ddd76e83", "value": "T10E662353D95844B6E9BB1232D02B0F27F6A801B1D1A630B631BD0FE52486F941F9EB5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855470, "uuid": "95a8501a-6245-4736-aafb-38f544db7425", "value": "196608:sZXxLGhriVZhNMitv1yCr7xacINduf1ji:2xLG2wPA7xcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855470, "uuid": "eb2d88ff-bacc-4923-9ae2-c76dab1d8017", "value": 6584509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855470, "uuid": "8d205c09-59f1-46ad-99b2-97f7f64e1118", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855470, "uuid": "5dc73985-b11a-4283-ac88-8d36fe5012ad", "value": "Velaris2-PreRelease.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6490f54c-abc7-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788900829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788900829, "uuid": "d947f75d-d5ee-42ae-9ed3-ac64689adf71", "comment": "Malware payload (Mirai)", "value": "fa093be2ef23ab1d3851df8c1bc26fe4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788900829, "uuid": "bf0802e7-6a82-4481-ad01-a95a797832dc", "comment": "Malware payload (Mirai)", "value": "7b93ebd36c707e336610fd34e41c17d276b85840b773b4063141a5acd3200027", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788900829, "uuid": "0d8cb093-8931-48da-a871-b786d26c7fb2", "comment": "Malware payload (Mirai)", "value": "305752c6782b809be8080d0ad02c61e7531c88f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788900829, "uuid": "cee90b76-3722-45ad-9bd1-ab23c8d7b313", "comment": "Malware payload (Mirai)", "value": "60637be66254aac97ac56f978e39536c8b563bf0e9886066709e4bea71662b7cfb6c2c06f01a4196d86a52e331dc31dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788900829, "uuid": "19756d52-804b-4994-988e-e4e5963f5b06", "value": "T10433F179C5D61106E937303A3C59380AADA2EA3FEB44D1D58DE0F0B7DEB1AD2175C608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788900829, "uuid": "b7eb9394-1690-493c-80d4-6f72068a4891", "value": "1536:v86r5lBX7b5N1szIIZoIJqIhYMajleO0Wfnouy8jn:Eg/BLb98oIJqI+hoO0Ooutjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788900829, "uuid": "ca7a9609-fbd4-47b1-86eb-a2cdba44deb2", "value": 50772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788900829, "uuid": "c75cee6c-6c4a-4faf-92f5-c3e157b5d321", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788900829, "uuid": "1fd0b96f-ee28-45bb-9321-6f6b784fd317", "value": "7b93ebd36c707e336610fd34e41c17d276b85840b773b4063141a5acd3200027.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e1afb10-ab9f-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788883612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883612, "uuid": "a70a78a2-ced2-4593-aa80-c5b4a35684fc", "comment": "Malware payload", "value": "9da811d1f21f7eec1faaa22d43c45b9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883612, "uuid": "4e6edb16-8a56-42e9-9baa-1e4827b2840a", "comment": "Malware payload", "value": "7c83a1922bb3cdfdef4317b7bd933f2fab4cc6918a1af2e8f27852798f1bc7de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883612, "uuid": "ac63b281-74de-4086-b163-7d761cdf0a4e", "comment": "Malware payload", "value": "adf4a5a87ea7095184bc10136bfdf34a0a692891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883612, "uuid": "584835ed-13a5-4de1-8f00-dacf65c230aa", "comment": "Malware payload", "value": "37fcbc08b8fac657ac49fa2389fb02a74cbc560e36cb1321b4b2d9c25785b3bd34add157246ad4be708dbb1d9678b07e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883612, "uuid": "89a8c1b0-2d27-4ba0-933e-23062e1a5a8f", "value": "T1340833E5B6979CF1DFC0843EEA4010721738BD198A5E31B7E98B41731A3967CA46872F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883612, "uuid": "7bdb52a9-019c-439e-8736-83ec3fc71df4", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883612, "uuid": "7ec9b130-0581-4968-a23b-53aba32c0c45", "value": "1572864:7ejOYfafhKX+sIF++Sb3yRb05G28rEaFWTvefNc/37:74Gh2F+Szy5SIFWKuv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788883612, "uuid": "638f5dc1-7678-4efd-9f36-4cb7f1614cb6", "value": 81107189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788883612, "uuid": "ffa312cd-4ece-4c20-a235-1688c72f2628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883612, "uuid": "cb58dc41-c532-4b79-93d0-a0458bffed4d", "value": "install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314aae77-ab7f-11f1-915e-42010a9c000a", "comment": "Malware payload (MassLogger)", "timestamp": 1788869820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869820, "uuid": "5a85103d-bf79-4f63-95a5-98bd26ef8719", "comment": "Malware payload (MassLogger)", "value": "c83902c8a82924213e2057605d292258", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869820, "uuid": "5694f4eb-69f5-4e1f-b6e1-8c4bc588243b", "comment": "Malware payload (MassLogger)", "value": "7cc79c56e65205f98fdb5c0b1f6e3f3d971cdf0d9ac4dc5678b929c19f1062bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869820, "uuid": "e3186a68-64cf-4a3d-b924-2e2a383c9afd", "comment": "Malware payload (MassLogger)", "value": "e05f50bfff8caa536c02d36ff9387b93db4a3da2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869820, "uuid": "8a41a716-9c81-47b5-85a3-7a267aefeeb9", "comment": "Malware payload (MassLogger)", "value": "b60e91156ea0890b282b28a94fd8a92a96f48557dfce49934ce5f086f4e0acde49cca248fb7bdf2ca3b55e6e53632f1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788869820, "uuid": "503f3183-1f74-4793-9a67-5997d24c0224", "value": "T1AA15BD582617DB37C56177B4D9B3E6F012641E9AE801E23F5AE9BEBB7F31E305900242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788869820, "uuid": "9c0217c3-f316-415c-a6c1-4c41400a15f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788869820, "uuid": "c1da0bf7-e5cc-443e-a83d-0bf6eb46cedd", "value": "12288:uLrp+4moClH1bzJsDoKx4ri/C61LMMwCzGMJF5rscph3quiqxjJqH6B2JzbE4pZg:ufpx5CR1PyDhquMMhzGMf5L3ziqprb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788869820, "uuid": "df397383-c654-4d48-be3a-fcb7f083fa29", "value": 922624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788869820, "uuid": "67cafeeb-a830-4e32-86d5-21cef1bfa49b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788869820, "uuid": "bb5157cc-bcf1-49fb-a3dc-c08971a3ee24", "value": "New contract_291421.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08da56e2-ab6c-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788861591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788861591, "uuid": "9bedab0f-c4fd-4e6a-b673-c169c95af380", "comment": "Malware payload", "value": "e02ec5d21e5ce285c67370efeeadad5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788861591, "uuid": "903d261d-6d08-450e-b09c-6afc0e39c43a", "comment": "Malware payload", "value": "7da6e84d862ac4605e50d4293100aa6bac4d57b104001937a791c03ec76724b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788861591, "uuid": "1c62fd23-11d9-43aa-ae8c-920c81cd7f0b", "comment": "Malware payload", "value": "221dd4b7f1c181c7f7c9c9f591be8a7f0c840ecb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788861591, "uuid": "b85ff2c4-9f6a-420e-b680-8e83e15c01fa", "comment": "Malware payload", "value": "a8ee6253bec7331bbd16c3220f37a6e068a58560c7ca695c77078a3e4362cf51bcc3fe536e8a467612450c64c31050b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788861591, "uuid": "73de24b9-2e2f-4c72-b6a5-d6f14ab1caec", "value": "T1E8729DA7F02AF4F2C521B93A142419C4FB6364253A438B571AE473BD9DB5AC82D20FD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788861591, "uuid": "c86f4ef9-3b49-4365-849f-2d8c4f103e91", "value": "384:DLu2HCUhIQKNdoNoSgdYiP3nUxaVXALp0b+OM3:XtHNIQK0ilP3hb+OO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788861591, "uuid": "04e1f47f-af35-43ab-8224-89dce759ee63", "value": 16744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788861591, "uuid": "1368ae4d-c40e-41dc-9f02-aee2d44b1c5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788861591, "uuid": "605442ce-d569-400c-a5f3-ec6a67097c39", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9f3074-ab22-11f1-915e-42010a9c000a", "comment": "Malware payload (ConnectWise)", "timestamp": 1788830005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830005, "uuid": "af72f41d-7691-44cc-8929-8b0146baad7d", "comment": "Malware payload (ConnectWise)", "value": "0f2e05992e1eb1032016d044b0f93b37", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830005, "uuid": "6dbf1c2c-e548-4119-93ee-5bbf1612b145", "comment": "Malware payload (ConnectWise)", "value": "7ef03054d3a602d418a382b00f10970148ce87d107f7d06e9fa5da71c8e4d3da", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830005, "uuid": "e3a90226-4954-45f0-ac67-33ce0750fc07", "comment": "Malware payload (ConnectWise)", "value": "61a32c987ed090c54b7470502bb5a615f121c9e2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830005, "uuid": "0232a398-5ee4-40d3-9f37-171a464b50ea", "comment": "Malware payload (ConnectWise)", "value": "12d270cd498ce3752550e6791ec2ff1f55f994e5303f8c27d93bcb338b33c58986707c88fccfedd17c91f8379b6bd0dd", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830005, "uuid": "66cb0a3a-00a1-44a1-a74d-2caaabb7ae74", "value": "T1FF46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830005, "uuid": "2c524cf9-c51a-4c2c-b5e4-6302aa10c7a2", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830005, "uuid": "3163b747-313b-489b-a585-46d021406a9e", "value": "98304:NzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:NhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788830005, "uuid": "2708c05e-6b37-4943-993d-c197269e2e19", "value": 5652664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788830005, "uuid": "4a734dc5-439d-4f87-aa2a-90d7c3aa99da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830005, "uuid": "a5659499-f191-47d6-9553-9a07bc2d25b5", "value": "7ef03054d3a602d418a382b00f10970148ce87d107f7d06e9fa5da71c8e4d3da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f5e175-ab3f-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788842655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788842655, "uuid": "04bab8e6-d335-40c1-8551-d1b59aa8bbd0", "comment": "Malware payload", "value": "80b7fc9677ea7ebcedf12aec0fea61cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788842655, "uuid": "a5396948-dab0-4e65-9b60-65c17e80e1ab", "comment": "Malware payload", "value": "7fd4d923b29136fc2537e156f78f0bcf4371c95b1cb1267a08780811c40aa8ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788842655, "uuid": "8d5ae416-f1a3-4803-8073-2879a2da1e82", "comment": "Malware payload", "value": "715f2a8b0cf927aceec019788321c69b03ce5d86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788842655, "uuid": "89744848-cc8a-40b7-857d-3634e4f92776", "comment": "Malware payload", "value": "ffb8be6a0f19f61738e204c75f3a9fe91ebe848e10ad10feccd46b20f3eb2f97a78dbf649d99ec95d9da698d265ba88e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788842655, "uuid": "3b467aa9-21b8-42d6-9202-89f9cc8b5469", "value": "T1D1D36B4B73E530F8E1768278C4921A06E776B8350B65CBAF0760476A1F272D16D3EFA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788842655, "uuid": "29e14d48-3f43-4270-88d5-5eb2e4e7972f", "value": "e6fc0c4ad0abeac68d4b9e9707122f34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788842655, "uuid": "697918c4-b4f2-481d-8677-6a185fcac13b", "value": "3072:Pi5QPxPkSfD731oTcTS669+A2rF5gMQZOXN4:PCQPxc4xHTS6dAmkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788842655, "uuid": "f61a5313-e216-4e8e-b656-6708373b5619", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788842655, "uuid": "a7ac5883-54f2-4080-ab6e-8dc6b61551f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788842655, "uuid": "49b05807-6789-42b3-ba44-2a8b59e97350", "value": "7fd4d923b29136fc2537e156f78f0bcf4371c95b1cb1267a08780811c40aa8ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a02627-aba6-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788886629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886629, "uuid": "0206feff-b03c-4840-835d-dd1c92df32fe", "comment": "Malware payload (Mirai)", "value": "284c4431ef1c6dad607648c53604b507", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886629, "uuid": "52b6c6a0-cf7a-438b-bbc4-34aed6433ec2", "comment": "Malware payload (Mirai)", "value": "8113b9d71f153627f3dcd057f63639ef392dbd3389f5eea32e7eef3b104e07aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886629, "uuid": "d1c76a06-36c9-47da-8e9b-72e9a1677a6c", "comment": "Malware payload (Mirai)", "value": "a7524b1bb126debe000ad16d06977db480a6e029", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886629, "uuid": "f8eb7c89-3b99-405e-9a3b-efa2cd92db5a", "comment": "Malware payload (Mirai)", "value": "70e7001bfd629ce784ee5b1ece39ae2a2ba2c3b09f8677e89d8146ef6478fd111a2d67f132bafea7ad368f3732c372cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886629, "uuid": "3364fd82-0a82-4738-8aff-d183f6e58903", "value": "T1FF14D70A7F719FF7E89FCD3705EA6705148C640622A87BB6BA30D958F60B24F15E3921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886629, "uuid": "0b52427a-c9f1-4fe3-b279-fb4309f9ed3f", "value": "1536:Qdamz1GcQrKgJ3AnqVVznqSWSl9tkGzAE02KzIo6axQ4RbzDrtEvONSsZL/oM0DL:QdamT+dQq/z2Sl3EDIWRyQSsvtlGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788886629, "uuid": "7761dabf-6cbd-4ead-a08d-05ab3413516d", "value": 191301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788886629, "uuid": "c222df15-1979-4948-b436-84faa64992f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886629, "uuid": "1a417753-ca27-4af3-b026-b96b8427549d", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51174b90-aba6-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788886623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886623, "uuid": "e836e5e9-d4ea-4d3a-af97-2102f4d68ca0", "comment": "Malware payload (Mirai)", "value": "360ea872c10cf47b4d5fb8301fbeb8ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886623, "uuid": "aa9d9e85-a5fa-4a37-85f5-d02d9de1398f", "comment": "Malware payload (Mirai)", "value": "8120fea65552acb805e7db469a6fba74dd87a4fd212c4b53fbb829bc26f174a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886623, "uuid": "a7bd730f-a03a-44e5-acdd-7d4487114956", "comment": "Malware payload (Mirai)", "value": "1ab853e64aa44eba102686ce63e1605a31bab504", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886623, "uuid": "9828547e-4dc8-4aa4-aa54-69df93c23d99", "comment": "Malware payload (Mirai)", "value": "826e418b6caa20ddae6af2d22b3bbefbe0c5c8a529e4f1b645fba458b15f402dbcee01f8690575f964b7a830c8128e76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886623, "uuid": "76e33762-4795-41f9-a863-8be94fde4717", "value": "T186E37D215D793F26C1C9A4BA01F74331B2F6274E29A5864DBDB40E8DEF1A7C4342A376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886623, "uuid": "f35f11b9-1af5-4cf2-b1b4-7a36b75de361", "value": "1536:QoifKtPgNZQeAdM7tX5obpyNqb94fe+cpv1CjOV0r1c54Gl+X0r+haOzYhas2qRI:QoELZKqX56efe+cdf6c4z0dRXG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788886623, "uuid": "86b58df6-8bbc-4351-9bcd-0a89d495abbe", "value": 151644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788886623, "uuid": "c3e4929b-1ad2-48e2-938f-75b1bc3828f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886623, "uuid": "eb234cd3-0171-43b4-b087-f7279b2c67ec", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff992803-abca-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788902378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902378, "uuid": "dbd21af9-46aa-4ccb-90ec-86ab0c46cc07", "comment": "Malware payload (Mirai)", "value": "feae24bdf86c618b9d841bd1b46dff3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902378, "uuid": "e184f649-3ba4-4a50-b720-6e8c98042d54", "comment": "Malware payload (Mirai)", "value": "8127b15b21a3373301672aa6d7b8f3c99014f82b17725303698563a45710dc4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902378, "uuid": "b9db0785-5ad6-4179-9d99-21f3a1d3b976", "comment": "Malware payload (Mirai)", "value": "e6bfe2c97f7ae206996d13cf030acab012f9a4db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902378, "uuid": "dd58e349-d290-49d5-99e7-2ed19c381a0a", "comment": "Malware payload (Mirai)", "value": "cd776032083d11639107310a15be4f0200a708c66df265744edd5641c215d920e0277a4b9bc186df37a4856a0268cd00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902378, "uuid": "974b147b-d4e4-412c-91ec-a0212fd4a2a7", "value": "T18EB33B41FD408767C2D227B6F78E479D3B365A6497DB331169397EB42BC1B882E39220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902378, "uuid": "3f2d965a-df25-4a76-a107-4c79e4b446a2", "value": "3072:Xqd1uE0YlkRt5RiUlaYS6KV5Vyuzw5dm7ZTQOh21JXwQA:RiUlGFvVyu4m7ZTQOhMJXwQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788902378, "uuid": "17e80404-f834-43a2-82c7-91d8861f0946", "value": 110845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788902378, "uuid": "985e96af-07ab-4d04-aa81-1e19651333fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902378, "uuid": "9d01927f-805a-4584-9a41-600cc1d8535b", "value": "8127b15b21a3373301672aa6d7b8f3c99014f82b17725303698563a45710dc4e.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2537cfda-abd9-11f1-ab4f-4201ac107002", "comment": "Malware payload (SilentNet)", "timestamp": 1788908454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908454, "uuid": "555a012a-a68c-4b99-9b29-719dfd97cf8b", "comment": "Malware payload (SilentNet)", "value": "eee849d6486e40e41423d96c8703089f", "object_relation": "md5", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908454, "uuid": "ae42dc08-d246-4471-9067-9633f983a7a4", "comment": "Malware payload (SilentNet)", "value": "81626e1e1cd90448bd07f46ae54efa2e3a0682986a28a11a77d8b436db880d92", "object_relation": "sha256", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908454, "uuid": "5ce876e3-a18a-4b8e-bc2a-c67343cde246", "comment": "Malware payload (SilentNet)", "value": "cbc8090ccffcc6ddeb378343cd45a00d21a68640", "object_relation": "sha1", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908454, "uuid": "444a107b-71b1-45e3-9dce-0edeecf6ddf8", "comment": "Malware payload (SilentNet)", "value": "ce2511a0afc75d52c724bfafcae96eaea4723c0a9786c15aeb5441c780ce9ff04ae6230c6897d76583bb6481fb3a0760", "object_relation": "sha3-384", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908454, "uuid": "a6fc3c6a-547c-4c98-9263-1e9b4ce6ed28", "value": "T11A94F0E7671ADEA7E53F467C81A31F82F91A329ED80770631D14B20B853BDCD613099A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908454, "uuid": "d5a0bb1c-f030-461d-aacb-55ef03c1ba03", "value": "12288:Ycliv2YB+N4OaKxXWKxNFkSHIF1mwspYR1DcwoPdt:Yuiv2A+N4OanKxYSHq1mRpYRxoPdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788908454, "uuid": "08b55fa7-552b-4b9a-afbe-fd16f4cb0dcb", "value": 445282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788908454, "uuid": "1a15af25-fcd1-4d24-b62a-d69bc44afdf0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908454, "uuid": "268f7574-f6cf-44d4-926f-b2745e3815bf", "value": "meteor-gui-addon.com__Meteor-GUI-addon-2_2_0_mc26_1_2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c04dff-ab4e-11f1-915e-42010a9c000a", "comment": "Malware payload (ValleyRAT)", "timestamp": 1788848700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788848700, "uuid": "a71400ec-a90c-48ed-99de-51a533ea77ed", "comment": "Malware payload (ValleyRAT)", "value": "3f7308e9c5e6e431b7fa3c70cfc0b388", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788848700, "uuid": "b8348fd9-9cca-40df-9024-d30881ce905e", "comment": "Malware payload (ValleyRAT)", "value": "81b4014ba47f755252101d3d265ec25c7b0b7cefa6e886b98a4e6d4eccfe33e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788848700, "uuid": "8d348578-b8ae-4c29-9c0f-2c0d6551de11", "comment": "Malware payload (ValleyRAT)", "value": "c4c44c926ed8eb9b8dee5b1e816e13c24ddef076", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788848700, "uuid": "28d3df8f-af80-4c23-a046-ef9a1475ade6", "comment": "Malware payload (ValleyRAT)", "value": "7b7e008e13451c6e7cc3b8ec49fe0264e5c2b28bb85b350692e13a475ab7f8db5ab80b679f8b405f3251687b6bac2565", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788848700, "uuid": "5573145c-d323-4bf2-9075-7895c68da504", "value": "T178743C0BFB4167BAD1AEA27444C75335B731BC292BF246CB2F8441151EE33887E35AA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788848700, "uuid": "f9068681-b2a0-44eb-bad3-95bef6815aed", "value": "57482a3c5df2d0fcd7746553c67c804f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788848700, "uuid": "117964ea-b892-49bf-892f-56b6d953d55b", "value": "6144:RxsGT8lWxG1Q+Ki0TcOtzRThp4tNWSATo:Ti24t0SAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788848700, "uuid": "ff0270ad-f890-488a-98fb-08e668868f4a", "value": 338536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788848700, "uuid": "f2f8c0bd-f93a-4bb9-8d06-65da0fb496aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788848700, "uuid": "7af439b7-6812-43bd-8183-191663d711b6", "value": "2026.\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848WPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743a3301-ab8d-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788875945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788875945, "uuid": "3a81b5ed-f329-436c-88a8-784718de5995", "comment": "Malware payload", "value": "c96ed6d22775f825cfa2b9d898005c81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788875945, "uuid": "81ec8caa-ca7e-4878-b9d9-0c1e47298da3", "comment": "Malware payload", "value": "828db1ff58e0d6f10da99075d35d65365488ee3b09c44763b6a5b2bfcc3ef93e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788875945, "uuid": "2afcd10a-91d7-4e85-ac07-ccf23e98d072", "comment": "Malware payload", "value": "031c32c882aabf78103f840b92987a4171aed3bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788875945, "uuid": "6742e2b1-8e2c-42b9-a36f-f67d3606487b", "comment": "Malware payload", "value": "bce488188def3916338623fbbfab1654c64e5f60cd1014012a29c8da46846896f2a2a998fd87d68fbd8f9543d39958ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788875945, "uuid": "ef236779-5b4b-4dfd-b154-d947cb3c18bd", "value": "T152665B73905624D8D1ADC974D5151213BEA8388B673863DBBBC076F11BBABE49E78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788875945, "uuid": "3ed304c0-826f-474f-84ac-6530d40f5f61", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQV:cqYUQuVDt0TZEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788875945, "uuid": "9e0d8ec7-66b6-4fc6-b465-4b0f15375281", "value": 7110656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788875945, "uuid": "f7659ca9-68df-4213-92b5-4ef58e78a9d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788875945, "uuid": "c70d37d0-7cbb-4bbf-840f-9615f95ca844", "value": "828db1ff58e0d6f10da99075d35d65365488ee3b09c44763b6a5b2bfcc3ef93e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486db798-abde-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788910661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788910661, "uuid": "9d8d1542-defd-484a-942a-20b3815867ac", "comment": "Malware payload", "value": "65d98d37e51605121247c12c4ed8ada4", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788910661, "uuid": "1624a8f8-3676-4c60-94ef-3f4c9bfa95cf", "comment": "Malware payload", "value": "82a4e2fe38d95392e19f9b8618df2ce0811d40a1aabc3a226b4d4c69a0bd5e7c", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788910661, "uuid": "661e489d-2918-4568-877b-4260734cc8e5", "comment": "Malware payload", "value": "4aa72f90da06e4b8be48de6d6b8a1fb81209c7ba", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788910661, "uuid": "eb9e7dfa-a1aa-479d-9b5c-74e1e82d6d2f", "comment": "Malware payload", "value": "44c847fd7f24b89e1f76a8113598cc483165d0270676c3f2668f392949302489718ce5140f5affbdd12bfc123ab5aca1", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788910661, "uuid": "0eb615db-9c24-46e1-95c3-8e09d3c6becb", "value": "T169F6E0037B5450D5E565D935C93BA267E620BC4C9B3223D73E60B4312EFA3E068BAF19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788910661, "uuid": "898c9964-f908-46db-af11-52dd7b1f6efc", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788910661, "uuid": "7ea20c8f-cd99-4dbb-b36b-81f63ab58e8e", "value": "196608:0bkKueOj8m0EoJdGRFAPlzAj5Pt2goWgq2s6iGBduGKN372OwkroCR+uj9:0x7Oj30EoJdGPARghCqXGWGaqk+69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788910661, "uuid": "3be23a08-6cd7-4c8b-a30b-ef3081846895", "value": 16106864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788910661, "uuid": "4b4083cb-704f-48c7-a4dd-868b0155402b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788910661, "uuid": "b288ee9f-7126-4c30-ae5c-4c94afaca395", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50b04ea-ab49-11f1-915e-42010a9c000a", "comment": "Malware payload (JOMANGY)", "timestamp": 1788846902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788846902, "uuid": "b27b497d-b855-4ebd-99cd-7474cff08f50", "comment": "Malware payload (JOMANGY)", "value": "5bdee394625efd2ecfe66b5238727ec5", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788846902, "uuid": "87aaf232-4e50-4b53-a826-e4439845ff32", "comment": "Malware payload (JOMANGY)", "value": "82c7c024d797549b2301bc83fedfe1c6013f146b99b691a544d3838c11d4527d", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788846902, "uuid": "a1b7b4ce-85b4-461b-a0b8-37522adf65c2", "comment": "Malware payload (JOMANGY)", "value": "311ae01276e8e74bdd27ee0ecdfd437feb56b384", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788846902, "uuid": "1d23ec25-4de1-4624-9617-38b8770052ff", "comment": "Malware payload (JOMANGY)", "value": "569c26007679fa71c9d30f2179b3e36327f35aac2606cf70acfa175eb10679ff5ca21d6a6e03b12e66254cb600e18e2b", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788846902, "uuid": "1dde9341-8731-4c60-b3e7-f6bfc1dc7bba", "value": "T1CCC27D966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788846902, "uuid": "8a3df0a1-a6bc-4002-91a7-bbd071ee427c", "value": "768:W8vCB+25j6es8RJ9FYpMSUpi+20qUpi+20YQX:W8l25Jvd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788846902, "uuid": "efdc85c8-7001-4d78-97d8-d163140821a4", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788846902, "uuid": "ebf9e53c-a4cc-40f5-bf92-343206abb59a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788846902, "uuid": "029679ca-2bbc-4995-a7c1-1365172d4c42", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fac047-ab5f-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788856324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788856324, "uuid": "0201eb60-5f15-44bb-a30c-a067b7cc21b7", "comment": "Malware payload", "value": "3bbf49d2de7ca6cde093fc10664404d2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788856324, "uuid": "ca9ca255-590d-47b3-8704-35e297c86fa4", "comment": "Malware payload", "value": "82ee47c0b88c210fe2cb1fd5b09ce68b3e43789948076d947c7764c91ca70448", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788856324, "uuid": "d618caee-57ce-4095-b8a7-b6779e381855", "comment": "Malware payload", "value": "58f857ccfd4e1328463fc20b66e54a3eb9a8dec6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788856324, "uuid": "581945b6-7d9d-4e2a-918b-7548275dda1e", "comment": "Malware payload", "value": "177937cf87a4939036f3ae5f749e6efa3060b2c71685a5c113f33484c39177e655d742cb6a614cf46291fb732581d495", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788856324, "uuid": "9ba30d7d-1be5-47fb-a89a-ffe7ba0110cf", "value": "T193B412861748E93503B54A5C059FAC5E2CC94124084C68DFABB7EED23D1FBAFE0B55AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788856324, "uuid": "fe812ef4-f5eb-4c20-b4f9-3c94be031b64", "value": "6144:O/CebTVbEGKSiJx/Sc3qZOqrIt9jy7yryM5ocOTvmnwvs48NX52ZwaRBOOx7Cx:O/jfpENl+r831OVwgXKOxmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788856324, "uuid": "52026aaa-cf2a-4462-a654-d0634ad603df", "value": 502545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788856324, "uuid": "93d8570b-736a-4181-9d58-5f213fb0b83e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788856324, "uuid": "0cdbd4d4-4133-4594-9e75-b46e97100013", "value": "img_602410.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c95f81f-ab39-11f1-915e-42010a9c000a", "comment": "Malware payload (JOMANGY)", "timestamp": 1788839747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839747, "uuid": "d3635392-9729-4e1b-8754-88505bc7598f", "comment": "Malware payload (JOMANGY)", "value": "33e1667878c74b79db8bb717137b8ca3", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839747, "uuid": "b3cb7749-81e5-4dd5-9d6a-8d6769a6f2e5", "comment": "Malware payload (JOMANGY)", "value": "83d6fa2804c09b3af39f71ce7144ce36d2a4f9b491792743371fcde788b7e8e8", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839747, "uuid": "762637d5-9be0-4135-9dab-2f91ff0d5619", "comment": "Malware payload (JOMANGY)", "value": "37f292a2a59665a366a84d709acc119e4a5a87ca", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839747, "uuid": "a5a85731-e045-41f2-b79b-a8d9b2915fde", "comment": "Malware payload (JOMANGY)", "value": "3493dc6208cddfa7059b520be978460e4e87179432d727d4eb72015230acdb20f1a285bdbf2602cb162c1d8a6363ad82", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839747, "uuid": "cbba17eb-b039-43a4-8dfd-e94fa7375113", "value": "T1ABC27D956A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839747, "uuid": "a37dea0a-6e0e-4ea7-b5a2-579f359c1180", "value": "768:laI8vCB+25j6es8R79FYpMSUpi+20qUpi+20YQX:x8l25JNd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788839747, "uuid": "472d36e5-6718-45aa-9685-a1d7e84a1d02", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788839747, "uuid": "8eb3e893-53a7-406e-9d70-d3917d6778c0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839747, "uuid": "7dbb43ed-4650-42c3-a53a-da0b4dea587c", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b03912-ab87-11f1-915e-42010a9c000a", "comment": "Malware payload (WARDENStealer)", "timestamp": 1788873364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788873364, "uuid": "0b74b2b1-a37b-49ce-97db-5decbc555321", "comment": "Malware payload (WARDENStealer)", "value": "50e48829374370c5c5206a9355d0cce5", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WARDENStealer", "colour": "#528E31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788873364, "uuid": "e6da99b1-04af-4918-9927-5db4202b1984", "comment": "Malware payload (WARDENStealer)", "value": "83ff82311a7e7ba69c4d0c10c26d1e7d37025c08f2aef4deb767f159e1ec43f2", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WARDENStealer", "colour": "#528E31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788873364, "uuid": "020627aa-3cc9-468e-8ef8-db2cc2436ee7", "comment": "Malware payload (WARDENStealer)", "value": "ce1a7a08259503c67eaf61ec7f5707349486d451", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WARDENStealer", "colour": "#528E31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788873364, "uuid": "b4a1c984-2239-48d5-9605-071b6af91377", "comment": "Malware payload (WARDENStealer)", "value": "7cc32f8cc2678f88bef5ebd1b796f019e7255fde445228cdbf234301390dafd7b911e3b02863727f24de6141ec598c54", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WARDENStealer", "colour": "#528E31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788873364, "uuid": "377cbcf0-53c8-4f95-b310-b230e3bfb3fb", "value": "T10AB4F063FBA80BFCD42A86799D050501A6F2B8625B6586EFC3B402970F777D04DBEB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788873364, "uuid": "69cef6c5-cb34-4a29-9f7a-2f9b8c73b889", "value": "998020fcd6aa39f1f38412dd2f4fadfc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788873364, "uuid": "77b03048-53a4-4ee9-817b-ba9bbd5502f4", "value": "6144:CE4M9mL0Pjh2fxLvLOHnREl6iiV5XPo84XpHe+iG+0jEJgo3/bGz5lOKf5T2zST8:CEn9mdf1LORE6361XkRyz5lxf5T38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788873364, "uuid": "7ced9bb7-025c-4f27-82b2-3ab515d7983d", "value": 517120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788873364, "uuid": "8752eada-3ec6-4388-aa53-f5fc3312e518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788873364, "uuid": "b0b7f601-7769-40eb-b581-1212ff925f65", "value": "1724460745.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3200ad6a-abd6-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788907187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788907187, "uuid": "2d4f2fab-0e94-4866-b453-96ee03326747", "comment": "Malware payload", "value": "f190d6ebbcc3810333712c48c12ffb2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788907187, "uuid": "0262791e-5340-4fd6-b820-f7c32c42ca8a", "comment": "Malware payload", "value": "86953022ccd295b02be2202be2e2d9d8d87ef719d1aa368ca16c30a33fcdbd63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788907187, "uuid": "bda469b0-3463-4cb7-b533-356f16a585b3", "comment": "Malware payload", "value": "d6744769778a4760b289303075eadc594a288e98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788907187, "uuid": "f5f5374f-eebf-42cc-a379-62be0ab15e21", "comment": "Malware payload", "value": "b02f24fad349db15aad159421f61ea8d163f396b312acaecb4b5d86f53b28c1d4d17660cd95441134255a3b50c51a435", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788907187, "uuid": "747e1521-2d6a-49e5-874d-5be34d445bcd", "value": "T1A8C623EA5AD853B0D4525540A58B43EA30C1BA0E85FD4D1A39DB2E426B18CBF214FFF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788907187, "uuid": "ebdd9a31-82b3-43b9-a867-d29cdcecd041", "value": "fac9b28d69ff8f4084e9d07b45254cfc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788907187, "uuid": "1bdf8e7f-820e-4f15-9f0e-001da389ed29", "value": "196608:bMk9ms2JtuyCy1FJqI4eb4lK3FA4XygWwW5OiB2RgvtgL60NiMsy3Dp7Sxzz:bMsuJ1HqI4ebnGgoFBKctw3F7SxP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788907187, "uuid": "7bf15786-3e40-43d3-a993-5fba0e74d2a8", "value": 11630488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788907187, "uuid": "5f6a2b54-26e8-4a8c-a0d4-84d91103a88b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788907187, "uuid": "6985f260-0df6-46e3-a96e-63b523748094", "value": "KiddonsModMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6903ff68-ab5e-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855740, "uuid": "39de661c-933b-404e-a4e5-813c6afa0d7d", "comment": "Malware payload (SilentNet)", "value": "68dbff08575bdc7ed580910969c33ee2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855740, "uuid": "ed819dde-dfc5-4966-8a96-a2ccdf2cff3e", "comment": "Malware payload (SilentNet)", "value": "86f3c76085672665d8dc340a5b5caaf7d0873b2092a01fca1414945569f6db44", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855740, "uuid": "2b4d9128-8233-4719-a533-afba080fab3c", "comment": "Malware payload (SilentNet)", "value": "24fa98f471b2eba6045650fae22d861090674a1e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855740, "uuid": "104a9a97-bc9e-4a2f-962d-08239bc2b3f7", "comment": "Malware payload (SilentNet)", "value": "1f3db67c1e6544bc1e4b559863e4281c014418f3c4d1cc247e062cacd21194b822b0c2005a394eae5ab71ca788ec9103", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855740, "uuid": "0713d611-8472-452a-941b-940665872f98", "value": "T1E5A4222B0E09513AEE7B3672A451D686F8383A41A01BF1FF0E0494DC5C8A6FB4355DBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855740, "uuid": "42af0646-da70-4023-903d-69d07380bc2c", "value": "6144:HJCY7KwSOjQsg9Pjf78uesEuT5dluhwCm/Z7hvfbehcJnkNxMi39fW7RKkZcAvNV:pCCKwNghD1HF5njtb6u2T99fWlTZdvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855740, "uuid": "c5e2b9e6-724d-4e8c-8285-e4441ffc3177", "value": 455595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855740, "uuid": "12c70ccc-188a-427b-9fea-8012810d00d6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855740, "uuid": "07e10473-2902-4d4f-a1fd-441dbbdeab49", "value": "Krypton-Client-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd49c0f-ab7d-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788869223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869223, "uuid": "898fd46a-aaab-4b4a-bde2-73ff3d447209", "comment": "Malware payload", "value": "924c410a520e6dc9aa1118474d9eb354", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869223, "uuid": "4a4d3a77-8d2a-4db3-9cb1-a1f4e82c20da", "comment": "Malware payload", "value": "86f663ed032c66fd1153f747835cf29105679a374a8686e375d436305dc46b7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869223, "uuid": "6f324ccb-f274-4289-90c3-a83304d03d7e", "comment": "Malware payload", "value": "3447c610f194661d51a8cb3dce04503882f74d92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869223, "uuid": "1bb5115b-c51b-4070-9e09-3a490c019507", "comment": "Malware payload", "value": "3f749002cc8d332c751e579b648b591f2393b8612be9222b92b6d4775a9d32a824a76ee2f411b8da6af513fe421e841e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788869223, "uuid": "77fbd495-9d83-4840-9b43-1cd157455429", "value": "T1ACE36D0AE794095FE946D0B5A232246388F2FF125B20E7D7F5BA0D572F99BD81F32244", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788869223, "uuid": "e76e6f9b-e389-43c9-baee-fb4ae9b0058e", "value": "3072:GfrZxkekr4djyLWsyqcqmUYwvalEejb3OHXKTO/L2:GfrZxkeJx8c+Xva5O/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788869223, "uuid": "702f092c-324c-4284-9191-0e950b0f3d1a", "value": 150720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788869223, "uuid": "39ca3912-3046-4330-956b-8129ad74d37e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788869223, "uuid": "e8fd5776-a5f6-4a84-8c1a-43e53b29214e", "value": "86f663ed032c66fd1153f747835cf29105679a374a8686e375d436305dc46b7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74968670-abcf-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788904292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788904292, "uuid": "4a8e0e21-4ca6-4935-8222-5cebc2d9077e", "comment": "Malware payload (Mirai)", "value": "17851307c106e5ee54367bf1ecf9a1e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788904292, "uuid": "6e25e2f9-4957-4360-9065-25bebe1c3540", "comment": "Malware payload (Mirai)", "value": "8865cec6bfc4cacc0fa38975628a6c1b32f71aa6a92446ee55414e8d2f85a2e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788904292, "uuid": "80cd5724-2b46-45f3-9e39-172ed6942c75", "comment": "Malware payload (Mirai)", "value": "17739b43e6926b05e95c9f2150d942bdb15f97ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788904292, "uuid": "8f8956d1-fc60-4249-ac46-3dee4426c552", "comment": "Malware payload (Mirai)", "value": "e9e91716f867196980a72e88ab29cd14230c209bc96f0e30261dfd12c1467bf695ca501556a6068f6295e3987b79b21c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788904292, "uuid": "8d8562b3-827f-42a7-b409-4d6277b02f3e", "value": "T1B454290DF902C8B0F86291F0459FC3A17D7055F7123BAD66EF5B2AB17E322619D4722A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788904292, "uuid": "9044c9e0-73f9-4031-88e1-b65234c307e0", "value": "6144:h3roKbsBRNQU7hQUyr18Ai+sRsbYg86mkyhTQOqAkq9ZXYL:Vs+WQbB86wsbYg86mkyhTQOrkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788904292, "uuid": "1ea76417-dffd-4e2a-8ad3-77c3a7154c4e", "value": 292376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788904292, "uuid": "265d1557-b93e-4c9e-a264-db0aba00d765", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788904292, "uuid": "43840073-8acb-49bd-a41f-03ad586e8559", "value": "titan.x32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f510ebaa-abc3-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788899354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788899354, "uuid": "6a9a9047-fb03-4916-b271-8ff3b3fe9a8c", "comment": "Malware payload (Mirai)", "value": "3b55eb291a402b5e715e854aed71663d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788899354, "uuid": "5dd8fa22-339f-4925-bfbe-6827dbfa3d84", "comment": "Malware payload (Mirai)", "value": "8876d082a455b569c9f50f98f4d25097f94b769e2e5701beafa182ea19911478", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788899354, "uuid": "a1002ad8-bc9a-4898-a6d2-ce4fe24ba85c", "comment": "Malware payload (Mirai)", "value": "7b26a8ef8898a93993a97c542efb66c745a116d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788899354, "uuid": "b6523479-5894-48ea-870d-bb36a2ef9469", "comment": "Malware payload (Mirai)", "value": "a8fe40ce515e9b142bbbb4821eaa839563f88631a15de1bf7a4bd193164408ca64dede3030d8e62379219ca268e13eaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788899354, "uuid": "90745935-6121-4435-b48f-aae5e3bc3a78", "value": "T1DB13F15AC17A5166C0CBB038780FF1F55C14DA8A30D9E4E2FDC8687A5162D46BFEE0E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788899354, "uuid": "02abea00-77f3-439c-967a-2b6b73c40d0f", "value": "768:A2m656tBMVFG796QofJPdHsr81q5FBKhaXYwf1RcsCAuJyoGYLrnbcuyD7Un/2V:46ct1796Q+ZdkllKPwPcZQUrnouy8+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788899354, "uuid": "9b9e5b52-0944-42ad-8f06-c574c040f0f4", "value": 41716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788899354, "uuid": "2a004df6-79e6-4b18-9880-6f12dc6fbc39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788899354, "uuid": "89240363-efce-4b56-86ab-1ea7ffcdbe90", "value": "8876d082a455b569c9f50f98f4d25097f94b769e2e5701beafa182ea19911478.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a0321b-ab9b-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemusStealer)", "timestamp": 1788881871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788881871, "uuid": "c629e9d3-ae45-4a65-9f22-721215ace73c", "comment": "Malware payload (RemusStealer)", "value": "ab3186230028fa25d3c80a61a5c87324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788881871, "uuid": "610ccab2-fb9c-4a01-bdd2-3a14985b4e1f", "comment": "Malware payload (RemusStealer)", "value": "8b24ee5329fe396f29fcd3476c4ed229b631fd810527dbb52aa7cf3f2c4e1c1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788881871, "uuid": "1a548a34-4be5-4f0c-ac2c-98ba64053705", "comment": "Malware payload (RemusStealer)", "value": "2aefe22e531de0040d7f0b8dece684b0f60da058", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788881871, "uuid": "39a506d9-f5ab-422e-8f02-71485436964b", "comment": "Malware payload (RemusStealer)", "value": "69af6ca7dfe431c07e691738474b33a801cd700a9557016a32b0d8dfcd685f023307dce7b4f95d48dacf3c9492309475", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788881871, "uuid": "4174e20d-1e8e-408a-a28d-9cba87df4b1e", "value": "T1D4062A037F9045D8D85AE239867B42A1B675BC8C9732B3E71A807A742E737D1A83DF14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788881871, "uuid": "526d6ed4-04a3-4ed1-81bf-ca0daa9387d8", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788881871, "uuid": "1cccf222-e811-4f96-903d-91e4bebd187c", "value": "49152:ubFgQfZ0dhnNyK00Z7jVcCbzDRc4gNbeA5+IypYdTTMP:ubqCSdJjVngNbf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788881871, "uuid": "92b1a11b-4f2f-409d-8c30-7589ea6bab6e", "value": 3777960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788881871, "uuid": "98467155-fd1b-4447-b575-5a7254924ab1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788881871, "uuid": "dc06c2d6-22a3-4d32-869f-6dc59d2df0dc", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4241b28f-ab7e-11f1-915e-42010a9c000a", "comment": "Malware payload (Formbook)", "timestamp": 1788869419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869419, "uuid": "ae4ce32c-8dac-49ba-a3a3-d9dc3f8f02ab", "comment": "Malware payload (Formbook)", "value": "5affc9981e6eb090fa8fbbe3ebfc0b92", "object_relation": "md5", "Tag": [ { "name": "dropped-by-remcos", "colour": "#5D7FF7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Remotehost", "colour": "#74154D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869419, "uuid": "0de183ef-40da-4e28-b41c-c2217d1a7b8f", "comment": "Malware payload (Formbook)", "value": "8c65d9805836b194f2b34cde260a0a0d52de3d73e1e0ce775e69e7179e9b5019", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-remcos", "colour": "#5D7FF7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Remotehost", "colour": "#74154D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869419, "uuid": "efafe63a-678b-4803-916d-0848c5625678", "comment": "Malware payload (Formbook)", "value": "a0ea955c9cc127d50eef5b832a08be819c811ec5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-remcos", "colour": "#5D7FF7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Remotehost", "colour": "#74154D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869419, "uuid": "c6908c62-fa69-4cc1-b870-d5dd7bd451a5", "comment": "Malware payload (Formbook)", "value": "f9939bb443293900c618573c10e404eac7a5c70043cb7f2dc9238ce6fd5b6103c993ab074d377cbac77b5d1124b46d68", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-remcos", "colour": "#5D7FF7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Remotehost", "colour": "#74154D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788869419, "uuid": "4f0f9d41-cbb8-4f2b-88e0-4bf120f6743a", "value": "T18454231B070AC25FE8F164B33ECF42E39769663918E67087579169F8C7895FCAC69203", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788869419, "uuid": "9c92b814-b633-44a4-a498-fbeb2c7c38f9", "value": "6144:gCIuutXnDuFJItKLmk61EFGQ7PpYa6o0XsJL4HOEtjK45XbT+kcYF:FSVA+IKkjXp6sJKBbba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788869419, "uuid": "0ea7682c-40ff-4a9a-b8e7-ea810a2d706e", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788869419, "uuid": "c531caad-6a97-4e63-917c-ef7484d5d1d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788869419, "uuid": "3274606b-dde1-44ba-ae57-2669842bdd27", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96dc1a8b-ab24-11f1-915e-42010a9c000a", "comment": "Malware payload (VShell)", "timestamp": 1788830906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830906, "uuid": "58dfe581-f2aa-499f-8381-d897ac84b618", "comment": "Malware payload (VShell)", "value": "81f40cf86a0398fa67c831f204ba186b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830906, "uuid": "da2de117-a731-44ab-b5bd-0735b00e8af7", "comment": "Malware payload (VShell)", "value": "8cf3cf35c95976b94178dba716adf5308d54f9226e90413f43dbff681afd5842", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830906, "uuid": "f84545dc-6a6f-45a0-88c9-3a21cb068d85", "comment": "Malware payload (VShell)", "value": "1a9cd178c20f433c090db2cd998b6e23875fbda6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830906, "uuid": "16141aa0-85e4-40f2-a545-f9d7452d0cc1", "comment": "Malware payload (VShell)", "value": "027d113ce8ee7a4dadaa9e4568b5e2c7acd01ac47dd1e0712f5ed00148da2bcd8d34454bca034892edc8e67d3ef11efc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830906, "uuid": "c2a266f9-2c7f-4914-afa5-ccdf0b23259e", "value": "T16B71D68160505AF2D94CE3BFC487B8A6FD4FB248A2C80B0F0798981A3F7507BB0D9613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830906, "uuid": "cdad3d45-1c92-44fb-9d88-cd189d62692a", "value": "e82dd51b077167be63c004bed23d0c1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830906, "uuid": "582a6894-a6ee-4a87-bcf0-43a4529542a4", "value": "48:6IZUBQYxZul2EywS6DqwkSjk7QLzgzIzQz4zAzo157D9N9XM/geu3ahr0/x:2BQMZ7EywS6Dqq++D9vXeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788830906, "uuid": "cdf0fd92-ba18-4c05-8443-fda7fc3cd5b8", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788830906, "uuid": "bb82ac09-ab07-4fa9-9b3b-376cbf622c2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830906, "uuid": "f41a1c20-0ee2-4bc8-a142-22d136056921", "value": "8cf3cf35c95976b94178dba716adf5308d54f9226e90413f43dbff681afd5842.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e74a65e-ab5e-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855749, "uuid": "0cea445b-1f12-4c83-82f3-3682e12e5f54", "comment": "Malware payload (SilentNet)", "value": "cb4dfc3ab7734ec42a98fd7eb8a8c52f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855749, "uuid": "8e0a16af-452c-4345-94cb-7df4ef716a6e", "comment": "Malware payload (SilentNet)", "value": "8d56988ac897654fee633735d4ccaa80605cfe6d376d1d5593859498c5bfd183", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855749, "uuid": "74a42223-c28f-4003-9848-ea8a5080496a", "comment": "Malware payload (SilentNet)", "value": "3ef13961aa1bffdf4c869224721b336478c489f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855749, "uuid": "8a88094f-bd6e-4e2c-b9a6-8cd7228dc252", "comment": "Malware payload (SilentNet)", "value": "81b20d3835aa86d2057ae983ad08ed5c311eb47485e0c1f0db572c70cde29064cb244d738f6456144e08635cc5825d15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855749, "uuid": "f397eadb-ba94-4634-8852-e71ccc84f8be", "value": "T115357C83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855749, "uuid": "93bce335-f197-4eb7-a50d-3305e6340c69", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855749, "uuid": "d504e2d1-b0bf-417b-a7fa-5e8feda2398a", "value": "12288:ebs/m0E54jwaFXGc8lEBBBHGBKq2IZwDIvfqItNqdg:ebOVE5ifGPRZwUvf3fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855749, "uuid": "63a42eb8-f2bd-4484-a65a-0be90f957ae3", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855749, "uuid": "ffc3e937-36d2-474c-8235-e968e8c81c93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855749, "uuid": "90e6acbc-a18e-4ed6-b9a9-fd301e16ee89", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4404b8f9-ab39-11f1-915e-42010a9c000a", "comment": "Malware payload (JOMANGY)", "timestamp": 1788839786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839786, "uuid": "ba957248-5aed-4449-8014-3a9c64c2a479", "comment": "Malware payload (JOMANGY)", "value": "52e0052399bce4a672ea30af7abfa04b", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839786, "uuid": "27d0af88-8c7c-4e4b-b460-4e2c65370183", "comment": "Malware payload (JOMANGY)", "value": "8d8fee5dbfb27e7ab6265953dd9c53853c3fd9763a1f5583ca33e208b315d390", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839786, "uuid": "8a84d6ec-9998-46a0-b8d3-2278227d5e16", "comment": "Malware payload (JOMANGY)", "value": "4a0f1cdd006bc18e85c5c3df5d0455bd38d13767", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839786, "uuid": "a564f168-70f2-402d-8cdc-2dd88f7bf803", "comment": "Malware payload (JOMANGY)", "value": "e163a3f2f67f687b8adaa52830aba45da8455873aa7c5b4cfda5fb54455ef36371ad45c22c4fd3a88732455d5482d3ea", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839786, "uuid": "25aa8b3c-098f-4a7e-b989-4f0e7c8dac1b", "value": "T1C0235C6516867C24AE98C8361C7E2F0CB9AD43E6324452EE7FCB3CF68C4A69D910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839786, "uuid": "d2a7218f-929d-44a1-89d6-38715e27f5ad", "value": "768:9+49GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:9+lcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788839786, "uuid": "f4b4c333-63e2-4738-a06c-30653b82f16c", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788839786, "uuid": "8d37b150-50f5-49a4-b3de-22e5219c6d55", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839786, "uuid": "bf3c013c-ad9d-49d3-a496-a26cc9ad3499", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7570b4e6-ab5e-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855761, "uuid": "0bdefabf-ec15-4b64-a9e2-483a23ca96e5", "comment": "Malware payload (SilentNet)", "value": "de55b87eaae1f3c67daede9e62913ca9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855761, "uuid": "63503c04-8288-4cf8-a1a9-0898f9917942", "comment": "Malware payload (SilentNet)", "value": "8d9aed2ea77f3bd9912cc598f0d2956e46d6147b8b4f50cf54b021f9f9bc0aaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855761, "uuid": "ca8e5fd6-6578-4516-8754-4333993a97c2", "comment": "Malware payload (SilentNet)", "value": "385206887d8a28fb881b5c10e3f20462cf8f2786", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855761, "uuid": "99f4a2df-fecf-49e6-bfd6-d433e2932c8d", "comment": "Malware payload (SilentNet)", "value": "1532a6fbf827d0f11cb9e0812a13cd15bd15640ca230c670e4c649788669a10bc270b159682469f06f60f6289f198fe7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855761, "uuid": "098efffe-0c98-46d0-aa5e-412a5748185a", "value": "T1E6357C83E7A385D8C116D9B5534BF137F9627C8E4B153197ABC41E633A67BA4E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855761, "uuid": "d1c85480-e76c-4110-a776-074f692e245b", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855761, "uuid": "7a60baad-e098-45b6-be21-e66f0f03dbf2", "value": "12288:ebs/m0E54jwaFXGc8lEBBBHGBKq2IZwDnvfqItNqdg:ebOVE5ifGPRZwLvf3fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855761, "uuid": "75dc0ca8-068a-4036-a3e0-401c170bb4a3", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855761, "uuid": "c3e509ae-2761-42f7-9c76-ec9f75b0bce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855761, "uuid": "0ab4f543-b4e2-40f7-af56-5ae25ae13cd9", "value": "r3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdba2b82-abaa-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788888631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888631, "uuid": "7bef840c-9863-423b-8243-333377b200b2", "comment": "Malware payload (Mirai)", "value": "0c45741ea60147e6f74f2d3755eec08e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888631, "uuid": "6588c45e-c5ce-49b8-aaa5-9d9ad38a95df", "comment": "Malware payload (Mirai)", "value": "8dd7f25612ff43e31668cdb62965b08467009d63852011a26fa45e5da0d5aa9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888631, "uuid": "e88cf988-8584-4207-acfb-0544bf34c2a3", "comment": "Malware payload (Mirai)", "value": "723947ea3093c6e7f99e1f87037b29b48c637583", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888631, "uuid": "5cbc85f3-e610-4d36-8478-277d93a667f3", "comment": "Malware payload (Mirai)", "value": "10a122792ec559996f2f63146dad7016f40189171b9499015b8e7e19c037fc8e2c938045412726fbdf6cbe89985fe611", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888631, "uuid": "7c54d043-0a80-4d13-928c-889418dc8b66", "value": "T1C5B34BC4FA87C0F6E41308715067B73FCB3299299035CA9BDB5DAE72DE27A414A0A71D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888631, "uuid": "57293f6b-3d5d-4a04-871d-580a398e8e19", "value": "1536:OnAXVChtx960sluFHWGav6puGUdMUlGaL40wsk08c9DE:sWx0i9Boud2Ul8skWlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788888631, "uuid": "d972af02-9224-44c2-bfce-53f6cdfa52cc", "value": 117120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788888631, "uuid": "9b000048-556d-4252-845a-27ec41cfda6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888631, "uuid": "347c3405-2d0e-48ab-885b-bbd78dda2740", "value": "01dd5723b2231c280497b0bb11ed1c03c8b030265d4c6292679859ff3f30b8b5.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4467048-ab23-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788830526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830526, "uuid": "b04cc81f-038a-4a2b-ba6d-d3edeabf5b44", "comment": "Malware payload (Mirai)", "value": "e488dde75d0d4372a4a9b4f9e09706a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830526, "uuid": "e01946d9-cb59-4d9d-bfb3-dc35de0f8e74", "comment": "Malware payload (Mirai)", "value": "8ea5fe9dba1fc6f845f8ee1b5697733b04d96d638b79ed5f275d8d47bfbd591d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830526, "uuid": "1b2fdc3c-c0d3-4114-be48-2fa4af4e6b6f", "comment": "Malware payload (Mirai)", "value": "ea53e313809855e9228f2d0d4a8a6e9d54c3cea6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830526, "uuid": "4d1c7f96-59fa-4e6c-931b-8c33d86fdf59", "comment": "Malware payload (Mirai)", "value": "dc8ec358cac1e155520b6bc0ccbd7a81d429b7175a30645bbd4afc99536e78cfd1721f0ad75b46640d174a56e6fb4dd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830526, "uuid": "b7643f68-5743-4433-b672-20342b61fab7", "value": "T167941903ABDD2F9AF0A3CF3548362066455C1C6A7BA4CD3AEFB82949710B7950F4658F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830526, "uuid": "2eec6b24-b11a-4383-ab56-85791984a909", "value": "12288:3i5Ez8J9CamYbXEtqdIhjXBuv17vrX7+M:39aZXEtRyj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788830526, "uuid": "3dca52b8-5eeb-4e40-8071-bda4b2a344ca", "value": 418816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788830526, "uuid": "1212a6f3-788b-43ba-8296-680dce76b9bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830526, "uuid": "9fe24cfa-bc1a-4a95-b22f-618db7ab7707", "value": "mips64l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c5521c-aba6-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788886625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886625, "uuid": "36d7f54c-7a6d-4148-b3af-ee7cd3f8f449", "comment": "Malware payload (Mirai)", "value": "f4671a8dbe7ad18d92b578e41dc5ec2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886625, "uuid": "60a87a85-1d27-4e3b-8b56-db36c2a68f1a", "comment": "Malware payload (Mirai)", "value": "8f642489cee2a2ed21e6498d3cee13decad32834d24e094533b10d499f64b193", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886625, "uuid": "6b07edee-f1e6-41e6-afc7-ee5930832c6d", "comment": "Malware payload (Mirai)", "value": "73eedc37bcb2a9b2fffe0059756ebd6b12aeed26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886625, "uuid": "27c2e77c-08bc-4fd5-a286-d6cc1fd8e4e0", "comment": "Malware payload (Mirai)", "value": "307f3994add0038bf085e51b0e4046a429b2109f7a41d90d793aa5290f06ab65ed846f478db51543c238528c67d75de0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886625, "uuid": "02b50f09-89a2-4885-bafa-5a8596a5bf0f", "value": "T140D35D02BB588F47E9975DF414BF2B9043AEEE5065B1B184E54EEE4D1231FA2241EF8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886625, "uuid": "bb76301d-873a-4556-bdb0-4f668ca1e959", "value": "1536:dxgsSX/PrW3YJrq1n8RxUzIT0XiSwCvhinmp1pUI1V+DH2rRWbHrsgH/:76PPrK1nm6xXiSbwwpUI1uH1H/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788886625, "uuid": "38f54354-a9cd-4eca-aa5a-9fd3fa56d120", "value": 142080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788886625, "uuid": "1eb24b6d-b1c6-4595-85a9-3638d23f97f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886625, "uuid": "eb783803-4d16-49fc-9b20-477003241982", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332546bb-abd9-11f1-ab4f-4201ac107002", "comment": "Malware payload (SilentNet)", "timestamp": 1788908477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908477, "uuid": "10ed6212-ca8d-4646-8b2c-1df4249d5ab2", "comment": "Malware payload (SilentNet)", "value": "18d98f41268178c0bd7703a908ed94a3", "object_relation": "md5", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908477, "uuid": "9602124c-47b2-4934-9d0c-691d30992e53", "comment": "Malware payload (SilentNet)", "value": "9053f8d71dcc63275a24bbaa1be86d963ce3165e58343f0b29649855b7162f8c", "object_relation": "sha256", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908477, "uuid": "4254c075-8317-445a-8b42-4d9e794e3a74", "comment": "Malware payload (SilentNet)", "value": "309375056352847b5d0eccac56baf0e2890cf683", "object_relation": "sha1", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908477, "uuid": "d59eeaa8-2362-44a2-a81a-e04d9573ce36", "comment": "Malware payload (SilentNet)", "value": "f759ff9f5b844b2d1a01df0bc24cddccc4f078e99e823f388d3c73b163d350d75d43aec6b00e8a07ea82912fd9066ca4", "object_relation": "sha3-384", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908477, "uuid": "dd74625b-0600-4410-a000-9a7d18e2fea7", "value": "T141151211B277422BD61BE138B85B8CD1BDFC59E8764CA59A02FCC0C0E5425BF1B61ABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908477, "uuid": "70e8854a-5f79-4ba4-9a3b-45461db0ac12", "value": "24576:ukYZiPhK4sIWzjXwpz5c1yMl4RO1Ers6WPOO:E5zjgpz5cIq492", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788908477, "uuid": "20502502-bbb6-49f7-82bd-6a0b36c77fdc", "value": 883010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788908477, "uuid": "1009d435-9b9e-4cb4-9e48-7c8de9af8d04", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908477, "uuid": "39174b57-14e3-4557-996d-05c3c45f4eec", "value": "trouserstreak.net__trouser-streak-1.6.1-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9512bb73-ab2b-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788833909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788833909, "uuid": "08b810ce-0c93-405c-a7dd-bb5cd71a62ae", "comment": "Malware payload", "value": "fe6ecb62611c793060f2802bcd0497e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788833909, "uuid": "3f2bc3ea-2070-45da-9727-a27cac8b8a2f", "comment": "Malware payload", "value": "90e89ed745ad864e8494daca5a4d9846990c0d1030336bb5cec2208e40211cb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788833909, "uuid": "69ed4849-ad11-4143-8b14-4d3064c57d06", "comment": "Malware payload", "value": "41e453832be37835507e1c6a25c91f659aeb9c2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788833909, "uuid": "eb6adf75-203b-431e-b220-89dad56d9123", "comment": "Malware payload", "value": "00672c48f1ac2ad26f0da15cd919a146a65ec030ff235d69c4f768236ba7aab63df359555d4c16a3e0648334bf0d449c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788833909, "uuid": "f0fa8d86-acaa-4c8c-80fd-2eb0b4eb90a8", "value": "T13086D02762E500ECE17AD13D8E5FAA03E772341A03219BEF16D04E665F97AE05E7B701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788833909, "uuid": "d078cd0c-94e5-4159-8695-5873881b98a2", "value": "c4fdda1e8c6bf59a34fca40793c26e6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788833909, "uuid": "01bd84a2-ec39-45bd-976c-fff09e30971c", "value": "98304:ZRzCfUJQaBd9FZ5JXdgbFTFQJQI+8Vx99k1uqMpypSP2Ff0UV/+blAw/hSus:LufUJvPzJXd2SJQVEj9MM+SA0UVzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788833909, "uuid": "b56f5b99-5280-4c52-9cb5-4d9d9711e74d", "value": 7959040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788833909, "uuid": "204627e2-2f79-4879-99b7-6161deba8de3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788833909, "uuid": "7d6b242c-306a-491a-90f0-d073e3f48d86", "value": "90e89ed745ad864e8494daca5a4d9846990c0d1030336bb5cec2208e40211cb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee930dff-abcf-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788904497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788904497, "uuid": "51005bea-dad3-4d24-b038-fab93d53f8cd", "comment": "Malware payload (JOMANGY)", "value": "c1af3b66c6d0ef6d5ff24d4e03e419a6", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788904497, "uuid": "bad98072-1289-47d5-86cf-490b36bb6268", "comment": "Malware payload (JOMANGY)", "value": "94cacfa7fcb76873c69243f5e651aa8ff7b21e4821065275e8cd6d419d49462d", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788904497, "uuid": "114b0b76-5b1f-4e97-a752-4f8bc9c4c3e2", "comment": "Malware payload (JOMANGY)", "value": "902a57cce2922ee7d1069f8cd25909a000c9d34e", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788904497, "uuid": "6a82fc0e-c27f-4207-82b2-5c9d4718d5b9", "comment": "Malware payload (JOMANGY)", "value": "71c78b1ae50ae0bb14e9623653a8800f21a257bbd146e0c817536ad27b501219c64ed688c2aefdfab19ae8bf7c720ae2", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788904497, "uuid": "b05e5f15-2873-4b03-979c-3db02cedc44e", "value": "T15C236C651A857C149A99C4371D7E2F0CB9AD43E6320452DE7FCB3CF28C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788904497, "uuid": "ebf7250a-4391-4829-a4ad-a5548235886f", "value": "768:0VEJVIhtMk9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:KEJ2MJcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788904497, "uuid": "f742b4b8-fff5-4fc0-916b-eb31d981e034", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788904497, "uuid": "ab934249-4bb5-4206-8ab6-03d04297f82a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788904497, "uuid": "9aa97832-a455-4b50-850b-12240dba123b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a46376d-ab99-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788880921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788880921, "uuid": "de9f628d-e273-4825-bd65-c108f8e4604c", "comment": "Malware payload", "value": "b47944e345e5bccbb3cf4d66b1ad054c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788880921, "uuid": "94b4c071-be46-41d5-a1c8-679b6e3d4336", "comment": "Malware payload", "value": "95e96945310aed6a31d125547ba0a71accb4a2053015d392e0b94f28a948f866", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788880921, "uuid": "9e5798f1-b646-4400-9084-dee0f5fc6cad", "comment": "Malware payload", "value": "f5631ab41228762e4797fbb3159e075d3293a32e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788880921, "uuid": "5b1309f2-c18b-4ca9-9646-b0ad02bd12e3", "comment": "Malware payload", "value": "91ec8db3eed5ca7c2ae70e69dfc67b0489dd058b5105ec575a1cfcb38d019873dae11fe0da6c4cbbbac5ae7074689e54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788880921, "uuid": "e42d0f79-f9aa-4702-bd7c-bce437a88a30", "value": "T186B5BF15E3E412A5E92BCA78CA158333DBB178925720D58F0798E6562F33ED19B3F312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788880921, "uuid": "5c837e79-0046-42b9-9a72-c226996fd61e", "value": "cf4276a70f071efbf419d732f8793de1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788880921, "uuid": "f4ac3896-9a87-4a45-a65c-19d3786f8a30", "value": "49152:z7nu+M9ZuICMZZog7rgI11jeTwNHIACk2jZL1ZEF7Ji:MVCufH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788880921, "uuid": "45732ba5-939e-41c8-9e53-f6ea94484089", "value": 2419200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788880921, "uuid": "4151738a-ab1c-4a5e-aac6-c9967fb3cc7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788880921, "uuid": "9d576bc4-83a5-4b3f-9c20-432183948f9f", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ef7fb5-abd4-11f1-ab4f-4201ac107002", "comment": "Malware payload (SilentNet)", "timestamp": 1788906628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906628, "uuid": "eca3d30c-efe5-47b8-8761-172417db1076", "comment": "Malware payload (SilentNet)", "value": "b286238af9ae518c361a8106889c7d64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906628, "uuid": "f56ea014-2c6b-4c6d-8cf2-e07c06154b85", "comment": "Malware payload (SilentNet)", "value": "96d443a8f6fbb22ef7a1462d57b39591cbd465ba391a8c6e2c41fa3df7f92f0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906628, "uuid": "6105ebdc-66ab-43b9-a8f0-b566c907af35", "comment": "Malware payload (SilentNet)", "value": "8d94e524a7458a464c9395e2a2c71318f75111e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906628, "uuid": "5a20e27d-8590-4b5a-bdba-256542054943", "comment": "Malware payload (SilentNet)", "value": "c5f4d8aa3c3572d4bb3e8714fa279400247647323bd2d45b62837c70d25eea0daf034239068b66f84e9c867113d2599f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788906628, "uuid": "95bf7ada-4cc6-4257-9633-220455ca212a", "value": "T191357C83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788906628, "uuid": "7b5419cc-cae2-40ec-8b60-7775954ed37c", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788906628, "uuid": "4b294920-41b6-44ef-aeae-9f9d2ed5c21a", "value": "12288:Xbs/m0E54jwaFXGc8lEBBBHGBKq2IZwDavfqItNqdg:XbOVE5ifGPRZwGvf3fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788906628, "uuid": "383812f1-b9bf-4324-b870-67efdd01e329", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788906628, "uuid": "39e9d33d-4293-4fdf-bad5-aedef4a0d1fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788906628, "uuid": "3fbcc707-c1e0-4e1a-af5c-85d98be93670", "value": "fortnite loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47bc7307-ab2c-11f1-915e-42010a9c000a", "comment": "Malware payload (njrat)", "timestamp": 1788834209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788834209, "uuid": "18ea4ca1-c6df-4791-bb2b-ef3467fee04e", "comment": "Malware payload (njrat)", "value": "8954631e8ffbb6b865e2353f3d847f0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788834209, "uuid": "67dd3a6b-f2cd-4921-8c0f-24e77ef69b66", "comment": "Malware payload (njrat)", "value": "976eb41511fdcb1b13af671b963aca873d1830854c94fa20ea117bdad34d4ce0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788834209, "uuid": "edb65ded-a738-45db-85dd-a61e5d63b9fb", "comment": "Malware payload (njrat)", "value": "54f52128496ccc3cead33a43d9c858344d371be1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788834209, "uuid": "685b8925-9176-4ade-bdd5-8fe73ec053de", "comment": "Malware payload (njrat)", "value": "600ed556f8227b197a4c4b80f9142615efd1d49024aacea907b21ac3ae1bb7b2a1d8663a0943fc667101bd19291cc499", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788834209, "uuid": "3912629f-eb67-477f-8a32-25f8055d4758", "value": "T178232B003BE9C16BF2BE4F7869F221458576F2677602D64E2CC442975A23BC2DA425FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788834209, "uuid": "e6d806fd-4043-4c8d-8ecf-cdc3d886dc88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788834209, "uuid": "3c514f0a-499d-46a4-8267-19dd7fd26ea5", "value": "768:NukjVT0kLd3WULVPdVmo2qDK6B+lm7AUIB1PIbM09H0JTh0bBV3k6Au2KjI2v/l8:NukjVT0M912V2cUVbM0d22bBC6T2B2F8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788834209, "uuid": "39909077-f108-4935-8520-70463dd3ea20", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788834209, "uuid": "4b95858d-55fd-4063-b8ef-376634d17bbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788834209, "uuid": "1ea3c347-2f95-447f-9bc7-96b2124f2e4f", "value": "976eb41511fdcb1b13af671b963aca873d1830854c94fa20ea117bdad34d4ce0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e7d3ae-abd4-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788906635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906635, "uuid": "334a5bdc-63f8-4593-a306-dd641e92b63e", "comment": "Malware payload (Mirai)", "value": "fd89e49453c4c024366acffb8937ad54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906635, "uuid": "941ec0d6-a1a9-4aa1-a696-15ce4ae240d7", "comment": "Malware payload (Mirai)", "value": "97921a2cfacb0b73fc7d14e29b751862b4bd0f02972d2af64cfdf8e0e802ab6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906635, "uuid": "7f4778e2-94fe-40ee-ab09-352bb9d58dbc", "comment": "Malware payload (Mirai)", "value": "aa358203fee62684ccd938c682e935c99b3f093a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906635, "uuid": "47f1f79e-7663-486c-89ab-9e8155588a96", "comment": "Malware payload (Mirai)", "value": "65c756eaa5223796578739418fc2cc5189bcdf2e8dbc0cfdbeebb9370df6d5180c562f534616bef509bca23bea37db47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788906635, "uuid": "10135898-10a4-46c8-b3c0-2a5d1f3ace63", "value": "T186456C5AF2F370FCC467C030835BDB62B835B46512226E7B65C49A352D62EB01B1AF67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788906635, "uuid": "57930c4d-a2e4-499a-9721-9d936100127f", "value": "24576:4BjpPxIgdtwrgaIHjlvdkiwzqcQVRI8srFu:i/NGrgaIDlFkiwzqcQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788906635, "uuid": "df2b6ddf-eb6d-4c56-aa12-08b49349b3f1", "value": 1225872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788906635, "uuid": "ab45fee1-11f6-4a34-9bc1-5ef3d1e12406", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788906635, "uuid": "d230c79d-fbfe-4de1-9caf-0c5e429b9522", "value": "titan.x64-test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc467b53-abc1-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788898507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788898507, "uuid": "64254390-d491-414d-a9fc-543c544997f5", "comment": "Malware payload (RemcosRAT)", "value": "4ce17b862ae479db3b1a3e6ca04ff237", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788898507, "uuid": "83684c7e-b73d-41c2-b4f8-21b419461e4c", "comment": "Malware payload (RemcosRAT)", "value": "987b25afc109c9e949941cc4241fe20b00916a6e365814a5579e7f270064f635", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788898507, "uuid": "f02f06ad-f0dd-4c22-a95a-b5706da6d62c", "comment": "Malware payload (RemcosRAT)", "value": "5cac215725bd1a025409276435bd4dc8df09d7a1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788898507, "uuid": "c8f083d5-fd8a-42e0-b708-e6e78c366c54", "comment": "Malware payload (RemcosRAT)", "value": "0b8dc56b2a824d89bdb807e0546685ddab2a2201f67b7d342679a8dc1dcb6079473dc6445f4ebc85af7771a8d444beff", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788898507, "uuid": "7c74ebe7-646c-4704-b7b0-cf6181cf44d5", "value": "T190D6F6892B88D17273279BDC4AB9DCB0D90A914318D6CB1575BDD7183F3CD0BA318AE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788898507, "uuid": "b1432ee0-eb1e-40eb-9aa4-54fc868a66d4", "value": "196608:oZNZLcVmwItrTKqqs3O3+TZ5a+89zWJd0VgDsMcQnrSECIJrp+p7BfPKhkSO5gkM:qVc4rSEtJgp7BHKhkDaRl7+q4wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788898507, "uuid": "4a3abd1e-6c63-49dd-a4ba-87561ce9f3ba", "value": 12883463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788898507, "uuid": "d873bc97-1964-48fb-b45d-147c769c50e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788898507, "uuid": "498f695a-de39-4c39-9193-911df0a60fc3", "value": "POdoc011492202501161354020220906134 Product s.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2b0783-ab6c-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788861652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788861652, "uuid": "640ba301-7a2c-41f2-a792-83b99d96428a", "comment": "Malware payload", "value": "891883aed1cf876a8a93156c50bf7d93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788861652, "uuid": "6537ec9b-2a64-4190-92ca-39382aae21b9", "comment": "Malware payload", "value": "987f97e16091812eb8785cc8236d653981e2e39af4c3b8dd68c4cb47b3029fe1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788861652, "uuid": "0fc6b2c4-ea7e-4ef3-a591-c47b3f69deee", "comment": "Malware payload", "value": "5df0a88c9557f9465a167027019d63f350d74f56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788861652, "uuid": "da84e550-8840-4dd5-a97d-ee1ce30544b3", "comment": "Malware payload", "value": "be08b957064be1dd0ba5290a481933f3129919f142f9d9eb7cf2ebc61cb7d2d6a6105499518ee134b0dc1edec9efeebb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788861652, "uuid": "92c6efc0-8776-42fc-963b-fc8a3a74349a", "value": "T17DC20853A9C7F0FDC86982794187B034A273B039127ABD463BE5E72F6E7AE124F59401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788861652, "uuid": "9027499c-3d63-48a5-b2af-349b27a4092e", "value": "384:DGBwSak2nTZD+zagYIpTtr5WXv+zXiL3zh8YyMm:DmU1DEYsIHzzhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788861652, "uuid": "8a4bec47-2a22-4504-94db-2bc3cb5b618d", "value": 26288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788861652, "uuid": "d977fb04-2d9d-467d-82ea-cbb23c292488", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788861652, "uuid": "f619f85e-46b3-43b8-9d63-b6c2d76c94d8", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67477b2d-ab5e-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855737, "uuid": "cafb8a45-4d0a-412e-a004-4e6ee6cbb670", "comment": "Malware payload (SilentNet)", "value": "70e94adc71059a6c2ab58392376c0b60", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855737, "uuid": "8aff23ed-1f4e-4d21-9aae-9fe9156d689d", "comment": "Malware payload (SilentNet)", "value": "99cf1b14a534fdbd81bd8a34f39c2e6c779a128c241f206599f191390a64f9a8", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855737, "uuid": "b0ff3bd6-0256-45d7-9c02-3fe2b5fba39a", "comment": "Malware payload (SilentNet)", "value": "bd3619570219b76bf429b722d7d1700f23dd9569", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855737, "uuid": "803ea4a2-ded0-4786-ae60-5dbcd18f8810", "comment": "Malware payload (SilentNet)", "value": "77689f44a2b5ef62a16c49bb560fb3b73f1db3e9d19c31b0cfed3d70dd72e36eaef5a3355f20b776c4c09076e63628cf", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855737, "uuid": "888ae271-0f37-4d5a-9b21-6bf2fe2d064f", "value": "T1164633A2CFFC41BEF897AA760174C666A5EC69DC910DB03B01BD49F6240FE9A4F40D19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855737, "uuid": "5df6ddec-ef3b-44bb-820a-f8c6e3a9255f", "value": "98304:nOuwejS5HJUww7h+/zvdhwGpzu+PGnWIYnYsJyY8Ci+nD53v9OAVQUkeU7+Ek/oG:OJejSMww7h2dhwybtb7wYy4v9ObeU/G1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855737, "uuid": "cc692ce0-9f12-47cd-a937-3b3bc0767e22", "value": 5625430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855737, "uuid": "a43e1a53-7f1e-4e3e-8a46-52a21b8c2f8c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855737, "uuid": "de2330b1-4a1c-4048-bb95-0e10503c65e6", "value": "FrostClientV2-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d7412c-ab8d-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788876156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788876156, "uuid": "24a0a2ab-7da2-481b-9694-98f07c61fc66", "comment": "Malware payload", "value": "27c4b1c91f312fec582081ec82c2eba2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788876156, "uuid": "f5d8f7c8-1d5d-40dc-ab5a-fe3214cd1c26", "comment": "Malware payload", "value": "9ac30d905e82b61540dc6b0ae9d2ad956f6013532ba5fdca29ab182713c10787", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788876156, "uuid": "affb6778-385a-48ce-9917-1c9a73f94f6d", "comment": "Malware payload", "value": "2852f174da567f8d12e3c92449ae36c2a52abeca", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788876156, "uuid": "c9713f99-1a70-4634-9e74-c105efcda019", "comment": "Malware payload", "value": "3ff8f91da39ce4917e75d737cdd64a19a009398b50845b7cb325d8bdaf64d6c58fe3ab11afd665d7d2af1b4e626c7079", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788876156, "uuid": "55162b7d-89ca-4f0f-b4cf-237be9a8cce7", "value": "T1B083B622388559B425CCDE6C49FA5C502739C00BCA1A2D2CF05EE5D83F76A78F5FA2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788876156, "uuid": "74f61c60-a8f8-46f9-ab59-80ed377c9ea4", "value": "1536:mUEDcQPyTuvb6jes5lRUH5Dvf00NRwaEo60D:mW0E5lRUHV00NRwaEo6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788876156, "uuid": "d70ededb-c34f-42ed-bcaa-f585d412189f", "value": 84649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788876156, "uuid": "7031bf4e-9df4-46fd-abd6-b257d494654e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788876156, "uuid": "1c7daf95-4ec5-4468-bcd6-a978ebaa850b", "value": "install.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbcc5ef0-aba4-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788885997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788885997, "uuid": "7b90a513-1daa-4cf7-9641-4f4553730f64", "comment": "Malware payload (Mirai)", "value": "7d1ca1fe746c7a259a6db9ccef068e5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788885997, "uuid": "7c8fcf4a-cb96-4390-9a3b-c7e358b8b34e", "comment": "Malware payload (Mirai)", "value": "9c472fe23c89c20424a6d24a27d87d847e8a4a514a4729e92c9f10b3b6fde67d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788885997, "uuid": "12f5209c-9f6c-4056-aef8-d9d00f841104", "comment": "Malware payload (Mirai)", "value": "ebe752a6bf9bbd6e7b5603449e7603e98b191485", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788885997, "uuid": "e5fd5989-efa4-4fcb-93e7-bd7fced442a6", "comment": "Malware payload (Mirai)", "value": "992101868e7d79987eb693d775264f845f398e51aaa597afd950bb84dbd62f6401a901243dbe7044fcb89da6a665cbce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788885997, "uuid": "7533eb55-b23c-4dc8-a9ef-9ea9c4bd4811", "value": "T116B26BA1CF3A1E68E26843B4642187345B93E826B74F0EBE162FA3518443DCDF1567B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788885997, "uuid": "7db62512-c4a2-4471-930f-baba94014d1e", "value": "384:OK1lMOITjIfe4Q5BC0ViWrzP78F6jIrRXoms12NXCvVXthdr7FDot/yXqBCv7dF:OK1KOIue4QLCDWO6jIdnVSXroNSjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788885997, "uuid": "c19a3779-c748-40aa-81b1-bf2168223934", "value": 24556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788885997, "uuid": "e37ea9c2-d01e-4390-9aef-12b6c9a2f2a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788885997, "uuid": "834de42b-9cbd-4fcc-a341-8fbd6f4d0f0f", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b60852c-abca-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788902129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902129, "uuid": "7c2bf468-42e8-4b12-82fd-5e9b9fee2377", "comment": "Malware payload (Mirai)", "value": "87fb28c7a73c9426594cba2dc9a14e30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902129, "uuid": "5d7ecd02-483b-4399-aedf-f8a3f1559c56", "comment": "Malware payload (Mirai)", "value": "9ccc4db28c8da295f73b0180fe7812f2668910726cf8e7d410b27e2d059369ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902129, "uuid": "ed93a5ef-09a7-4f9c-a544-d2f201f705d6", "comment": "Malware payload (Mirai)", "value": "fb14206f810d76c51c3c8b64efab6215e4778110", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902129, "uuid": "6f3d3a47-66db-4a4b-bf08-f2835df666cc", "comment": "Malware payload (Mirai)", "value": "9677c8992eb9e462d9c7746aca435717d1acef1131ae86bed317e6cb6266dd154d20169ca512118dc43653abf3468c22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902129, "uuid": "69f3e76a-d18f-4650-8a96-7df6b902c44f", "value": "T1D044085AF841CE21F9D116F5FA9E42D83B2303FBD7FE740699050B742BA785A0E27912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902129, "uuid": "8bbb120c-c9f2-4129-894b-a6edb1841b33", "value": "6144:ww+W0lgqsEFx+gduhCj9LRAPJ3X9iPO5QeL7NQsRC80kyhTQOmw/UqK0:w9B9LRAPJ3025QONa80kyhTQOF/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788902129, "uuid": "e869661f-8b00-4572-b111-952471a65834", "value": 276160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788902129, "uuid": "9d6469bc-eb5a-4e0f-bcec-a1276e235a31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902129, "uuid": "4178d874-fe44-47d9-9ef6-34e0c1cfdde7", "value": "titan.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ce81f3-ab35-11f1-915e-42010a9c000a", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788838043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838043, "uuid": "cb52ab81-69d2-4047-afd4-9daf22fbc273", "comment": "Malware payload (RemcosRAT)", "value": "8549b8229be85caa0c095bfd1d229cf6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838043, "uuid": "27e2ae38-4019-46a4-885c-e9fce7bb94e8", "comment": "Malware payload (RemcosRAT)", "value": "9cdb768128aac2350badeb1b8eab186e80bd9d223dbd0852175c0b7ed7daddb6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838043, "uuid": "6cfe543e-425b-45c0-b0fc-39c136f0db5f", "comment": "Malware payload (RemcosRAT)", "value": "8ecad22d8014e35450ccfe22da3ac8253af1cd4b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838043, "uuid": "2716edef-0ada-4e41-9620-1b16d1ec30b8", "comment": "Malware payload (RemcosRAT)", "value": "246af32092a7037dc2c96b78950a091aca8ba05fe294287cd321ec285f1311dc00f3f5936d9ac8553dbde017ec6cecd0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838043, "uuid": "6c49d8f4-85fe-441b-9ab4-34b6545c30f1", "value": "T1C4A73337DF4F95B1C1F6EE2FA82F2E1F112A332A40E5018109961326EA6EE74146577F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838043, "uuid": "e9a01e05-d635-4975-903c-b68c51c746ab", "value": "3072:4wCVSMUSGBES5gKQ6EcFG1lAtJazaP53eOB2ai+balFzHijRILDn/PgLNnwInyN6:sai+balFzHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788838043, "uuid": "1b80fc49-4f5d-48b3-a019-dc6f9486f405", "value": 45012564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788838043, "uuid": "e7f4962a-a341-47ae-b36e-79380cacfd3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838043, "uuid": "4d69cd87-c707-472f-abef-6e4654e53912", "value": "FedEx_AWB_doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f4d2c8-abda-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788909214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788909214, "uuid": "971cb792-87ed-4935-913f-240656016695", "comment": "Malware payload (Mirai)", "value": "0e393a3c9daec276e02d9e071ff204fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788909214, "uuid": "818bc602-30d2-408b-8356-e459a8a62869", "comment": "Malware payload (Mirai)", "value": "9dea0a840f4925b3a5d7b25d9c6281838ec3247b6938c3883d7f3b98545e71b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788909214, "uuid": "46d2b884-908d-4119-afe6-fc6510f7e31b", "comment": "Malware payload (Mirai)", "value": "044550d34883c05943ab30e68c15ccf6a615f863", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788909214, "uuid": "43488588-f424-4255-abbc-d13cb269f16f", "comment": "Malware payload (Mirai)", "value": "b21012fc843ff0ddf6bc8ba1311bde95c32f6964d62c14afaa6fa81a03d2e4929bd4ffe51f912b2483524d45ed47eac1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788909214, "uuid": "39c27c0f-bac2-4dec-90a0-6dd81b9c86dc", "value": "T101E33B16FA808B53C0D61B76BA9B825533239B54E3E733069928BFB43F8375D4E27506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788909214, "uuid": "4da91d4b-fd2c-4dcb-b68c-473377a18583", "value": "3072:/sRsUR6aaibTkem39Lz44L1NXWSJPvM/9xz0R810:0Rb6aaibTkemtL9nmSJXM/9v10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788909214, "uuid": "22c21e50-b71c-4dee-9457-f3a2ddf3209c", "value": 148716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788909214, "uuid": "b76c91b3-8c18-471b-8646-dd5ef28303ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788909214, "uuid": "f352dc50-c9cb-494d-8a5b-15b0a50652a4", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527bae75-aba6-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788886626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886626, "uuid": "b8493cac-b663-4871-89a7-210a845a23f3", "comment": "Malware payload (Mirai)", "value": "61fbb51db995c823d839f1971e284277", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886626, "uuid": "a037d78f-84f0-464b-ad1b-688a6fd91639", "comment": "Malware payload (Mirai)", "value": "9e4413646e9515b8dd5edcb2f6d57d13a5e301f5635c762ba91b623bf0d439c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886626, "uuid": "ea8756f5-3baa-4248-bd37-0a239f8e7bfa", "comment": "Malware payload (Mirai)", "value": "dbc01ac8646144de3cbb95cf22be33053a4bed3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886626, "uuid": "0935c14a-1e27-4c01-87f7-9974ca5906fd", "comment": "Malware payload (Mirai)", "value": "e5bd9bde0b3fe8850a3afc3007f75b596ce43f8c994e2ba11f2558c8f6287cca391f553058dd2b9f51319abc081d2630", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886626, "uuid": "21550cd3-7422-4082-af06-417570c18ed7", "value": "T186144C45AA808E53C1C527B7BA9F414E33329758E3DBB2068D285F7437CBA5E4E37606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886626, "uuid": "831c66f0-6cc2-4d74-a7f6-eb5704170b44", "value": "6144:uEYi6570lQHagGAfoLmpMguHcUbVUHalw7WyuH0csfCTTU9wlCzos/wpgT2/s2yM:uEYi657cQHagG4oLmpMguHcyVUHalw7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788886626, "uuid": "b5fe9347-4f19-4dcc-899e-f347db1b9a81", "value": 207750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788886626, "uuid": "01f11b05-929b-4dc2-bb06-081e4c37055c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886626, "uuid": "6b929320-9013-4c30-896d-9574908b0bc6", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f216089-ab98-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788880500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788880500, "uuid": "be2547b7-963e-4b34-b021-3675ba11cb63", "comment": "Malware payload (Mirai)", "value": "00c9da969663f4db1991b7bb62c9bf0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788880500, "uuid": "3f8befb1-0495-4d14-9af9-5ff857e5125d", "comment": "Malware payload (Mirai)", "value": "9eb52cf2de2b3770c5884fbc88b0772aed3953b9e36ab489223f9b7ab994c59d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788880500, "uuid": "0628f046-a9ab-45f4-83d2-e4bb4092526d", "comment": "Malware payload (Mirai)", "value": "4807b340409b44f93d9b82119e1f938858522b9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788880500, "uuid": "874b059c-95d3-4775-bf98-cea5159cd2f6", "comment": "Malware payload (Mirai)", "value": "3bc8a9508fe2e7d93b60ff806e099f0884132c2dabd09ca475b5485d7d1a5e9d014f2c1020dafb8a62c5ddfbf7b13f66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788880500, "uuid": "421e470e-0029-4b87-b3e9-eee458dbc4c7", "value": "T14BB2D091D028C0F4D6E15D7ABC62920F2D89A3F8F5EA3204AC0997D83AC65870FFC685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788880500, "uuid": "153f5982-6d02-48cf-a5ea-22ba5eb569d0", "value": "384:6xx7u5kN3kf+RSYe5FGURjC1r1hPbqerEzECYHmvfQRFpYmdGU53DtB9ecH:eu5S3kWe5n0PPfNK4FpY3UfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788880500, "uuid": "a11c74d8-bf88-4203-a235-adaead42f87a", "value": 25292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788880500, "uuid": "63b913ab-00cb-497d-88d3-5a891119478c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788880500, "uuid": "185f4b6e-b9a4-4d35-9e62-27e90023d050", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ebb875-ab3f-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788842494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788842494, "uuid": "8f194f8d-2986-42ef-b17c-ecc7508813ee", "comment": "Malware payload", "value": "98000f99d9a9f11f5463d4a13a6a2183", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788842494, "uuid": "81a7a26c-614a-4a0f-ba79-46566b25b81f", "comment": "Malware payload", "value": "9f1cfd0a8a372bc87c384b08714414bebfccef308bfa50a87f8cc7ebd6825b22", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788842494, "uuid": "0d1ef288-2115-4f34-a273-060c2b9be6db", "comment": "Malware payload", "value": "db4b726278b48127e592293976bdddd1cf5ab489", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788842494, "uuid": "f9c3c548-6acb-4108-acfb-7d0cfde60ac5", "comment": "Malware payload", "value": "783b2e2a47aa3c1daf094ad0da7fac72829d6702c442973ae071ced5ebf415b2068d52026c79314625b4b6d404a8b4d5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788842494, "uuid": "2eae7d71-040b-4257-81cb-79c74089ac9b", "value": "T171B1959D5BB7520086887E7074FF21C850E35E8527A40E2DF6DAAC71C88B9C1F17AB1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788842494, "uuid": "72643c0f-820e-4ad1-8eae-afaab2a3bdc7", "value": "96:awDQZXyJs1I2CZ8LmQhyUhVm38kIyZSDXojW1+wEZ+LMmhy+hVc38Cpbo3oXZaH/:awDQZXyJs1I2CZqmkyYVmMkIyZSDXojy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788842494, "uuid": "726be909-158d-49d7-9091-beadeb004486", "value": 5180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788842494, "uuid": "b3de9715-9dae-496a-8eee-cbab13a1d0b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788842494, "uuid": "c18d0a04-650b-42b1-af20-cea89d7de7d4", "value": "lterouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03cea98f-ab51-11f1-915e-42010a9c000a", "comment": "Malware payload (Formbook)", "timestamp": 1788849986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788849986, "uuid": "a7264dc3-4640-49d6-9abc-e558133d4646", "comment": "Malware payload (Formbook)", "value": "83b5deccf643e9ee89bbedebad07a727", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788849986, "uuid": "593dccd7-8d0d-4d7a-94c1-7a71e04e0cab", "comment": "Malware payload (Formbook)", "value": "9fd56099a09d95c176edc8ef6486393f79db311c6243453c697358c411d6378d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788849986, "uuid": "80ef057e-f19d-4cb3-92ef-16b798db8f5d", "comment": "Malware payload (Formbook)", "value": "96862fd5f2765d53c5eef4b030aed2f3013b06f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788849986, "uuid": "ca86cc61-b9c8-4911-9f65-2cb33b9070b8", "comment": "Malware payload (Formbook)", "value": "44ebcbee4ce620864a86ea3f15de03a626c4d631b11060ffba577edfe232b3de56ec3c6149413861285be94b52ff984f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788849986, "uuid": "7aa96bb8-70f4-4745-8076-e5f39c280df8", "value": "T1B14512246326E412C62497354AE2E1B407B84ED9F412E317AFE87FDB772AF160E44787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788849986, "uuid": "d46266c6-cbbe-44d4-9620-b77ca7f8e6ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788849986, "uuid": "6a45303d-d98b-4463-9d89-8ad71d8fbf2d", "value": "24576:ysAqj0qdPtD+t6gLvYIPpGizWUlR8fxPcpsKAPw3XAKOcYhGHY:rXIQIPDzWYR8fupsKLXYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788849986, "uuid": "a42b7738-f075-4467-b037-2ea2bd0a72c6", "value": 1233408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788849986, "uuid": "e21dd5a3-9a8c-4764-add7-df38bde33c48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788849986, "uuid": "8483fd44-0c86-4414-a11d-6c34823f4c18", "value": "Shippment Documents Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e15d4b-ab83-11f1-915e-42010a9c000a", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788871790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788871790, "uuid": "67e5d3a7-2e2a-42be-93b4-ddfc3dc6fd66", "comment": "Malware payload (AsyncRAT)", "value": "95a7e7662a21d7c0e589275e80f9d9f0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788871790, "uuid": "00beddd5-5834-4600-acd8-17ab5a2e3a38", "comment": "Malware payload (AsyncRAT)", "value": "a01800943355f4b93674511624a7d29da702fafb6c250cfcc6e11fbc60a951d9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788871790, "uuid": "58d14505-14b5-42e4-9bf1-3ba051682af1", "comment": "Malware payload (AsyncRAT)", "value": "347f645d6843692eb3714b77c01b8e0b2ada7ceb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788871790, "uuid": "f70753ce-9488-4466-963a-42701bba7040", "comment": "Malware payload (AsyncRAT)", "value": "e4f3ed13127ebafa32601f8583af21131d0d650e9897f6f8ca3110f6d49c59af87caac3b27911b85e473bb72e1c93fc7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788871790, "uuid": "a0988dbf-e485-4fc0-a897-60c0ccbe3f9e", "value": "T10C25D019E7E405F9E0B7E578CE838912E7777C494771D68F03AC69A61F232908E39B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788871790, "uuid": "6af33051-f4e4-4263-b5de-30850da7ff92", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788871790, "uuid": "49dbf9f0-d5e2-4599-a8a0-3cbbe56ee8c6", "value": "24576:TnvS+55BpfRX95rDoKWdc9Lzt7s1joEAq1sDU:rKA5/fBj0N+3CjoE/1sDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788871790, "uuid": "81aaa481-3384-423f-9d52-2e2ea473bdfd", "value": 979980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788871790, "uuid": "655b91b0-d6fd-4beb-b672-95d27ff6136f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788871790, "uuid": "5cfd9832-af0a-4314-8c1b-3531a349a6b3", "value": "TenioDL appcompat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16184682-abd9-11f1-ab4f-4201ac107002", "comment": "Malware payload (SilentNet)", "timestamp": 1788908429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908429, "uuid": "2456a84e-9d01-484c-862b-eb4f7fd1ddae", "comment": "Malware payload (SilentNet)", "value": "a473e8b985ff965ee8c46a69a55ee874", "object_relation": "md5", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908429, "uuid": "3b000868-eaaa-403b-81c6-46474331a81b", "comment": "Malware payload (SilentNet)", "value": "a0d5fc7c7125ea1b4803a4059db8a3b88282e0fb13df14c02d334a368dbe2cc8", "object_relation": "sha256", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908429, "uuid": "b1767507-a9f9-4a4c-97dc-8cd9570c9111", "comment": "Malware payload (SilentNet)", "value": "ac862e405f1c5cd8a6d28971fe8126962e19eebc", "object_relation": "sha1", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908429, "uuid": "59144f8e-4efd-4393-93dd-3ee594519fb2", "comment": "Malware payload (SilentNet)", "value": "06cbc7dbc00b09fe0b6cf11d38fd83f93df6d865110214273d78c083ad3124248ac39b26c6635f9f989d2f7e6065d611", "object_relation": "sha3-384", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908429, "uuid": "51a79322-ce1f-4f6f-8946-cb57f88478fd", "value": "T1A7A4E0DB974ADEAAD13F577804531FC1BA083385E806706F0E64F24B943B98F2735A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908429, "uuid": "89ca1539-a990-4456-8887-eb32c840d3dd", "value": "12288:jI03xmwspYR1DcAd2kyzZQh/U+hzFGMlOpfaOc:jLmRpYRFd2kyu86FMpCOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788908429, "uuid": "5ec8f911-9de9-456b-bbeb-ecaaa9856fe9", "value": 453480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788908429, "uuid": "cd33e0c5-47fa-4aae-9cd9-c7206e209611", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908429, "uuid": "71279442-344d-4dd4-a6ff-02eeaeb2f2cf", "value": "meteor-gui-addon.com__Meteor-GUI-addon-2_2_0_mc1_21_1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be0ddbd-abd3-11f1-ab4f-4201ac107002", "comment": "Malware payload (NWHStealer)", "timestamp": 1788906022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906022, "uuid": "a598ccc8-5308-4782-9f86-b46f36aa2343", "comment": "Malware payload (NWHStealer)", "value": "6b2fbfab939314234562e355acf91af3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906022, "uuid": "470f42f6-8eb3-42a5-bd3b-efa0128a1573", "comment": "Malware payload (NWHStealer)", "value": "a19fce7dfd85822b3dcc3fad77b0d91ac2740fc5a739f5741a1d3294ca2135bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906022, "uuid": "4d68c55d-9caf-4d19-a2ec-31465770ae3c", "comment": "Malware payload (NWHStealer)", "value": "a93c087ff20cfbb42937c7e8c102d562c215a6ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906022, "uuid": "bd2b5afd-e8c7-4715-820a-4aa9b1825443", "comment": "Malware payload (NWHStealer)", "value": "50a11feb81db68b4cc87cb13e1624c9b30d4a2c7514cf16eef1e168f50e68cfe8798205d5582f15efd629da1bc0576eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788906022, "uuid": "15a62f38-30d5-4303-9ef4-81b1636c86c8", "value": "T146286C43A2E751D8F0BBD17496E65323E933BC490B3469EF12944B312F72AE0A779B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788906022, "uuid": "734b86c3-9494-4f02-b840-3f4c00437d48", "value": "fd6f6d07cc33ee9a2b65bda58a07bb94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788906022, "uuid": "eb9daeba-fe91-4906-a6a4-e36a5626465f", "value": "1572864:GZa7hmguP2nG0/Vyv7UhgxIabc/97Awb0:GZa7hmguP2nUOTAwb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788906022, "uuid": "5447201d-1832-4f86-a785-fe9bb3c3eaed", "value": 97949184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788906022, "uuid": "9a275759-9bac-4cc0-ba6f-4e993adbb602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788906022, "uuid": "adb30569-5d24-42da-b825-8c8ebdc3adcb", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45322fc-ab64-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788858550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788858550, "uuid": "71583402-5d4a-48d9-bf9f-99175878c76c", "comment": "Malware payload", "value": "48ee41955c543a13a5e5159ddf24054e", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788858550, "uuid": "f0329beb-f5f0-42cc-919a-771005f3218b", "comment": "Malware payload", "value": "a1ee3d64aaae2a8fbe1c015622a7cf0e842a2ac417df341160163bbe0d1dd652", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788858550, "uuid": "ff57b1c5-2246-49a4-876c-a3ac8627f56d", "comment": "Malware payload", "value": "244330b9f497718f6858ea3b2e29e5073b290bc5", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788858550, "uuid": "314d0828-34ea-4a7f-a10b-3f781f68959a", "comment": "Malware payload", "value": "b9997cdf07d88658873c38d67be016b9cf891645d92eed207320e894a7b8a494f1e7eb3bfba4fe8335d1d03063b411f6", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788858550, "uuid": "6a1d8db5-19bf-444a-a28a-7e48aea1a227", "value": "T14C08AE15E3D84B16D67FC27CC2638512E7B1B8421362D7CF0495EA992F63BC1AB36263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788858550, "uuid": "5f8cef8f-34d2-48da-8144-99f1f1b1ad6d", "value": "a604b4697f94922aff3add61321029b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788858550, "uuid": "2fea3d09-3f6d-409b-9ffc-67879bafb32d", "value": "786432:7biI/rq7FsKUXTjdJyFV1OH0n5fj5P14Sn7V:7d6FsLGFVHZHZ7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788858550, "uuid": "d2d7edf7-ec5d-4067-9ebe-769405afb9b5", "value": 78931184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788858550, "uuid": "1e62c3c7-c263-42b0-aa8d-eb590937a5c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788858550, "uuid": "37fe2fee-3ed4-47d3-bbd9-49130d6406ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aee58ae-ab9e-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788883123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883123, "uuid": "5fb4457e-2d91-4a64-9610-3f7c404069f3", "comment": "Malware payload", "value": "9561f827804a198e3be1b9342c660981", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883123, "uuid": "3d4601de-11cd-4d91-810a-199be5bdf3b3", "comment": "Malware payload", "value": "a2fa794887ecb96a4b40389fe152e52707c021c86f63c4430557e7c286840b96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883123, "uuid": "101a1feb-d773-427d-a9ee-860e32faa5d4", "comment": "Malware payload", "value": "35a5b41d23418e5eec809fd8a95f31e67f8fbd79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883123, "uuid": "7acd8e4d-9653-43ce-a060-0bdda4df94ef", "comment": "Malware payload", "value": "5a8d97acea313cec50751a9673a74e5070bf337f151fd60184c17a23c4a5df808e770d47d782509df57f860f3eeffc9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883123, "uuid": "d0f70902-ce00-49b6-a824-7799765d4fa6", "value": "T18BD52296B9F229B0D836CBB38F86F07DB0293B9907700D9BB2CD59048C636556D76378", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883123, "uuid": "13f8a260-1239-4c42-a9ce-c38f421cc502", "value": "58f4b17816a07f7a36dd14e504d515e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883123, "uuid": "7f683bdb-2d2f-4e98-b1a2-7916518b253c", "value": "49152:9nmowHHEkCHgoKojU6yKqyBJyvsHXV119h06fbJ9V4f1t6vJfC5FfD8Q:NhwqgoKYPjyoX/R08J9VGS6jfD8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788883123, "uuid": "99531b84-6e3a-45a2-8d4a-f2a908ddd824", "value": 2937344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788883123, "uuid": "0b9ca7ff-e8a5-4397-bb57-b8b39ab48a0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883123, "uuid": "461d965f-f807-4056-a128-152ba98b7862", "value": "a2fa794887ecb96a4b40389fe152e52707c021c86f63c4430557e7c286840b96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5a9a7c-abc8-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788901492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788901492, "uuid": "43f74470-68d7-425b-92bf-1e044bb47d6b", "comment": "Malware payload (JOMANGY)", "value": "05d6c116f6c38ab44644e3287e18931c", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788901492, "uuid": "467f4828-ac5c-4d1d-a132-0a1e3ef91e60", "comment": "Malware payload (JOMANGY)", "value": "a3d1af638d5f16e7e2aa9aea53fe2da960f4068e628ff9c6a5cf9a696a198cb1", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788901492, "uuid": "b888a905-421e-45be-ba81-5e8986fa32d3", "comment": "Malware payload (JOMANGY)", "value": "7dfc896b1042b2d38d1143c071bc533e00cc95dd", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788901492, "uuid": "2009cfd0-b106-4d7c-af8a-2bb162bf50b2", "comment": "Malware payload (JOMANGY)", "value": "fe0e2d23bf41c4ff502534f5825c97f8d6f6f84a135de3d56e227c6721f65b005e1b55ed81d511d5ae6ff7c8f95cc503", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788901492, "uuid": "f6a5dce6-097c-44f3-8eab-9565db7e6ece", "value": "T1BFC27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788901492, "uuid": "22abea55-4b1d-43d3-874e-c52113e451a7", "value": "768:58vCB+25j6es8R49FYpMSUpi+20qUpi+20YQX:58l25JOd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788901492, "uuid": "3b74f366-db83-4855-91e8-fe3ecde266be", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788901492, "uuid": "8719ad6b-b454-4215-a00a-c732b53cc7b2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788901492, "uuid": "582e5360-dd19-48fe-897c-2b6c8f1eaa49", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c40e59c-ab3c-11f1-915e-42010a9c000a", "comment": "Malware payload (Gafgyt)", "timestamp": 1788841115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788841115, "uuid": "8bb4a1f5-63e4-4367-9397-324c2d62b77d", "comment": "Malware payload (Gafgyt)", "value": "9b86dc00c3aab43c435832050d26da89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788841115, "uuid": "91ce8ab4-f3d4-4a04-9c0d-ac7dcedbd2eb", "comment": "Malware payload (Gafgyt)", "value": "a45b75f0b026f60ee55e492c8f22349b7660a8e40715af01962ed584e9f2a66f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788841115, "uuid": "b8e75315-edd0-4de7-8877-42afd946860c", "comment": "Malware payload (Gafgyt)", "value": "401c73ef936b3965e3be11ff6eb7c87e8f594d19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788841115, "uuid": "9d2a595f-4f96-4510-affc-c181d97e0b7a", "comment": "Malware payload (Gafgyt)", "value": "f073896232828bcad14a1069db724865757ba492cc47dc9e7a277032e654a734bbfbdd4bfe8ca97581b3b1592711f80a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788841115, "uuid": "890be428-f39f-4259-b0c4-aa61b0084960", "value": "T11AD32A00F9908767C2C2177AF79E429D33336B64939B33359A24BAB42FC179D1E39625", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788841115, "uuid": "6da770ec-1e4a-4d90-9328-5bfd86f4fe1d", "value": "3072:RsW75amgzyUN5mVcv9amVe2xwihwTVwGqliCcPYXzmsQTi7aHgp:F0mVy9amgGwT2Gq2YXzmsQTi+Hgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788841115, "uuid": "79e0983f-3a01-4724-8eb2-b77e29bc31fa", "value": 130876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788841115, "uuid": "6f827aa4-212f-4834-a4fb-c6e04703a277", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788841115, "uuid": "187aba9b-3a84-4728-9e69-7eef9e89e1aa", "value": "kworker", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42338557-aba1-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemusStealer)", "timestamp": 1788884451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884451, "uuid": "a7d79dff-6f34-4045-b999-97487221b349", "comment": "Malware payload (RemusStealer)", "value": "9ff63cf7a5ea46e7736905a5e5cbbe49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884451, "uuid": "dd329705-2fe2-4ec7-9fc6-2155d204ae2c", "comment": "Malware payload (RemusStealer)", "value": "a5c49d510384172103726857fd054cb8b28ea950d7d80497e785304af80002db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884451, "uuid": "96193d6f-4275-4f61-bd41-dceda8333aee", "comment": "Malware payload (RemusStealer)", "value": "b9d11dcbd71e1509227ac13315b6f2cdfd3a7eff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884451, "uuid": "42dca043-1b06-44f0-abdf-2a99e6a4964b", "comment": "Malware payload (RemusStealer)", "value": "323388e115460cab3d81f8406fbe420c2a4b578b96f2644856d12a4124b8f375bb1e307024796accacd8dab4ef4ce2fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884451, "uuid": "ca5d94a2-e95b-4f41-9bea-23703033dd4c", "value": "T1E8062A037B9085D8D85AE239867B42A1B635BC5C9B32B3E71B8079743E737D1A839F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884451, "uuid": "e404f438-a6f5-46bd-af1d-b5d9867d83a7", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884451, "uuid": "f2fddbc9-62ba-4ff3-98f4-052b2a809775", "value": "24576:IZhUIx8LRgtn5XnipHq9cNNpXUWN2tKhOOWdp3+XZr1ayVpD2MnxwZdMtPyBVMgB:IZhRx8LGtn9p9cNN70t2OOWdA6JdVS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788884451, "uuid": "a669b9d8-4f22-428f-8a37-98f35be8681d", "value": 3737512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788884451, "uuid": "90dd607b-e37a-4f34-846d-60772a43223f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884451, "uuid": "b601af1d-45f4-4afa-b267-079ca266d7a9", "value": "xcutorsLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a0709a-aba6-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788886732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886732, "uuid": "0f1db1bb-bc1b-408c-b317-9cab24a30847", "comment": "Malware payload (Mirai)", "value": "20addd1a8cf4ee8c96a3deefda6e5d61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886732, "uuid": "b9512206-f06d-4e98-aeda-27b4358a863b", "comment": "Malware payload (Mirai)", "value": "a7155d37b823212b5db29c531d63f13bb30921513dc0dd9ac9e7b4cbfc97bfcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886732, "uuid": "2cb4fefb-60eb-430c-b501-a053b9fadfe5", "comment": "Malware payload (Mirai)", "value": "4e6761df1cd2da2dc0f7b75eb04973f7a9c22251", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886732, "uuid": "35f66bf4-90ca-4ae2-84c0-b98b6d3b3619", "comment": "Malware payload (Mirai)", "value": "59061a0ab38412f62cdc5ee8cc4cbf03e140387cbaeb3f756f71fb76d5835e3e905be21f3c63aff7455cff2289aacc9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886732, "uuid": "8b302523-a44b-4423-be4e-3b1579fd40ac", "value": "T11753F1A905728631DFD41172BDB38443F6A5337D89D8BBE319D0A97E9B2D6D3888C206", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886732, "uuid": "b3a48095-787d-41a3-8020-fda1696e6361", "value": "1536:snip/33UqAtPuG1wp4cwvlSoQf9ShxSfiVsYVL5bjJn6:siJkF9uG1wpkI0vSfEsYVRjJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788886732, "uuid": "93f313d6-eb65-4a3f-9159-c8436b27b62f", "value": 63984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788886732, "uuid": "73dce881-d0fc-48f2-8f9f-6c247c951f3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886732, "uuid": "cf8cda6d-0bba-42b3-a18f-c3a48c199e04", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc78aa3b-ab34-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788837895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837895, "uuid": "037f1ac5-ba76-4490-99b2-c7c17402623f", "comment": "Malware payload", "value": "9cbea1132205ea0a204a4312bb31ef7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837895, "uuid": "17071f16-613f-4f35-93fc-147268d5a427", "comment": "Malware payload", "value": "a724532c00f17cd82afeb84b8fb81b7f154dc4331bac8fb7bcb4e2aac160036e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837895, "uuid": "a2dfa2d3-2028-49ef-b6ca-bca8cb9feeb4", "comment": "Malware payload", "value": "b454c017f447470f9b6e6492b3a7274f3a3a8283", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837895, "uuid": "945871ee-c2e1-4e96-854c-5a86d79c48f1", "comment": "Malware payload", "value": "2776f276b87ca918e09c573634edc72d59a6af9a272fe2a0f8494d589bee6fd022bf564a167e1268a89d805934aad7ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788837895, "uuid": "86622831-281f-4a10-a006-c6cc1802ed19", "value": "T19F5633E33595C15AE85144F9D007EC354FA17C1C9F7AA12B3E8633AC1A335AAF91AF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788837895, "uuid": "75081ce9-7ec1-4295-997b-960aa1f00ab1", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788837895, "uuid": "7bac8b92-16f1-4086-8401-2abdefd28b5f", "value": "98304:p0Om7Eu8CUXGbA6DfQ5M0SMPPBxyhMrXqfgdt88kC8xLMauVn+nhgfTfgrKQs9p2:p0Odu8pyDIM0SjMrXPzkhMauVn+gbock", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788837895, "uuid": "1a547bf4-ae62-462b-9be4-aadfa2f9266e", "value": 6180478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788837895, "uuid": "37cd92fe-0565-4119-9e72-d4ecb92852fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788837895, "uuid": "468b69f3-d971-4e6f-a281-8fa20d714fa3", "value": "a724532c00f17cd82afeb84b8fb81b7f154dc4331bac8fb7bcb4e2aac160036e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee0dc49-ab4e-11f1-915e-42010a9c000a", "comment": "Malware payload (ValleyRAT)", "timestamp": 1788848743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788848743, "uuid": "65580108-f734-49d3-b64f-4169f27ed9b4", "comment": "Malware payload (ValleyRAT)", "value": "f2de0ba4ee33a037a540807c546c3ea7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788848743, "uuid": "b7155e7b-1321-42e6-9124-7047ba26a387", "comment": "Malware payload (ValleyRAT)", "value": "a72547c70d47fb619a61fd693791d33018afe65d4b5d2ff298e8b440a1117047", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788848743, "uuid": "02e9f6cf-b0bc-40db-87b5-5c191ce862bf", "comment": "Malware payload (ValleyRAT)", "value": "f44195b7f64758cff9b8e3d98acd7274481af736", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788848743, "uuid": "7c010a59-b7d6-46d2-94b8-cfbafba8df35", "comment": "Malware payload (ValleyRAT)", "value": "7652936a26256bd72d09ec44dfb1f9e566d094f5656948062d79f4fa1ec34be2c780c4af8bf508edd798c65e0d7b0361", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788848743, "uuid": "59fc1b1f-e80f-4794-a433-7a6fae325f91", "value": "T139A48C57B7A430FDE2778234C8A94A5CD7F27C32DA205B5F03A08A695F237918D6DB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788848743, "uuid": "d899c394-86d7-4959-947f-dc2b52a6ab5d", "value": "5313a4a748bf3ac229d0c56bb043bd29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788848743, "uuid": "e6bf42e2-e3fb-4ea6-b89f-24cd9a2eae8b", "value": "6144:zRKXTw/Vb358XbJwgzFa8Uj/R4R/HYX0Ayiz1pLT6fd+aVHql/mbiDqDHed:zRKDwZ35TUFarmR/H+0Af1ol+krHed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788848743, "uuid": "5a2c2335-275e-415c-8c46-6a4e73b7fa81", "value": 474624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788848743, "uuid": "fff9ac6e-f188-4990-bf54-8778d6d09136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788848743, "uuid": "47a388c8-3228-4f03-8a32-4396f66a0f5b", "value": "AggregatorHoss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb370e1-aba3-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788885274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788885274, "uuid": "61f78162-5972-494f-bb0c-c84b305c51f0", "comment": "Malware payload", "value": "2ac5adc70ed2261a14e61cc78004b0a1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788885274, "uuid": "3106db91-56c3-4db9-a599-7c13088aabc9", "comment": "Malware payload", "value": "a78c9cfdd6b80d1aea60021f68d9add17387d161250b7319a67b492595b53701", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788885274, "uuid": "1e761148-a9c4-47c3-99bb-fb10cbe0406a", "comment": "Malware payload", "value": "1b95eeda6814d4ba4719754521de6563d703a494", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788885274, "uuid": "516254da-331e-49a8-9cef-c84a0ccaf6fe", "comment": "Malware payload", "value": "ddca1225ea27db3166ee8c90edfbac689195f0075346078b7d2f5ea8aff99f118517ea2773a7f9e16757ee9d2ffaaa88", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788885274, "uuid": "f15e6a2b-c0d7-423b-ab4a-9d8002df697d", "value": "T1783181CF00541B310162CE9F76B37188A64DA2EB395FDBC49D1A0EBA534828CF666F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788885274, "uuid": "53e3ffb2-172d-405d-b747-a26a0e6d394f", "value": "12:U92769efb6xCTmeQ6aL66ahYwSEk6CNNi6NuBSD5i6BSD5z0268/TZ/6KANP76NI:Y26eVQUqZX4e5Xe5vTehyvl/VX5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788885274, "uuid": "d7533dcb-c76a-47aa-ac25-cf901fd5999e", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788885274, "uuid": "fcb9eff0-b523-42bd-a5ac-83ef5a492d94", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788885274, "uuid": "a004dfb9-f58c-42db-a3ad-6527b4f31d3b", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb31473-abaa-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788888634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888634, "uuid": "d1f4516b-f333-47f6-9e4a-7ed9122da74b", "comment": "Malware payload (Mirai)", "value": "c3e11e2f9d1be256a8352d5d6252df0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888634, "uuid": "0357b27a-83a8-43e4-8d1a-c652224a5eee", "comment": "Malware payload (Mirai)", "value": "a7d1bdc4620b99dee60f8244bd3efa3a4d2f6465da8d2b23f2b5aeee0e5b37f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888634, "uuid": "562d0099-3d65-4105-b5cb-3adf353e2b07", "comment": "Malware payload (Mirai)", "value": "ab14fa4fcf32d67c9b385c378c718f8aceb2d3e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888634, "uuid": "ed973292-ab1d-42f1-943a-b9ee71e8b520", "comment": "Malware payload (Mirai)", "value": "04bdc5b9e4457fcd8828e0154cb26b4f23ebd65185c5debcfdd592c5d1ac44413fad900d6b6aa263de6b809785fbfff4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888634, "uuid": "78c22184-e79d-41f0-828e-7999dbccef4a", "value": "T1C8E30945FC419F26C6D361BBFB4E428D772A17A8D3EE320399255F21379A8970E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888634, "uuid": "cb009aac-1500-4ef4-b469-47ab8dbb44d5", "value": "1536:NRzufMUWMzt2LLYA4V/OpFVUr4Iv6xJIi0aOcFeZ+OyMo8lNSFwywckQLP+/gS3O:bztULzta4gTe4Iv4IiPnObZwPKyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788888634, "uuid": "afac7e1c-0248-4cc4-b17e-8d39713fe543", "value": 154312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788888634, "uuid": "a757e180-190a-4a32-aa1d-da856addf3e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888634, "uuid": "788dd6a1-2cd5-4bf5-bc2e-c352c335d59e", "value": "647836d5995d0b9a9edd844ca1110b3d0a137e31421c64c683215c5f958782ac.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f5fb75-abc1-11f1-ab4f-4201ac107002", "comment": "Malware payload (ConnectWise)", "timestamp": 1788898149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788898149, "uuid": "f9ac8a97-e416-4487-9bf6-59c06a2cac45", "comment": "Malware payload (ConnectWise)", "value": "fb1c97347a2f8158a3a26752b6c44db3", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788898149, "uuid": "bcb78373-0f27-41fb-88bb-f601af1edc19", "comment": "Malware payload (ConnectWise)", "value": "a955dad7a3e578f1fc0e6e956d168bc395e940e7e9535049e50aeb296483607b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788898149, "uuid": "2a7bab39-aa23-4e9b-8f1d-168a94446e69", "comment": "Malware payload (ConnectWise)", "value": "bc5c046a24a83fbfd3e6fa724a1d1d2542b90ea5", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788898149, "uuid": "c173b687-2ace-4a6a-a34d-cdc4d09d1d77", "comment": "Malware payload (ConnectWise)", "value": "c72b66cb6c20214f73c1a9ed0d09c5e8f4c0c5b969536ea9d4a128e81864112a7c18947a2f344ae3344a11ae02cf1368", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788898149, "uuid": "420b07bf-2370-4c85-afc6-0d0d29f708c4", "value": "T1C2A623116BF8D278F1F12A39D876A0B1A53A7D119E23D12E2324791E2C75EC0CA63777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788898149, "uuid": "b11f8e5a-377c-4ebf-9e39-2418a707e633", "value": "196608:VHxcp9ym3nltDUJVkHxcp9ym3YHxcp9ym39Hxcp9ym3VHxcp9ym3:HGplpzGpmGpvGpHGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788898149, "uuid": "8f80e208-7b47-4339-bca1-59239e3f7851", "value": 9957376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788898149, "uuid": "aafde9b8-bf82-49ae-aaa0-ab73015cc339", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788898149, "uuid": "6bf4f132-0656-4483-b584-cfa955e6b023", "value": "a955dad7a3e578f1fc0e6e956d168bc395e940e7e9535049e50aeb296483607b.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3507e3b8-abbc-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788896025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788896025, "uuid": "ef3b29bf-2453-4275-9001-0f69305990df", "comment": "Malware payload (Mirai)", "value": "83bfae215f5267426dc75ccbdedb873e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788896025, "uuid": "b5ee9f54-c392-49f1-a126-6971f8c6f66f", "comment": "Malware payload (Mirai)", "value": "aa2ea714e084456216408dc0aa127e920c4c9e2fbca59d203d6395618f6e69b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788896025, "uuid": "00317a93-d052-4dec-938c-f132c64781e8", "comment": "Malware payload (Mirai)", "value": "0bf15afd5cf8a9dfb754c567ecd2b3f68a048560", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788896025, "uuid": "0ac1eb4a-0db9-4f07-8935-b8b8bdf0d911", "comment": "Malware payload (Mirai)", "value": "523f85a296c981f47306d76b40b3bffd48e285159e7f3ea03a59414941b1a86037002e5e99bd6040c1a029990c4600bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788896025, "uuid": "1413739b-c007-4b97-b9f9-be512ad976bc", "value": "T12143F141CDB9398ECDD171B91C078E5293CEA477697FC5EC252288E48B8088FFA64235", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788896025, "uuid": "b5d3c045-c860-4cb4-976b-0b1226f922cc", "value": "1536:DdxqLU6Iqig2FetkWBuSXQz/3Ht2G4rkyIgNv2YISOQ4:D6ISq3ck/HCIbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788896025, "uuid": "c975912e-9e7f-4d93-820c-af88e3b47469", "value": 55456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788896025, "uuid": "47d1e415-8a4e-40a0-9ef7-6a0902ea220f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788896025, "uuid": "f3640d58-e52d-4a00-bb91-92018512e971", "value": "aa2ea714e084456216408dc0aa127e920c4c9e2fbca59d203d6395618f6e69b9.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3345f13e-ab38-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788839329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839329, "uuid": "c65c849f-5690-47d8-8510-53f6629900bc", "comment": "Malware payload", "value": "95ea0d7857dcaf7cb75dd4bc751146bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839329, "uuid": "72b35555-e2b6-4867-8d83-2eafedbaa0de", "comment": "Malware payload", "value": "aab72ca56ccb45e94af7cd6edf69392c8872f7be04e88ffeb1fa351edd9bf356", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839329, "uuid": "d5e7fb11-fbe7-4526-8443-e436a348df4f", "comment": "Malware payload", "value": "eb72cfdaa053d2fddbfff436aaf7ea08c036968b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839329, "uuid": "fdbdf40f-a145-4d71-a095-e26700ec9dcc", "comment": "Malware payload", "value": "eedd4c8dcf41d64322e2b7f8f411f6a373f148bf4e1d00927157103d379d6fbebc80bd37062195ab98714dcff7e16ad0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839329, "uuid": "d4d90f6a-eb22-4966-8b10-89aea967dbb3", "value": "T178D523D134B61979C037C7B6CF52F0AEB16D334687298E0BF5CC69408E6266864B73B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839329, "uuid": "fef9c532-d66d-4791-ba11-4b7ad8d99987", "value": "58f4b17816a07f7a36dd14e504d515e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839329, "uuid": "95bc996e-01d5-4a84-85f6-84149c0d9f93", "value": "49152:yRKGVUz0ecxWNO/+9OdUrk8G4vLqoda4HBflV1j25WSErDGbKF1M60oWxL:4U0HaN9OBEqlMJ8N7KDwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788839329, "uuid": "351ef96a-0fff-4fe1-bc20-ec3c30a2bab1", "value": 2895872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788839329, "uuid": "bdafc233-27b0-456e-9c74-9dc7354ee2c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839329, "uuid": "13c7008d-ee84-455d-84b7-9a1132dc4015", "value": "aab72ca56ccb45e94af7cd6edf69392c8872f7be04e88ffeb1fa351edd9bf356.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2656b0c-ab4b-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788847702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788847702, "uuid": "1f3e90ed-3349-4034-805d-cff1d9f82b64", "comment": "Malware payload", "value": "548e2a51e578308bcc467964dcce85f1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788847702, "uuid": "1f5582b6-10a4-4b6b-b4ef-5f9cdcffdb66", "comment": "Malware payload", "value": "acb961a9e3dee2dab05662761b2970cd6a618eb74332625372ff1e6267a0e1f8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788847702, "uuid": "422dabcd-dc28-4baa-82d0-563777600f3c", "comment": "Malware payload", "value": "3e91c470ab9ca3e66fd1dd195749c3cd22e7f5a9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788847702, "uuid": "861067e7-d39f-4367-82cc-8ce0004dbc60", "comment": "Malware payload", "value": "3d80d6a7c3ad6eb7255899aa3492834389e203e9e8cd131fbaba3e8e084e51abb00573334b1184fd06274bebab98099a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788847702, "uuid": "41bec534-b9cf-499d-9e50-37a7a355ae8c", "value": "T12C21CAB1A1F52A753F70849CB106912036DABB925BCD4CE2CB3C5AA23A13590F0B0B31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788847702, "uuid": "53288880-1163-4046-b0b9-77bab96e23ca", "value": "24:w1NLme/NZ+r+SrNvNSL5lOKR00TGz5lOKR00TGP:wTiT6SuOKR00TGGKR00TGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788847702, "uuid": "ca50f339-3dfd-40eb-956d-10652779b537", "value": 1191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788847702, "uuid": "9d887dcf-e04d-4f27-b9ab-e61abf2f35bd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788847702, "uuid": "a2677ff5-18f4-449f-b74f-27f4625fe001", "value": "rev.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1272f31-ab72-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788864424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864424, "uuid": "0a17270f-b1a1-4826-9250-913eddf14a72", "comment": "Malware payload (Mirai)", "value": "854a92a8286b60e376e7814cc2bf4baa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864424, "uuid": "2dfe2f2e-d133-47f8-bdde-021e8ed75e25", "comment": "Malware payload (Mirai)", "value": "ad26b15c4137d0825befdd626ec7bd0bd9676bd1a0196d057af1524ff312be10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864424, "uuid": "657aa5d4-553f-4071-9f76-eaef7a623fa0", "comment": "Malware payload (Mirai)", "value": "c542b2f9f53147233b63ceff6e6d24b7be762353", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864424, "uuid": "30f65405-07a6-4f42-8e81-24a675853d64", "comment": "Malware payload (Mirai)", "value": "5f54d166b76b84de853d26f89d19c8821e9231a09e1325206cf2608cae05011c0b0b78cf3e734adf4a01bc4a254652c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864424, "uuid": "70b345cd-65b3-4204-9d87-9dff7e514c7b", "value": "T1C7630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864424, "uuid": "61622fd0-c282-4469-8686-a72123b7de00", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788864424, "uuid": "89da2054-f2d7-4be0-9f80-1d5880dd7f03", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788864424, "uuid": "07a11817-94bb-466b-a86d-606723a03c78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864424, "uuid": "7ea2bf55-1d18-4576-85fd-bb408ca4285a", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4ff229-ab2f-11f1-915e-42010a9c000a", "comment": "Malware payload (CoinMiner)", "timestamp": 1788835723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788835723, "uuid": "9d762540-6a29-4eec-b638-30f251ccedc1", "comment": "Malware payload (CoinMiner)", "value": "b8181d43e0231d5a12038e16ece15329", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788835723, "uuid": "b3f73e87-48df-4f95-812d-5a5b977bed74", "comment": "Malware payload (CoinMiner)", "value": "ad4e1af8ca493cafc4e4d6b764194af49b9fe8d02c233ce529929627bfac1afd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788835723, "uuid": "5664eca3-b3c7-4f04-a87d-4fd47b886df8", "comment": "Malware payload (CoinMiner)", "value": "984a0e0826f6a64db6f453643f3f96cbc8f02baa", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788835723, "uuid": "66929eb1-e4b1-4a3f-b652-4952e46f6d81", "comment": "Malware payload (CoinMiner)", "value": "834db751ce79c0345ba672a180f07e32b1484679af5384a2d59732768bc9d3b1939d5ccbe3175d1d67c6ecf9fe802c3a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788835723, "uuid": "393c9aa8-3b66-4954-9715-e2b2392c858b", "value": "T1CCE533856BC610B6E073CFF7096276F0C66AFEA9109C0A235B7076E566323D9CF1E944", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788835723, "uuid": "b139e4dc-04b3-4d59-932d-7a66712915c0", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788835723, "uuid": "5efb654b-3671-45bb-9de1-54bcc020aec6", "value": "49152:ggUVC5zhianMjs7wZzS3SAKyJ8FlXXAXohbVhbpmlmlmgDtiXvJ8nzHiArEBn56:qVC5zhianweGG3SVAAXAYhbVhbpmlmAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788835723, "uuid": "5f09120d-8c86-4a89-b533-9e8eadb50ac5", "value": 3073884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788835723, "uuid": "92e388b0-f4e1-4b6c-963d-1439676bf266", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788835723, "uuid": "e83bd1c8-c17a-4254-969a-4e47e8fa39d4", "value": "ad4e1af8ca493cafc4e4d6b764194af49b9fe8d02c233ce529929627bfac1afd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9a66bb-ab42-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788843886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788843886, "uuid": "ab6b083f-fbb3-416b-a594-f882970a9e7d", "comment": "Malware payload", "value": "d0915c864b2125c4b3b03aa9ce6ea55f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788843886, "uuid": "a879fbba-9996-4225-b745-dece11cfb4ab", "comment": "Malware payload", "value": "adcd83a8cdea356d3e3aff41f1b59b6401377fe0c213b1078667789556cf0959", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788843886, "uuid": "4218f9a5-7ea6-4c99-beae-8ac2a5578b17", "comment": "Malware payload", "value": "cfb3397794a5baee529b2672d548c6571a4a6237", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788843886, "uuid": "74194c1e-87e8-4f75-b29a-c3b3a831a3bd", "comment": "Malware payload", "value": "847a52d867e2a437fbd263e6522ef93db6f1be0c9438fd64a9d80100f3d00cf6aabb83f804d3be4a8ac26d98f79d62c7", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788843886, "uuid": "7608c08c-9aaa-47b2-b849-1bc13ff9ad44", "value": "T10FF05C4584A08D19523016547EC0F9055AABEB4783496D4C72EA60BD1FC4BC2CDCF47C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788843886, "uuid": "7ce20bc3-918a-4bd7-bb71-fcbe85ce1f24", "value": "6:qTIuJzhqIwGiY63fAbplilAl3t11/+SR0AqIbR2AWHwlD7V4LKTjawlPP5WRF0N9:qTp0JYyg9193R5qsPWQVb5WRqAEd2QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788843886, "uuid": "7a23ad28-125f-47a5-be39-ec7ea5a93af3", "value": 446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788843886, "uuid": "87b9e346-a73b-4b0d-9747-78303ff41412", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788843886, "uuid": "6742ccd6-46d5-4f50-afe4-799d988311b1", "value": "goodthingsforbestpersonforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df8cb96-ab4c-11f1-915e-42010a9c000a", "comment": "Malware payload (JOMANGY)", "timestamp": 1788847883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788847883, "uuid": "e23c9e48-95ae-46e7-9525-246ce8480b50", "comment": "Malware payload (JOMANGY)", "value": "49df003ac1dcc8134d0eca718baa313e", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788847883, "uuid": "61165574-d1e7-44b1-9e63-702f26620481", "comment": "Malware payload (JOMANGY)", "value": "ae2f76df2a12bc186ef7fef0aa9208418b0d8b2c22e63f47fa0fe390abcde59a", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788847883, "uuid": "a256649d-fdfd-41b1-831c-bb1f80db519c", "comment": "Malware payload (JOMANGY)", "value": "fd2cf9ebc0799ca0555e68de2dc5a47e118698ea", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788847883, "uuid": "ec88f69f-488d-41e6-a5df-ba8bf8d6110e", "comment": "Malware payload (JOMANGY)", "value": "f4b680cc4936bc3f419939217c8f93dbbec8a01035193eeb5da10b064a7e9fd67ed80af38a2d2ddbc3ff56e939cd177e", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788847883, "uuid": "f615321f-05f1-4df6-8780-f4cfe9546396", "value": "T101C27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324D42AC3D8A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788847883, "uuid": "7e6f7b03-dae9-405d-9326-73cecbddcb88", "value": "768:c8vCB+25j6es8Rb9FYpMSUpi+20qUpi+20YQX:c8l25Jtd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788847883, "uuid": "1ccb2a5b-89ed-481a-b7c8-8de1264efe1c", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788847883, "uuid": "476c3634-0ba7-4e71-b2e1-f4f64e3d64f9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788847883, "uuid": "b088c212-c5c9-43ed-85ff-02f1b51ab588", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3601167d-aba7-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788887007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887007, "uuid": "bf5be397-1d25-44ba-ab46-1ab0d0d9565d", "comment": "Malware payload (Mirai)", "value": "ac051d6f05ecf77bafd886c68dd92623", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887007, "uuid": "35737c4f-2782-46e0-8da3-b7d6ec5b8ff8", "comment": "Malware payload (Mirai)", "value": "ae9d89f2117fab0d0cf80c3900f349c09ecbbf822dc0b5d20ffedb7e183191a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887007, "uuid": "ba3fb89d-c46a-47ef-b8cc-bac3270b7eaa", "comment": "Malware payload (Mirai)", "value": "5620090eb7318d4d99440a11cfbcb041d2de4438", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887007, "uuid": "1162278e-5015-4e5e-887a-f3cd51f3df2d", "comment": "Malware payload (Mirai)", "value": "07b365619886bb8768092aa23269c45e8ed90ec530f3b718b394a8d1d13ed11200059f549885d2fea0375849ce4199ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788887007, "uuid": "b2d056a9-0fd3-4847-a623-e954ccbdd771", "value": "T174F31A45FC509F27C6D611BBFF4E428D372A17A8D3EE720389255B21378A4AB0E77142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788887007, "uuid": "f43381c9-0f5a-40a2-8229-f954e97cc0d8", "value": "1536:4bpbDKifb6iT/2i3B4VUJ6CVk8XFBwgui0aOzYbo8WQB4vllwlwywVMb/A6Vp9V1:IBDVjZT/94o7W8XFHui7hK0Qs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788887007, "uuid": "2d59fb1c-0d85-4021-a18f-29043a128f60", "value": 158408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788887007, "uuid": "78116e2d-34ef-4d0d-9551-a0f2ae633e02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788887007, "uuid": "f837d30a-cb4f-456a-811b-c3fded3710bc", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8055fd-ab1a-11f1-915e-42010a9c000a", "comment": "Malware payload (CoinMiner)", "timestamp": 1788826404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788826404, "uuid": "159dc761-c69c-4943-9635-2263df503034", "comment": "Malware payload (CoinMiner)", "value": "709b5ea9953d9be3ec70b49132946fdb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788826404, "uuid": "7caa7b89-fb06-438f-a87f-efd445540621", "comment": "Malware payload (CoinMiner)", "value": "aee04196dacd805b71d4191dc91403feb208cdceff108e1e781c0d507fbeb1a1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788826404, "uuid": "92b49770-f048-4658-ad05-18e5c6efe693", "comment": "Malware payload (CoinMiner)", "value": "0cc1da9f276f275b115b58dd67a7d279573c5161", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788826404, "uuid": "9b939688-a20f-4f09-b30b-c5ec2142f5a8", "comment": "Malware payload (CoinMiner)", "value": "e0531747ac15ce77b6ac390ed3f1ed39c2ce1d2047971b5a5b3177b48149ce820827957e1ee95cc0de4e365ff10ef41c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788826404, "uuid": "6db97dd8-3a20-419e-bccc-1ce8fb4e7d14", "value": "T11DE56D56B6A214FDC597C430876BD672AD34B46802227DBB2580EA303E67E705F2DF72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788826404, "uuid": "05eb063a-d52d-46c3-9e10-6b9129973f1f", "value": "98304:JHeCWABRddqiB9y9zN+nxjSy4aKonSMa6HY:fOzeF4aJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788826404, "uuid": "98f33f13-3e79-4edb-82fd-bd74b06fd7a9", "value": 3227824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788826404, "uuid": "32f8e9fb-57b4-48aa-b8ff-eb86447b9b48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788826404, "uuid": "a23ae727-d0bc-4b5e-86a9-bbe4669b1b69", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897639cc-ab74-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788865243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788865243, "uuid": "fd3aa34e-1748-4599-80ee-9f5d97b9b9e6", "comment": "Malware payload", "value": "3eb7309541fe2f965d5ca52833be4b0b", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788865243, "uuid": "0012038d-c4f6-401a-9bab-e02417d25720", "comment": "Malware payload", "value": "aee1b2855f1aca29c7be7ecf6060b1953e4ced2f4a49e29c841c6603286d2bd5", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788865243, "uuid": "5ed033db-57e7-45ab-9803-a09ed36385e9", "comment": "Malware payload", "value": "30adf59ba53d5996147882a95a1d038c69c2428d", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788865243, "uuid": "d23947ee-adee-488f-9d13-66e6eb6ef48d", "comment": "Malware payload", "value": "d3bfaa99b0765e3263b7b1d7f4a576d3158f24e663d6ae665f42d3eaf1bf29d0c67a996ffed22ee42d0ee3091ca296a8", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788865243, "uuid": "70938627-f1b5-41e4-8d43-de4fc8512bfe", "value": "T1E63172CE152156751103C99E73E2398C7A8DB6FB288FDBD49D481EEA824D7CCF260B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788865243, "uuid": "5ae8e0ff-2689-4893-8e54-b6a743d6a308", "value": "24:9uM/fV7e9xcoknqqWDH/Bg00X2z0t7gKj28AQ2:NV7e9xrknqqWbght7gKa8AZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788865243, "uuid": "6d393637-9fee-4118-a909-d30241075b9d", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788865243, "uuid": "6c6686e9-4bbf-48df-93fb-a16b39ef3e54", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788865243, "uuid": "620ce89d-b252-4c02-85da-72155c289002", "value": "aee1b2855f1aca29c7be7ecf6060b1953e4ced2f4a49e29c841c6603286d2bd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91dc67a-ab23-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788830534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830534, "uuid": "b4f63c3a-242b-4a1a-a29a-405f4c8ad95e", "comment": "Malware payload", "value": "89577ea39b195703bf1bffc86fb5e533", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830534, "uuid": "00b08dc1-2014-47af-88b2-8a47d86c0620", "comment": "Malware payload", "value": "af90dd521ab85a4c8d3ee79e6e7413a1297a8b31caeb5a2ad0c0a0064282550f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830534, "uuid": "fc0e03a8-0fe9-42b0-a9a7-ddfb438ab02c", "comment": "Malware payload", "value": "adf8e98294fbe2bb9640d04a9cebd7df81b7eb44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830534, "uuid": "bee204d0-b292-4983-b650-6dcd8ca524a6", "comment": "Malware payload", "value": "603c0bee9751e0d2a9baf9ae73019308b806ddf325bb0f15eb241f56af994e283e955a4c7da961f19b9b2926f9abcce1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830534, "uuid": "8b1eb506-c453-49a1-b651-b354b4a00b86", "value": "T128D31303F2895639DD294C3B2D6F8BCA6E36F0247B8CA90E018BA763DDBE515E1117D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830534, "uuid": "5cb46678-32da-4be3-a185-7ca49b59e260", "value": "3072:qM7R5DpLBJrlro5F01y6UH6+eBZFYZ64ZaObPOrs4Zmy/9K:qM1NJt4F0B+eBZFYZLZfbPOrs4b1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788830534, "uuid": "05bf9365-5c6e-4f13-9d34-714904633a59", "value": 135916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788830534, "uuid": "21298684-bc33-456e-952b-9d25349db824", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830534, "uuid": "80632f2c-4c75-490f-865a-cb4ba145dbed", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4470fad-ab79-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788867489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788867489, "uuid": "67538234-acd3-4ab0-b3e5-a13643a00e8a", "comment": "Malware payload", "value": "39098d5052ce64e912094fcd41a54cb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788867489, "uuid": "607bdce0-ca0f-4a39-9264-eff2d73e8d77", "comment": "Malware payload", "value": "b047eab90ee5813efa99fd39736d134b44021aa061a9d1c1ddbb2635e5852f52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788867489, "uuid": "21fd77ce-068e-4af9-b13c-7943d5e0e562", "comment": "Malware payload", "value": "094127269a62f26fbd2e01da53136475347cc611", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788867489, "uuid": "64f230e2-568c-452f-97c1-d7f807807e61", "comment": "Malware payload", "value": "c504472c77b3ba423f360f6614cd10836932f8ac7e91f81b25b9db07c94402935670655b0b54d67006ee1bc6a6ccfd72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788867489, "uuid": "40e4dd37-e5a2-4c11-8a1f-ebd86bbaeb41", "value": "T1FD2833037FAA21E0E069DA348A76925ABB607C8D873673EB1E5077306F263D05D76F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788867489, "uuid": "971c31de-0512-43c0-a47b-db6fe8b1d918", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788867489, "uuid": "14fd0b16-94b7-4036-9148-52e501654351", "value": "1572864:OXyeWMbjiYKbDEPuVMpNrRD2AiZn9F1kdfDwGQrIoDmv9RvXIb+2He77:mWMbOTXEP0Cv2AiZ9FKFDcIoDs9RvX6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788867489, "uuid": "fb007c36-1cb9-4a8a-aac8-db9fe7e5f64d", "value": 96888696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788867489, "uuid": "b87e5418-d288-4df7-9f70-04877f2cbec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788867489, "uuid": "4b2a8264-7be6-4342-8d2c-fa80dcdd108e", "value": "RealUI_v8.86.886.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f2bdcc-ab3f-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788842481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788842481, "uuid": "5b495f62-2092-40ec-ac74-f504f07a8f0c", "comment": "Malware payload", "value": "892b565f7000d9c7881426dbcfbbc9c2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788842481, "uuid": "a09c8e4c-c316-41f4-9646-6ae0de31b8fa", "comment": "Malware payload", "value": "b06f4b22c7828b395c1074c5c3de2fa1c5d380dde916bf21ad0905fc876ed8df", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788842481, "uuid": "3bf2bc2c-c9fa-4ee5-be2f-84be84dbcc34", "comment": "Malware payload", "value": "0c2800c16614e8f3e5565eca79de4ee3c5f30560", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788842481, "uuid": "abc8de03-34fb-4ee1-814f-6f88069870a9", "comment": "Malware payload", "value": "f11d15a4d8293e29eb01869929c272901f6684a32d562888eee50255d09263e6219858ff16b39cebd65f33bf3dee48f5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788842481, "uuid": "7c5a116e-1aff-480b-bb00-e93e8b2f93a4", "value": "T1A6314B8E10246A328003D98EB3B76599668DA5E7389FD7D4D84C4EA9928828CF261B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788842481, "uuid": "fd04a095-9608-42f6-b0c0-45fabe25b380", "value": "12:UK6w0SDy6Dq5xMag6qhvxD36NDzXx6XGotB4TKDa6D8DD861aIGI6IG8ltwGI6wq:a5xM75CsGNJxWZ8ln3aIJhnBagbe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788842481, "uuid": "0ebdcd37-806e-490c-a914-19f26bd8177f", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788842481, "uuid": "d6abe300-3dee-4bee-8c96-b8e56558b87c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788842481, "uuid": "e82dfba9-e00f-4f07-8cf5-6f250851cad9", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d80907-ab88-11f1-915e-42010a9c000a", "comment": "Malware payload (MeshAgent)", "timestamp": 1788873780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788873780, "uuid": "80ac28c2-dc75-4d5b-9c04-8ff4da0c47fb", "comment": "Malware payload (MeshAgent)", "value": "f2d0ebe8b99ddf2e2f477277ef5b717b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788873780, "uuid": "128ecc28-dee0-4264-aa07-8b66dd8250bd", "comment": "Malware payload (MeshAgent)", "value": "b10a4dcd87ac40ff55b48531a43d4f1c412bf5df124e59deb351d94c65170e0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788873780, "uuid": "34fd4ebe-3f23-4ff3-b819-e5fd06d89f6a", "comment": "Malware payload (MeshAgent)", "value": "4216a99eef542be09755038095c0ff42b8671882", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788873780, "uuid": "449f8e33-0d08-4fdb-946f-6e72487c6cab", "comment": "Malware payload (MeshAgent)", "value": "633a21e33175b426cd09c784021131b8e0344956010b6bcd14eb5498f4e3a3c3ce9ddd57d8716a3e56d00f99f8c5bef8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788873780, "uuid": "a5c54ec3-2d11-4d27-89c6-484b590f6ef3", "value": "T1A906023FB28B653EE06E1A363976E510983F7A61A9164C0696F0C88CCF261711D3F797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788873780, "uuid": "ed27b32a-9d64-4d3a-b46a-8ea0c732c955", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788873780, "uuid": "9748ea6d-30d0-41ca-abed-e88719e5dceb", "value": "49152:4uI2hnBH7gQX/PqSwjM0+xALHXgLuDpa4sO/DVnvWBBvv9g9rBf/zu8ZcXikQu:45OnBHNPqY0+fKc/O/pYvy99f/W1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788873780, "uuid": "631bbe1a-3fac-4173-9edb-1d465790e899", "value": 3664230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788873780, "uuid": "0ca6b858-0bcd-49dc-b8fe-30202ab33e69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788873780, "uuid": "1f3098c3-a88f-45db-9cf5-2417b53e15d3", "value": "Customer_Statements.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8485a597-ab30-11f1-915e-42010a9c000a", "comment": "Malware payload (ConnectWise)", "timestamp": 1788836029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788836029, "uuid": "1b4e55fb-6432-42a8-8f04-5586e7db6c65", "comment": "Malware payload (ConnectWise)", "value": "d297a3f1b263a489d1742181658cfdcb", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788836029, "uuid": "4be7cc36-3d9f-4f68-b9ff-d1c0eccd8f6f", "comment": "Malware payload (ConnectWise)", "value": "b19b6070e954271290391cb58e81fb0d2f7f6cbaa88841e2b1161fa66b8d7a10", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788836029, "uuid": "dbfb748f-1a25-4926-a356-bf0ce438f4de", "comment": "Malware payload (ConnectWise)", "value": "628815424b708eb794697b841ff62d8794079122", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788836029, "uuid": "b6417a20-3e1c-4229-b6ed-db83e4a690a8", "comment": "Malware payload (ConnectWise)", "value": "ea2a604781655ca325f12edbdcbf790a9526242e32cb91aabca1720f698fb50372a901feaa4c544e94e8b54297f16007", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788836029, "uuid": "1f7706ce-ca93-4a46-a828-425cd5f45782", "value": "T1E9D61211B3D6A5B6D0BF0639D87982A55675BC058B62C6EF53D4B92C2D32BC08E32373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788836029, "uuid": "8e6d8ac3-68f7-4723-8e49-efd594bdbb65", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788836029, "uuid": "fa9737f9-2056-4bc3-bee1-4889f0f8041d", "value": "393216:K2xiFxbwpa+CH2xiFxbwpaD2xiFxbwpaW2xiFxbwpaF:lUFxMpjCWUFxMpxUFxMpQUFxMp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788836029, "uuid": "10e96d0c-1cb8-42e8-b2b2-a07acd9091a0", "value": 12809272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788836029, "uuid": "056127b1-4199-422f-820a-3124d4ce84ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788836029, "uuid": "ef738631-385f-4a07-a3ec-1d5f994eeb47", "value": "b19b6070e954271290391cb58e81fb0d2f7f6cbaa88841e2b1161fa66b8d7a10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffbd110a-abd2-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788905814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788905814, "uuid": "56a7a7dc-23b3-462b-a49c-3ffd6f5aee76", "comment": "Malware payload", "value": "ec85a96fa7b2da573c409ff298861eb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788905814, "uuid": "a4e6d37a-1a00-4d08-a8f6-f27142718898", "comment": "Malware payload", "value": "b20b400002fd59a805b29118861b48480a0eb20001fc23561df311a93cef57f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788905814, "uuid": "0bcf8b5b-5949-4c55-b1d7-0e8b23d5da80", "comment": "Malware payload", "value": "80f6cd7cf218938eac63e78205f302088023eaa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788905814, "uuid": "1c295d60-759f-4a8f-b2c7-801c354a2677", "comment": "Malware payload", "value": "6ce6ff7d12ea0bb55b8184adb47614979f080a74030c4f48566a6089c71177f2e5ef762f360dd9895c6d2f2337c431cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788905814, "uuid": "ffaca627-7c59-4290-bb69-a3faea1b0d6e", "value": "T17DD47D21EAA811BDD0B7C1FDC9934C43E372B80B43355AEB07905AB61F169F95A3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788905814, "uuid": "3a296548-33ac-4615-9e5f-865bda08b719", "value": "d62a3d2a3aa130db8fb7a7c4f51346ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788905814, "uuid": "9a58d6f7-c27f-45f5-8c52-8e4fe89fca97", "value": "12288:egYlfb80ZGZZ4CsGVC79QBNCRKj/vjyVo0dP1:e7TYZ1sso9RKfKt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788905814, "uuid": "81f370c3-32b4-4a5a-9042-79884ada172f", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788905814, "uuid": "4f46cdc2-bf3e-47df-ad76-4e18405ef31f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788905814, "uuid": "e591c230-87b5-4794-995b-5098ba9599fc", "value": "decrypted_payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8f7742-ab2c-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788834512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788834512, "uuid": "2bb38607-3900-428d-b08e-9443a81a80b6", "comment": "Malware payload", "value": "63b4580f11aead38218cb949fb5cfa7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788834512, "uuid": "ad65dfe3-a09b-41b2-8f55-847a49474c10", "comment": "Malware payload", "value": "b28f37aa73c2e3461b2f68c6dbd8e0e39696c8c3e1baf8a24320ecdd7b05b868", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788834512, "uuid": "ed910405-e018-4dc5-97ce-fe4b0f6e9710", "comment": "Malware payload", "value": "22977aa55fe9fe35585a9cd8325366b27229a4cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788834512, "uuid": "ad43ff74-f833-419e-b8f9-0802ec0559de", "comment": "Malware payload", "value": "ecee38fb8fcb1cd653fac75c16d4ffea231fa56c6a1aeff9f5bbc7d6131d0f718f49608d98d5ea1dcdb09901d723dfbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788834512, "uuid": "45d184f6-2591-40f3-a904-ac8cddd2437d", "value": "T1C1A5D03FB24B613EE0AE1A397A77D210543B7A7164124C5696F4C88CCF95A702E3E787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788834512, "uuid": "bfccaaa1-52f4-4f0e-a1c2-177dee9decdb", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788834512, "uuid": "d155fbba-3790-4f5d-ac55-8b6749d0e5ee", "value": "24576:5XVrSLScusMmOvjjhzvLmdFtswMBsFDphTah+O1bj4K1yhcjP+vADe4Kfqp51/qh:yuI2hMFtBMOppao7h6qggqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788834512, "uuid": "a5727719-81b8-48b7-a824-5a4c9342f78c", "value": 2068008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788834512, "uuid": "fbfb9d74-64ea-4e97-90fd-2c7c34f57320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788834512, "uuid": "0107ea0c-7eda-4364-b9d3-a7eb2b0e5b8f", "value": "b28f37aa73c2e3461b2f68c6dbd8e0e39696c8c3e1baf8a24320ecdd7b05b868.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56f1720-aba2-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788885047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788885047, "uuid": "24fd095f-d223-456f-8d74-e772cfd27cf6", "comment": "Malware payload (Vidar)", "value": "3c46d01a0d34f033129c5ea4bfd24007", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788885047, "uuid": "dfa85acc-7b66-4c0c-9dbb-7e5fbfca5af7", "comment": "Malware payload (Vidar)", "value": "b2a566ba1fc85d309fcc4aff31e05515773b71a44a4929785d8b1df5c0631e9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788885047, "uuid": "1df51287-95ce-477b-8bad-0bf845806b64", "comment": "Malware payload (Vidar)", "value": "dc405f5903f2ee686f2fb6204471a2a17eb1043e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788885047, "uuid": "c0161190-c46a-4be5-b93b-8aec4f888718", "comment": "Malware payload (Vidar)", "value": "7ddda4a641fdb790eb796b0d9e44a4388f6659b0d37a80fa0230e8a145e2ca0d1295058c05457607f0fb49635f733b77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788885047, "uuid": "ba4f0306-1ebc-4b04-bb52-c98950b0948f", "value": "T16F08339093458B01E1CBAF7C517A0BE35F175EE0B77AA4AF57A38432F9654B9C2C804B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788885047, "uuid": "ba363412-5821-478d-9a91-7a6e8bfa2173", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788885047, "uuid": "988c22cf-ce52-4af8-aad0-ec7deab73ef9", "value": "1572864:LLdktIufDDYSsROFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB723:L2t/YpMaABZVPArg/bXeB723", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788885047, "uuid": "72bf1af3-bf9b-4bd3-8ba6-1c183326beb2", "value": 83949920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788885047, "uuid": "e7aacd62-8a70-455e-9ef2-24a3237b0b68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788885047, "uuid": "1f79330c-72a2-435a-90f8-8191225db16c", "value": "Project_v1.2.4.windows-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e97147-ab5d-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855463, "uuid": "543e37a4-ae94-4aed-9641-13a965a0a5ff", "comment": "Malware payload (SilentNet)", "value": "f2ba5c9da59acfc6343a427fbd9b6012", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855463, "uuid": "1003af12-f1fc-48e4-9784-23ee2451f982", "comment": "Malware payload (SilentNet)", "value": "b2b45e3371f421855549cb73d5665371b298536d0e506fef5c22e806ad54e370", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855463, "uuid": "0e26d383-fb22-4ae3-ac86-72b57a622505", "comment": "Malware payload (SilentNet)", "value": "ecab8d2cfca3122bbaa7c745d222384119bbe9fe", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855463, "uuid": "d9cfc5cb-4a96-4882-b82c-31a4bd35194a", "comment": "Malware payload (SilentNet)", "value": "38b359072265f7ef6c48681de11a6f49e3f40f0f647b7a5ba2abb1137b02e81d358a604860f0487b500544f1f4a94d1a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855463, "uuid": "8b5958d4-e3c8-478b-99aa-0aba1bb12328", "value": "T12FC53302BE4EC226D727F039E858AD2090E6B2D1712A12EF05999797C56D74BCFC3CE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855463, "uuid": "576b4847-6c9c-4ab9-9336-2943009e77b3", "value": "49152:9qA7rhD5wLElTZYK7OZsMEigCmAhcjAqG3l9eUMIevfpEqlDWU:9JhD5wEVZhqZsCgMFVPfAWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855463, "uuid": "ee017d16-3459-45c0-8fd1-c7ae2460c64f", "value": 2712292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855463, "uuid": "4092e4a6-9f8a-4505-9196-4a33643f7f67", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855463, "uuid": "7100e52c-8703-465e-88d1-38ef8145c227", "value": "RadiumClient-1.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc04a2f7-abd5-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788906989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906989, "uuid": "adff99a7-de07-4205-b1d6-5e11ee3f70f8", "comment": "Malware payload", "value": "d505883d927ca1e4a211c3bae9cd963f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906989, "uuid": "9740de25-9634-4e0d-9821-5af3fdbc4020", "comment": "Malware payload", "value": "b350924ace363c1d4980aa1d5022d48f4591df1c701d32c5147428273dfa56a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906989, "uuid": "63cbc349-27ab-42c0-b2c0-d4d5d8fc2d8e", "comment": "Malware payload", "value": "b42628b8deb1168c48693dbabf1d6fa04aa9df2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788906989, "uuid": "f2cca9d3-8173-43df-84b1-3a35ce97d5c4", "comment": "Malware payload", "value": "342a6604ba08bf96adc7a75e2ae7310a3fe1c29be674940ff3f431818c2e16ae5c461f8153b23b5a1ea2be6765528169", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788906989, "uuid": "e3d8ea8c-f5b4-4506-88a3-c852c1518d27", "value": "T1CC283391A6AC5014ED7DFC76F36CF36F212D8E0E4C0085AB05F61134BBA06B2B65EB56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788906989, "uuid": "7dfacf2e-194b-4130-924c-fb948dd1c8f9", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788906989, "uuid": "3072d15a-c2ec-43bb-84a4-b2c3f14cbaac", "value": "1572864:NuyFfaRGpG48TwYqtSqF+1GohGuESDQ+c/dUxIlX+jHj00EKV0X7NzvLWCnbo97:NuyZa04wYoFvuE4Nq6IlX+jHj09oCns7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788906989, "uuid": "d365612b-b2ea-4fba-a951-db172649ae48", "value": 100650699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788906989, "uuid": "7ba57ec3-699a-4a4d-a8c4-7621e6fbfbab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788906989, "uuid": "9f4412c6-f187-444c-9168-54932b151697", "value": "larpexodus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae54c7c-aba2-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788884788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884788, "uuid": "43fb76db-f1f3-4586-806f-b75622de78a0", "comment": "Malware payload", "value": "fda1c8c636ab3163f7beefa12cbbc0a9", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884788, "uuid": "d0a9da7f-2c36-4017-a5d8-a2e033fc68f0", "comment": "Malware payload", "value": "b4434af6db480ff74eff2fe6d6de7bcdf091a4ec463437353c6932315a9e996b", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884788, "uuid": "1b7ec256-3c51-4b49-823f-44d08ab60f67", "comment": "Malware payload", "value": "a735902338f27ad5bc8717f481e5434d509bf750", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884788, "uuid": "9c620486-656a-41db-8ae6-97a531b3d4c6", "comment": "Malware payload", "value": "57759ede756a23adcbcc4fcf60858427f121a51cc3ee97fe05a9c9ff64e5f947efb34bba06ad4c19bdfc6eed74070472", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884788, "uuid": "166f440d-3769-4e78-899d-a8686a072f36", "value": "T116F733D17677429DDA11807F63082ABEF70ECE35C70A7D4286AFD66AB118E20661CD4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884788, "uuid": "9ec0a19d-dffe-418a-aad4-926de0922a5d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884788, "uuid": "19bcbea1-c800-4503-aa73-e79fe2a268a1", "value": "1572864:IejOYfcdjytt1+mbzEJE7jc1eaGTvXLy5YeG8+OqdYHE7:I4kA/1jAJ4YwdXm5Yj8+vduE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788884788, "uuid": "02ffcc33-0704-4f56-b9d5-c9515f667dec", "value": 76299718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788884788, "uuid": "65a84312-3160-465c-a3b0-dde522f0e4bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884788, "uuid": "74597664-cfb5-4318-9866-eda3e2e296b3", "value": "installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e55bbd-ab39-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788839739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839739, "uuid": "da098192-c06d-44e7-bece-b411e9aef923", "comment": "Malware payload", "value": "805e59ead53373dbe8467054e5651a10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839739, "uuid": "5cc82044-2c30-4b1e-a435-b580b94d2d4d", "comment": "Malware payload", "value": "b4869973a788cae0ddd8e6aae3025c2a5c95ea96aebdb5156179f83012fc5101", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839739, "uuid": "43c5b996-34b4-4082-8a6e-3d40caf9480b", "comment": "Malware payload", "value": "778031bc51e049fb160c073b68f52fb01f1d6fc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839739, "uuid": "d680e65f-d7ca-4f3b-9fce-968958c20b0d", "comment": "Malware payload", "value": "fdbd7bbbc892326b40f0c3768b2a730588c1af11539fe430f1269356fa44ed51db9958d7f67bbb7857271076a9521d6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839739, "uuid": "c3f08d2b-1e82-443d-a0b3-04f2bc836c13", "value": "T116C31238DD9494C5FA8F22E78D16E3B27A4291E42FB6DD64CEB0921D694B424CCF14CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839739, "uuid": "f48c11cb-34f7-46a6-abd4-34a4f0af2519", "value": "3072:7OhQV+/fsJFPEeMF6aq2u9bkeZniXcHsSAf4u+qgw2uY:ahQVkiHI6/tbkeUXcHsS8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788839739, "uuid": "94e151b1-7e8f-4666-800e-044ad19ea1bd", "value": 121984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788839739, "uuid": "3f06cad3-736c-4476-af36-3f0da615fb9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839739, "uuid": "49e18191-c3f9-4353-905a-e6aba15a3dd5", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fcd2ea7-abc9-11f1-ab4f-4201ac107002", "comment": "Malware payload (ConnectWise)", "timestamp": 1788901734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788901734, "uuid": "994c957e-e5ea-4af3-b3b6-2d998d62da11", "comment": "Malware payload (ConnectWise)", "value": "162e5f309e7c5a14127559d1bf6b6a99", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788901734, "uuid": "8b4664bd-dea0-48b4-b1a7-2d8441138f28", "comment": "Malware payload (ConnectWise)", "value": "b4b9fa7c5472840a6d122c5550fbc6aa346c58361d6dc38e1f53894ca3387329", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788901734, "uuid": "f5ad8baa-2520-4a03-bc7c-5546ba100bda", "comment": "Malware payload (ConnectWise)", "value": "22699607e330f5d824da769d27cb0f82a52f3f71", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788901734, "uuid": "8161d1db-f07e-4a5c-a250-c237fb2f92f3", "comment": "Malware payload (ConnectWise)", "value": "3339efecb74979e4b2a0d1e894407c0214a1e0cc80764cc41cfd683f26f10bb7e0f7eea3e651506fc5e92410392e4a6e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788901734, "uuid": "ba2533d1-61ca-4497-8803-81994dd8d47e", "value": "T18DE6230573F8A109F1B32A3AED3955F19C7B7C228D62D15E1658364E1AB0EC19AB3733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788901734, "uuid": "ada6be77-522d-4815-9683-ea9ad1287879", "value": "393216:EmkEdQ03NldumkEd8mkEd8mkEdZmkEdvmkEdjmkEd:ME2cxCEqEGExErEfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788901734, "uuid": "a35ca308-deaa-4ad9-88ab-dac29eb7f574", "value": 15216640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788901734, "uuid": "7e014eb0-0fc1-40fc-a5c3-03f794c6aa10", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788901734, "uuid": "9fe324fb-668a-4e27-9e24-419a462904a0", "value": "b4b9fa7c5472840a6d122c5550fbc6aa346c58361d6dc38e1f53894ca3387329.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b6b4d7-aba6-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788886633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886633, "uuid": "88cffede-2b70-4e88-b9b5-97eadc40c5c2", "comment": "Malware payload (Mirai)", "value": "cf97076567a659c5333a9e5a0241aab9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886633, "uuid": "3f81dd73-65a1-426b-b54b-5bd7f22c6c6b", "comment": "Malware payload (Mirai)", "value": "b57495e33d631c2e74b8896c3b715f06bdea430c83c4ad9b349bc9d3cb3b1a66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886633, "uuid": "cc04689f-7581-41b2-9579-b98faa080422", "comment": "Malware payload (Mirai)", "value": "d1db044c7528d3716252a3a4ebdcaa31b43f9cde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886633, "uuid": "bdb8d093-2df8-4ba2-8377-b013d7d1e146", "comment": "Malware payload (Mirai)", "value": "4ea06b03c465a1777c717effce9b336770d39baa26d152d5119ffceaeb43ba0abdf7a6bf660aa58c973f48949b3dca32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886633, "uuid": "8e90a4c7-b0ed-4abd-bf59-08aaa479737e", "value": "T125934A32BA695F27C0C9B5B602F34731A3F1EB1A2976861ABD216F9C6F126C03517770", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886633, "uuid": "9e10d3ba-4127-4371-923b-9e8cbd760e2f", "value": "1536:1r9apS+LXxLrDI0VInIQPktdyt75BOtU/kYc1+6+EvFRnoIkX9FESSn:1r9apSKXxLfI0VInzknytVBDHEvFRno4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788886633, "uuid": "24d773f6-b5e7-4ade-b987-308897fe97d8", "value": 93954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788886633, "uuid": "d0da325b-519d-4dca-a33a-b90235b03129", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886633, "uuid": "6711d4ad-0940-4f69-b8a8-ab2bc62adc20", "value": "main_spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59a96cc-ab5d-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855466, "uuid": "194d559b-023c-45b2-8aa1-ea2fd8943786", "comment": "Malware payload (SilentNet)", "value": "67978ceb93d2e8c5ce6759b6e6a71cbd", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855466, "uuid": "698863e4-1b8e-489a-964d-229ccd8c4f1f", "comment": "Malware payload (SilentNet)", "value": "b6a38955efa70b65ff39f8338783bfa30e2ed14448f88afa6b0aa9d676064415", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855466, "uuid": "8d6e5c53-00a9-4a5a-80ad-26596f66a147", "comment": "Malware payload (SilentNet)", "value": "539c6d9a526562cbffbe0643f6e438df392c4156", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855466, "uuid": "cb79574e-1243-461c-880d-a980452aa35c", "comment": "Malware payload (SilentNet)", "value": "d74c86df110bfe4d89d56240c19a18c6e7dfcaa6455f7120dcb0f983a5e1037c86e41dabbc074c7e858fba89354948bc", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855466, "uuid": "efa150b2-0da6-4d61-9756-4fde79aa6844", "value": "T114B5235AA16C44B6CC6F7273B3214EF2D88F058D8509F07612BD15CE0497EE857AEABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855466, "uuid": "ff711fce-96da-4b63-91ce-835b212e09d6", "value": "49152:dMXAk8j60r+pjcup2YYNy+582DLtpo6eXek9Srm:sAk8PKdKLoZeVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855466, "uuid": "32abc2da-13fd-47be-be9d-6b47037ad6d0", "value": 2349397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855466, "uuid": "7d346495-9141-4a0a-8acf-1be4d8888746", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855466, "uuid": "42ca127f-f5b3-4f9c-89e5-d611e78cd1e8", "value": "ShawarmaClient.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a00f22-ab26-11f1-915e-42010a9c000a", "comment": "Malware payload (Stealc)", "timestamp": 1788831575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788831575, "uuid": "d47439d1-06dc-4b79-9607-25c202a6c6eb", "comment": "Malware payload (Stealc)", "value": "5bae18cb6cd8ad345b24cbec6b62a4b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788831575, "uuid": "363e3d3c-3a72-4fa8-9b5f-843270650683", "comment": "Malware payload (Stealc)", "value": "b7a06c7dd0943016ee68b5c14ec8a20578df56f9d9fa5f6ea73df6daa5211c07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788831575, "uuid": "2e49278d-047e-4564-904e-dbae01dc2356", "comment": "Malware payload (Stealc)", "value": "669d803901ca39a60e50067b80f4d77b1d7f6276", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788831575, "uuid": "d70aaf09-d689-4a40-b49f-4fb6a0a1132f", "comment": "Malware payload (Stealc)", "value": "1c0330ed0091dbd87187cfb43c3750a8828a4d3e8dc3628f5c41c909c878c8fe3915441c02f498b9e656fadbc78a119a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788831575, "uuid": "0bdb6add-601d-43c6-bb46-d30235b89158", "value": "T1F3F47C1EF7A512F8D0B7C274CA428953E77278465370968F03E15AAA1F3B6905F3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788831575, "uuid": "ce3b4803-9fc3-4f43-8a4e-6ce601433d7a", "value": "c5a49d74dbeba2b4cb56b327e236efe3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788831575, "uuid": "6195ab0a-ff22-4d09-85ea-89f1ac5b3f57", "value": "12288:wb5Hpg92Ojf14sHYOFYTPIP1LvM6eh0yxBlDetAqxSv:e5Mjf19HwUdL07h0yb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788831575, "uuid": "61ed306c-6e38-4115-96f2-414f12061569", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788831575, "uuid": "88aed0eb-9e41-4ea7-b7e9-4558a5ceac49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788831575, "uuid": "eef7e7a5-6306-4c97-a8d8-b2c720d629f6", "value": "b7a06c7dd0943016ee68b5c14ec8a20578df56f9d9fa5f6ea73df6daa5211c07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964be604-abcc-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788903060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903060, "uuid": "7035c3d2-3f68-41b3-b3f8-87c6a2250016", "comment": "Malware payload (Mirai)", "value": "4f7329ff1f7dc9455a2566e118553759", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903060, "uuid": "9857837b-ac19-49ee-ad50-7ca23d8f795e", "comment": "Malware payload (Mirai)", "value": "b882d7626ff89aa52514fdb06a9333db386e98b31937d0184d65c8ba70474eed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903060, "uuid": "ab27e8bc-80cd-42ae-999e-571d1b283e60", "comment": "Malware payload (Mirai)", "value": "7ba34390b6afc34da733fa8ae04b5aadd9d36a6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903060, "uuid": "13d7baeb-d7eb-49b4-8d09-571179ba1d43", "comment": "Malware payload (Mirai)", "value": "5e7b27f27b12bbc749041216598c2fd6a7eaf0cf9aeec5a47b6b59cd69d7d87472c5fb796675190f72ebdc009689ed38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903060, "uuid": "0456708f-761f-4985-8b6a-7e83c8c1212a", "value": "T19F645C02FB048932FD420EB09A7F07E5BBB141C316B9A909550F57B11B3367AE5D37AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903060, "uuid": "b4ea29b5-9bf8-42fa-9715-d7bcc322dae5", "value": "6144:NZsjxJYpFDwwScXLvrItqapFCeVdwGz83kyhTQOmsL1Q:NiYrNjrg83kyhTQOxL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788903060, "uuid": "7e811a84-100a-492f-be18-509d51c4bd30", "value": 329320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788903060, "uuid": "50749f97-04b1-4a5e-9588-3aaa69c2d16b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903060, "uuid": "6af8cb6b-3c90-47f1-91e2-fc20ac4cf1bb", "value": "titan.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ab2284-ab72-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788864457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864457, "uuid": "affe7d2a-7df7-4a3c-9c27-2dbe2f3d8a75", "comment": "Malware payload (Mirai)", "value": "75765b9e87d06990f0602ccfd37d7783", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864457, "uuid": "a1594dc5-825b-4417-b0f2-bade8587b0b2", "comment": "Malware payload (Mirai)", "value": "b9ee755e3f0567c727d3bcd634a9d4b3eea4b156cb487db887bf80dc4245830f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864457, "uuid": "44e6e7b4-b127-40b8-94b0-77b753d1465c", "comment": "Malware payload (Mirai)", "value": "a179efef97cdb9a0cc7d8db225782e3b70ca6fb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864457, "uuid": "0b2facb6-807e-48b1-b805-d0522e3bb199", "comment": "Malware payload (Mirai)", "value": "621c604f723c835953ae584fbcccf954a3a9b234562e53b65e7a95f8b61ee42c9cf54942ac9f7654d03abfab57428495", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864457, "uuid": "48e086ad-7181-4272-b534-c535882e5748", "value": "T12A73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864457, "uuid": "6634d8d6-de8d-4e26-88ee-33b2c65e003b", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerESti:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788864457, "uuid": "fdd5626d-fb73-457a-b99b-93266fc6576e", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788864457, "uuid": "ea8591b4-83dd-4d33-bc54-c57e9d66a4cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864457, "uuid": "8619873f-e6e0-475c-a96e-7115f21a08cf", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b897c0ff-aba8-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788887656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887656, "uuid": "fec2bb29-35e2-49aa-9a52-8a3dc8f19a1f", "comment": "Malware payload (Mirai)", "value": "f64494aafcdf8ebd534966d156b8c66c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887656, "uuid": "46e08f71-b696-4c89-b35d-6085e8553fa4", "comment": "Malware payload (Mirai)", "value": "ba5cf6adc816afc033091f830777d7c89c7c130fbd3817b649501bc5fc681202", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887656, "uuid": "8d6301ea-927a-40cc-a3bc-04ebfe627355", "comment": "Malware payload (Mirai)", "value": "4723648bf4e727e4aee7ee9a7f3d7df2a92cc222", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887656, "uuid": "6288cbc3-d566-4577-a233-d3a94a33d19e", "comment": "Malware payload (Mirai)", "value": "6e336fa31c457b60b9ef0f6026dcece12f40b7bd87da693d3e5dc225bfe580a2bb6c5c01e552defb1f4b57fac4833027", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788887656, "uuid": "c002b720-57ae-42c5-a882-c0ffa58d8d43", "value": "T1B30439C7F801D9BAF81EE73A48530819B130B7B248825B736217357EED3A2951577F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788887656, "uuid": "989a0e85-bb64-434c-af74-40be4cbfff46", "value": "3072:68FlX7tEc98AnSzmk/C1fA6yUsPJpTeY00kjcyGlxRCXVJjbiKLYQCOON:63QdyU6JpTe30oG3RCdLzNON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788887656, "uuid": "59dfb816-b3ae-4be0-986d-7ecd0eb4f7df", "value": 178472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788887656, "uuid": "0a7f5435-cd73-49d4-a6da-19601d0db75b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788887656, "uuid": "a2be30fa-9525-4b2f-8ad0-53c048cea699", "value": "ba5cf6adc816afc033091f830777d7c89c7c130fbd3817b649501bc5fc681202.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fac4f48-ab70-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788863428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788863428, "uuid": "b29d35ee-49d4-444d-94b2-fcb39a20be9c", "comment": "Malware payload", "value": "123834d6ef1f0f24916a3c4eceb8c470", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788863428, "uuid": "1ca85316-e4f3-4368-850d-95fd905afec6", "comment": "Malware payload", "value": "ba9ca1f7995ad2647cab12e384331ceef0047331623371a974b88c4d51cda627", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788863428, "uuid": "5948da4c-4724-4b09-9b4f-259582007a42", "comment": "Malware payload", "value": "9a8f8133ad2912a5a43bc7b4a7d1bd55319f567a", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788863428, "uuid": "80574bbe-b2c8-43e3-99ca-77a8f463dd2b", "comment": "Malware payload", "value": "28578d9cf5f7c4d0747b91eb9e0da0ba44f20f5001baee0573fd1fac20810462b8f63c76a7c9ec1d73a5d9bc56f4e0f3", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788863428, "uuid": "f6419d8f-4e01-4d39-951b-19d559c6691a", "value": "T1FB3100DE04101B311002DD4E32762188B69DA5EB2DAFC7F8D9488EFA964D7DCF1A1B4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788863428, "uuid": "fb4a48af-0c33-4676-9a21-d03a206d5cd8", "value": "24:myaVW8aHZGfaEaoL2Sb0WfWBtimDOjpgI:myaVW/HZGfaEaoqaON1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788863428, "uuid": "216b0ff4-17d5-403e-8968-384db23dfc74", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788863428, "uuid": "fa3c91c5-9208-4020-8876-a6a80e4a3455", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788863428, "uuid": "4780ab4a-4a7f-45f3-8669-73647d226995", "value": "ba9ca1f7995ad2647cab12e384331ceef0047331623371a974b88c4d51cda627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e599bf-ab9e-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788883353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883353, "uuid": "d313d0d1-2581-4dfa-8b05-33b0b50b0ac8", "comment": "Malware payload (JOMANGY)", "value": "94bf32f2265cc7e475284322df88ca94", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883353, "uuid": "b2240451-056b-4ae3-b878-241c2cacefd6", "comment": "Malware payload (JOMANGY)", "value": "bbde68e5b2ec151998c7b5958597ebc0f30758404645bd1d689b714db8ac4a4a", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883353, "uuid": "de634da3-aeec-478d-b446-520203d37c32", "comment": "Malware payload (JOMANGY)", "value": "733a7ef0623cc0f214248185f0ffe97ade669669", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883353, "uuid": "01b46b14-9e53-4b43-a30c-4d074ba0c1e3", "comment": "Malware payload (JOMANGY)", "value": "7a813f83a7f7ccb4eac610803b4b6f91789ab07cc69f6fd37403ba54ac84b77cbb71dced9207349e140ecfa394fa8d16", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883353, "uuid": "a4114f4c-404d-4f5d-88e2-099aa955e265", "value": "T1BB235C6516857C24AE98C4361C7E2F0CB9AD43E6324452EE7FCB3CF68C4A69D910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883353, "uuid": "16616c36-7a7f-419f-8ed1-881f320a92f2", "value": "768:t+H9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:t+wcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788883353, "uuid": "3e1a4359-d617-4783-9fa8-87ddaa8611b8", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788883353, "uuid": "e55521e6-ba6f-4365-b33d-05986f7e5880", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883353, "uuid": "2d7f43cc-b57b-489c-8cb4-7b5595c3b514", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a80a0d4-ab29-11f1-915e-42010a9c000a", "comment": "Malware payload (VShell)", "timestamp": 1788833033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788833033, "uuid": "8d58b137-ca67-442a-9758-730563b89a2b", "comment": "Malware payload (VShell)", "value": "0659fdb6c977b558292b7c4ef3bdaccb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788833033, "uuid": "21e67d47-5097-4134-bebc-87d4cd4444af", "comment": "Malware payload (VShell)", "value": "bc666f8338e12e90bcfd891c794821442eb53146be3c22325f7f47aae582ea70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788833033, "uuid": "1eb27b16-98df-434a-a8c5-0a833df70e3f", "comment": "Malware payload (VShell)", "value": "fb6f5ffdfdc26e972ecf6fbe6bd4acd51d86e1c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788833033, "uuid": "22b7f3dd-d66a-4539-9d8d-18f48c9068ce", "comment": "Malware payload (VShell)", "value": "0cd250a56566f205974b6253cf76eb0c0d1f8656ea8c8f038d424dd244a09b0aa296428f9ebbfc35a1e0b6f9b7534598", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788833033, "uuid": "d517f991-ddd3-4659-95a2-ca7f36e58d00", "value": "T183716188F3276EF1E43C46F900D3A614D059ABB8C250BF4D5E60381D3C210BA255AF97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788833033, "uuid": "d6bdcb08-1828-4be8-975f-46a2e09f450a", "value": "e82dd51b077167be63c004bed23d0c1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788833033, "uuid": "eaa6da26-824a-4e7e-a262-7c83b5754016", "value": "48:6Icwm0gt2WSJ8zrD7TLjpSpc1ZsSYr8XxhxhwcRaK:4jJtQSNSYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788833033, "uuid": "1e76bed5-3b1f-4c5f-afaa-ca78d6a1bcba", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788833033, "uuid": "ca48ea30-b86c-4bc5-b3f7-3888385341f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788833033, "uuid": "885a4cba-2954-4d6a-a805-ea904ac61020", "value": "bc666f8338e12e90bcfd891c794821442eb53146be3c22325f7f47aae582ea70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51606bc4-ab23-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788830360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830360, "uuid": "7b08c9b8-ffc3-4042-b2d5-8920fca68604", "comment": "Malware payload", "value": "1f95b9326435cc40babe94d46c3d5ada", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830360, "uuid": "8aec2dad-8203-4433-9624-b597f17578ed", "comment": "Malware payload", "value": "bfd2c9647990d557da6b9897174755f8ec2f4f9822b4b2e8a84e2ac3fb18a6a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830360, "uuid": "a1f8425e-246a-464d-9e43-6ced5c27f956", "comment": "Malware payload", "value": "2311c62879abf0ad48127d874f7713f996538f51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830360, "uuid": "83d3b6aa-071b-4e72-abe0-3d8052db4682", "comment": "Malware payload", "value": "c608d2c1370b2710a9e0f31ce3b3d82efb4df99a1d792d4306ff8a4c7972bbec04b7125192d91179acdd9cf7597fc406", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830360, "uuid": "c7c2230b-efb8-46e4-a400-6d0383c6679b", "value": "T19395D061B681C036E5B152B187F99B39287CAA30073795C7BBD85E890B704E27B7E713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830360, "uuid": "bf0be024-2959-4336-a65c-1a7461ea22eb", "value": "b5a3c83ef75b81f8d1977a162569446a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830360, "uuid": "1ca2a340-55dc-4016-b662-4e2ec14c332f", "value": "49152:QfSVUoAwp9Vxz6oWkuQOkVP+MtTKtSTB+1FUfjxaqUN:c2Am9Vxz6nkuQOk1TKtSTBkFUfcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788830360, "uuid": "ee26fa63-0e5c-4921-9695-18045dd6c9f6", "value": 1965056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788830360, "uuid": "c2084e6b-ef5f-480a-823e-eb5e294509fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830360, "uuid": "8e8b8986-b9c7-485c-9699-70eed281a64e", "value": "bfd2c9647990d557da6b9897174755f8ec2f4f9822b4b2e8a84e2ac3fb18a6a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263c1808-ab9d-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788882686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788882686, "uuid": "41fa5be1-6221-4b73-8f8d-e746c33e797f", "comment": "Malware payload", "value": "5a7ead90545a120a0c47c0495115b05d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788882686, "uuid": "734a0f07-119d-490a-b71a-8b19724eb860", "comment": "Malware payload", "value": "c051af563dbbcf504cb783fda30143faca1796b412b7fc248f9a8e39c07f4dd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788882686, "uuid": "04576a75-9f7f-4197-a484-6f2efd5a1aad", "comment": "Malware payload", "value": "5448acc19b951a24b252c89e27f87f62ca2572ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788882686, "uuid": "ed350298-30a6-4831-8f6a-d78b3d7f4ee3", "comment": "Malware payload", "value": "b5328079804b1cd64909d003f5373608cda0568bdb42d1f74451603cecc69d0d775b20af546a80a146fc96ba8783254a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788882686, "uuid": "bb86bab2-e46c-4d6e-8a60-5f2a8a8fe709", "value": "T187A78D1B735344FECA17807486AF9372E531F81213709A6F2B65DF326E61D604F9EA28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788882686, "uuid": "74075fcd-ee1a-423e-8619-cebcebe9112f", "value": "9fb83edc49289f09f734547eaee49679", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788882686, "uuid": "165f0fda-8052-4d4e-9588-f45cc1411b21", "value": "3072:/BBNk8oVP6kLBQ7cfOu2CAiruotCHCvWUMivLFBUBG0W+IqJIJa61H/xOgNw:K6khfhruotxWUMc0GXIJMa61/Ma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788882686, "uuid": "02d908fe-54e2-4fd9-a8e5-cd93e043d57b", "value": 44297824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788882686, "uuid": "5662b84c-2189-4be8-a048-2e391a16c7d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788882686, "uuid": "d3e1a8ca-7aa6-4a89-b78d-4da9037e3a37", "value": "Full_App_Setup_v9.8.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6fa073-ab35-11f1-915e-42010a9c000a", "comment": "Malware payload (CoinMiner)", "timestamp": 1788838161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838161, "uuid": "d027cea6-bf15-4118-884e-c410764d55a2", "comment": "Malware payload (CoinMiner)", "value": "3e49faab0a462731cda05061dffa697e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838161, "uuid": "cdb6e392-b462-408a-bfa7-0c4f92d0a80e", "comment": "Malware payload (CoinMiner)", "value": "c10d0fc195135663bdc10bdf738dfaaa2fc03e56c737dc6806b126ce6639870c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838161, "uuid": "00bd8f79-ee08-4df3-8e7f-9d10b3be613b", "comment": "Malware payload (CoinMiner)", "value": "cc4520c0149c1487f1fbeb18aecbd46da561ee9e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838161, "uuid": "80b14d2e-73bb-41e4-9662-ad95513d6f1a", "comment": "Malware payload (CoinMiner)", "value": "9c458ace4fc14b186192fc2bb230337110aa11d070143c82c82ccb872e50bba2c9346d33f4108b44aceb286290bda873", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838161, "uuid": "438756be-285a-4968-97cc-76c00dee2bf3", "value": "T12F363384A8879678C427CBF80573246DB76FBBB59C22BC0672CD69014CA7E35287F761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838161, "uuid": "458783c9-19e3-4907-8580-1c5bb1625a3b", "value": "949ec789a5933fb6051c9013a550fb57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838161, "uuid": "405f2592-8539-4291-918b-3fe1bce0c374", "value": "98304:6JX+BtA0hzfvNwFd6w8VcNLiiIqGl27/iuax4zW/JvQI+Ls126q:6x+BeEzqPtii6YbiuTYjYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788838161, "uuid": "ef389f7e-a33b-410c-8a21-be0896cdefc6", "value": 5303296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788838161, "uuid": "a6960f63-ee56-4764-a0d0-006fbe56f0dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838161, "uuid": "96d4a166-bb66-4c2e-8ee4-614ffe2bfbdd", "value": "c10d0fc195135663bdc10bdf738dfaaa2fc03e56c737dc6806b126ce6639870c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600faca5-ab5e-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855725, "uuid": "832d8fa3-bfd1-452f-9df3-87c8e281ce7b", "comment": "Malware payload (SilentNet)", "value": "dd423487fe536bd608b019601f3c2cac", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855725, "uuid": "afb460ff-4073-4acd-b569-3d25751445a0", "comment": "Malware payload (SilentNet)", "value": "c123da8c9e42d66f0b0c14cb9197d4bbd390c00950a7e4538abbc0984ed85905", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855725, "uuid": "146eaa0d-7ab8-47e4-ab5b-bf642daf1802", "comment": "Malware payload (SilentNet)", "value": "b3a2bf07ae84ceb0aff16521886c35015cd325e3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855725, "uuid": "73754776-cc6c-4c3c-a88b-1a0f5a9bc5f8", "comment": "Malware payload (SilentNet)", "value": "f1eb88df2d373af427a5a954a211738eb20390382f670b3b89ef00c0136f873edbc74b1444263851658029a31c13106d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855725, "uuid": "71c017ac-0940-4828-b501-bb25fbb39310", "value": "T1013633D70F02B1C1AD9394F9902A4FBAED0682F6461E5EB3456B5C3A4F71690BFA4432", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855725, "uuid": "70aa5505-e5c1-45ff-b14a-920891f37845", "value": "98304:gD2CbddmSjqesPoaaqtvmikrzDDpsqmbo5hiE5Xtkuhgjs:+bddmSjqeLaMikXwM5Y49kuhgjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855725, "uuid": "1e8a5d3d-e4bf-4113-9308-8df7b032f100", "value": 5056927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855725, "uuid": "56b11b29-3bb5-4e11-b117-53f4dac8b770", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855725, "uuid": "97f2faca-4efa-48d2-9c8d-80287b9ff146", "value": "cracked-client.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5557375b-aba6-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788886630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886630, "uuid": "3accd483-2fd4-47dc-af59-354f2305c378", "comment": "Malware payload (Mirai)", "value": "73608b61a6d4b230dbd3b3cb0661b2d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886630, "uuid": "fbd74776-7e44-43d8-9be8-22ccb9439650", "comment": "Malware payload (Mirai)", "value": "c13e3c3d658d17838c0b09f64abe9a8ad35e71cb4219dfea5829eaffdf6e9715", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886630, "uuid": "a4ee55a3-bae5-46a9-9173-2c086b571f89", "comment": "Malware payload (Mirai)", "value": "3640d3ef642d7c6291028e9b2d94db26a57dddfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886630, "uuid": "992bb3a5-3a07-4aec-8cea-f1dea21b5b97", "comment": "Malware payload (Mirai)", "value": "377bda35fb402bbc4e003c0fca385a4045a39c851ae8b20bf121bcc8ec143dbc532a1263b1add2032ccbe48d056119d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886630, "uuid": "c045d6f4-b92b-41c0-b928-8ffbf6ca2345", "value": "T153F33B4269918E22C6C517BBBA6F404D33356768E3DBB3438E285F7427CB65E0E3A251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886630, "uuid": "11e36cb0-c86b-4fde-ae65-a58a26abb1a5", "value": "3072:2PehUNG+n8g+hjZJ7Vxzga5V578qoLmpMguHcUyVUHalw7W0uH0IsfCbcge70d2K:sehUNG+n8g+hjZJfvoLmpMguHcUyVUHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788886630, "uuid": "beda02ce-ce43-44ca-b59e-ef3084ad3c3c", "value": 170529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788886630, "uuid": "4b3ef799-9852-4624-8b2f-fd79b197cc60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886630, "uuid": "a863bb4c-76dc-434b-9a0c-d345002470c0", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6197ebdc-ab5e-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855727, "uuid": "6788a15f-d2c2-4c08-be41-6f2d58927ab2", "comment": "Malware payload (SilentNet)", "value": "380ea686c362efd6b03c0d6ab8353625", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855727, "uuid": "ee0be2cd-57b5-4985-937b-c374aa5f9c96", "comment": "Malware payload (SilentNet)", "value": "c15ef3aba31c13864a6f51cf1dbe4c7c03b2a728aeb19f74b4feff2decacf49a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855727, "uuid": "720f95c3-2190-4f28-a312-16d599b3ed86", "comment": "Malware payload (SilentNet)", "value": "5087d540bb0436b3fa44589f741773f11d32f2ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855727, "uuid": "c4bf389d-0191-4a74-9cdc-f44a04dd174b", "comment": "Malware payload (SilentNet)", "value": "95d6babd4011e28da71cd1c474fd0133af08f0343ec6c9c5804460956731741c1a4aca6de592416e010bc5336bfaf766", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855727, "uuid": "93838abe-2c5c-489a-98d8-11095caf8609", "value": "T1D4641207D44282A6F524D3730107DBB6F6267C9D071AD5D72FEEBB1A0E3E6A016BE490", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855727, "uuid": "7b1608a4-d5f4-4b15-b984-3e5aa3379436", "value": "e6c6166959e9db1494bb9a620affb282", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855727, "uuid": "356715dc-ce00-499d-a78c-11f13794af5f", "value": "6144:70vzGha3Wc6lFg/zLKnwFymYnjXhIIkddqP5MAjbEnG3kb4EM6sR:70vzGi6lKzWj8DAn6MNEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855727, "uuid": "64238a8b-4596-4d14-bdc5-7187078800df", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855727, "uuid": "145ef316-a548-4821-87d7-dad0e0cb1976", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855727, "uuid": "b690d479-9a3b-4932-ac4a-ffd33d5e0c31", "value": "emulator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7922e83e-abd7-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788907736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788907736, "uuid": "752506a3-02a1-44f9-ab3f-7a85553c5eb1", "comment": "Malware payload (Mirai)", "value": "78aa4549d9ad093a8f5e40d00f83983e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788907736, "uuid": "740a79e0-dc7c-4441-85bb-0b9f5b37064c", "comment": "Malware payload (Mirai)", "value": "c19d15ff0145110b8f9357c14ae5c61f92fc7eb20e5b2a1953c70a6673ac7530", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788907736, "uuid": "babbea11-6633-42f8-87d8-8bbdae5391b0", "comment": "Malware payload (Mirai)", "value": "3819c5b599276ace85635b52c9d8ef409bbd254b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788907736, "uuid": "8053cb1f-1c62-41de-9991-e91e2b36e3a3", "comment": "Malware payload (Mirai)", "value": "4dacab107f603433055f3417757dfb7a5147aee9b274477039734c5b1f6e0e5a96d4692bd20468f18ea662ab0efb8ee9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788907736, "uuid": "5b9cbdba-d131-4645-9b25-8fcf26eedfeb", "value": "T118744B07FE408AEBF81BCDB0C9BEC3923DF561D756F96539617889AC3E6B10A0493494", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788907736, "uuid": "2f4cef3b-e7a3-4293-9b38-57c572cbbc3e", "value": "6144:gtSWfLgETBKs/b9vvTw4hBRecObPNP52y83kyhTQOmoOq:gtSWE+vtTRjQld83kyhTQO/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788907736, "uuid": "9f3859c7-eef0-4afa-9912-ad979cb3bd3f", "value": 348864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788907736, "uuid": "694cf314-aaec-4a97-8dc3-a03d49f70c3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788907736, "uuid": "48770bd8-b693-4073-9173-108c53975edd", "value": "titan.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a966df4-abb9-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788894746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788894746, "uuid": "7ec2c0c5-b28b-442b-98d7-c8bbfe756c5b", "comment": "Malware payload", "value": "d93346e925fba4e37cfd2d9b07a2bdde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ProRAM", "colour": "#AD57B9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788894746, "uuid": "37a6abcd-8cfe-4626-971b-5fcaca795194", "comment": "Malware payload", "value": "c3394372c2000643ce385269b0d8c648ccb8c833076a84bde397a3c01e7b4a5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ProRAM", "colour": "#AD57B9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788894746, "uuid": "b4384ae0-a48c-492c-adcf-75afa2554ff2", "comment": "Malware payload", "value": "8a474a7cd6881be8630fbc9afccc056ab470ba4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ProRAM", "colour": "#AD57B9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788894746, "uuid": "89489394-bdb5-4f09-af99-c4b3b5807ec4", "comment": "Malware payload", "value": "28653985f7ed78c2fc6cc95df2584af5bf917d1d7c0ba77a455349855d4216be003e3a7a7cd565f38e3ba5c193f274b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ProRAM", "colour": "#AD57B9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788894746, "uuid": "5d47c725-53d5-48a5-9c1c-39e800da4673", "value": "T11954F1433BD2C1F9E1D229318592B7E269FDF7250F298AC76B840A0B1A703D5D73D296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788894746, "uuid": "ee8c98dc-1825-4623-96bf-04d6411cfdd6", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788894746, "uuid": "fa6d94c8-4580-4e6d-b6fa-352061ef73e4", "value": "6144:KLTHQOrRezFWuRwIDnJs3kjCUfMxromBDi8AVGFSfnYJDwPObu2F:KXwOrReFWQFjZqsmBerGsfYJDwG3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788894746, "uuid": "e6950592-510a-4a69-9cd3-f221b1261684", "value": 304016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788894746, "uuid": "c1ad0fd4-b2b5-47a0-a8bb-d62649cd6a86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788894746, "uuid": "fc5eb594-4bee-4356-a2bd-d2c39ac53f71", "value": "360speedld_c3394372.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e28f8fb-ab89-11f1-915e-42010a9c000a", "comment": "Malware payload (ProjectZStealer)", "timestamp": 1788874297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874297, "uuid": "4818d1da-7aa4-4e4c-854b-31af34d6d939", "comment": "Malware payload (ProjectZStealer)", "value": "6eb94b4629d58977a67577968bbbe66a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ProjectZStealer", "colour": "#11DCDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874297, "uuid": "685ecb36-17ca-466f-9c24-9fd83eaba4e0", "comment": "Malware payload (ProjectZStealer)", "value": "c35a7d89a165ef214d29f2a31dab1650ab7812c404ef6402c46afce60a500a5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ProjectZStealer", "colour": "#11DCDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874297, "uuid": "fd1a1f99-96d6-49a5-aaf0-4bf8cf9a899b", "comment": "Malware payload (ProjectZStealer)", "value": "d7ab1df71185e09ce980f14de4bd0d264a154af5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ProjectZStealer", "colour": "#11DCDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874297, "uuid": "8b4b1420-3bef-447e-8873-b2cadc3bad61", "comment": "Malware payload (ProjectZStealer)", "value": "7ad4be755a63e71ce718dde0bdcd9ee7bacc36f0fcbe2ba42e5053639f134fac6073e9cd5441ac7666579de9ac8f6b4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ProjectZStealer", "colour": "#11DCDE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874297, "uuid": "d598920c-d1fe-4fd7-944d-6715eb6207b6", "value": "T1A4559F47B2B800FCC4A7C1788A5A560BE7B17805137597DF15D8CA6A6F23FE11ABE324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874297, "uuid": "270fc80f-20e1-4fbc-beb8-6e5002cac4b7", "value": "1fddea23ff3b6af89e56379e89d89693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874297, "uuid": "498c76ed-8263-4f09-9ab5-3268500a1830", "value": "24576:ChH+UOf4FxQnz0GxY+F2ickBP40Uf47k+FH83RgY54+hkkNSz0PZob2CIJ0K:Q1E4F4PRBP40Uw7kuH83RgYO+ykNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788874297, "uuid": "22867cda-3bcc-4f12-899f-2383bde36715", "value": 1326592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788874297, "uuid": "9327eaca-5698-4abe-bb9b-cc89d1da17ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874297, "uuid": "9f722b32-6734-4b47-9312-a353894fac83", "value": "c35a7d89a165ef214d29f2a31dab1650ab7812c404ef6402c46afce60a500a5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9248b8e-abde-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788910850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788910850, "uuid": "dd44ecbe-0b72-4678-ba21-20507ba48ee2", "comment": "Malware payload", "value": "9a5b71df1b5fd762fdc5e54dcda9257a", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788910850, "uuid": "d7379bb1-6470-47cb-b82a-a39402eca319", "comment": "Malware payload", "value": "c3e430b1716764ca82d8a25db5d19e2239018bf426e7c6d4b5e769ddce469ad9", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788910850, "uuid": "ba38ea30-e08a-4a6f-a9c3-738cd3b2c968", "comment": "Malware payload", "value": "9cb16ea9b24605f185b679a19210ea838cb3bc9c", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788910850, "uuid": "243d5f50-105a-4aeb-8186-dd02a8e4fcac", "comment": "Malware payload", "value": "0f8701537699caeca995bf38dc783dde774396353ce31e44f7ab70a6398a40117054049bdddb0c6e460c5360b1632594", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788910850, "uuid": "f03a9d9e-8e25-4b5e-a129-80337d7e278d", "value": "T181A68C43F26280F8C16AC075935A6233FA227C894B3479EB5BE44B253E65FD06B3DB54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788910850, "uuid": "c97a8fed-a325-43ec-8234-51bead17166f", "value": "d840933770682f7204ccca58e56807be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788910850, "uuid": "4db12f75-3db9-4e17-a166-70dba0a0ee5e", "value": "196608:S9jApIzhdUHXGVwVs5ZuHa7kWXe4+eNIrSV:SqpIh3vZ3FO4+eNIrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788910850, "uuid": "c616cf6d-0086-4af1-a313-1ce069847155", "value": 9545728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788910850, "uuid": "de7d087d-18f2-40f5-ab6c-d3db764ffd58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788910850, "uuid": "50a78d00-669b-448c-ba24-6b50ceadee92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32d2b6e-ab72-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788864454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864454, "uuid": "bea920a5-f515-4486-99e6-f4988662e9b5", "comment": "Malware payload (Mirai)", "value": "87a321796c1d480ed71886590a2696ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864454, "uuid": "2145b49f-491b-4e74-b212-a5d982375786", "comment": "Malware payload (Mirai)", "value": "c40412860ce3a41c299db6f204975cd29c1c5266383194644a4df5d255ded9f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864454, "uuid": "4af890e0-3cc7-42d0-a01a-bde2337bab1e", "comment": "Malware payload (Mirai)", "value": "b6a7a7882b2a73c8b34d7c8c265d3cc5c15b22c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864454, "uuid": "b6a19a09-34ff-465f-8917-d0695fe768f3", "comment": "Malware payload (Mirai)", "value": "46f7c9c9079c7caa0c2f1b077fc14240c9b48c46bef7ff2f3918cda1efe5a2af75b81a2a3c3ad88f1634b0ab12cf1102", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864454, "uuid": "12d9034c-6199-4445-9497-37dbfc2b649a", "value": "T11AA2E155BF18818BC832297551D9E9D21253FC71F2EDDC192A40C16FF1A33A91474E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864454, "uuid": "34a61b3b-b4d0-4646-9d86-a75a32fb76d4", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKG:798o08kxofBE+ZkXaqGbp2F2TWul0c5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788864454, "uuid": "ba3d429c-d12f-4cdd-9949-a6e5af812945", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788864454, "uuid": "919aad0e-26af-469e-9519-a03e20376dfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864454, "uuid": "1cf8977a-c7b9-48c3-a893-0db8d4c96a74", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "488c5277-ab36-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788838505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838505, "uuid": "e67a048c-f260-4125-8b3b-941c5c6ddaae", "comment": "Malware payload", "value": "d4dcae7082f6ef9ecdd9921f3445028c", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838505, "uuid": "f35fbbe8-e563-41fa-834c-c54ad1d59779", "comment": "Malware payload", "value": "c433dd621fa1a6b78accf366583f614d2776b82dd257ad8f08af802072e86d27", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838505, "uuid": "59681282-08fe-4e67-9cbd-e6e2ac271183", "comment": "Malware payload", "value": "77c98eee52f7ca25a036601feb295cf8455a56ee", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838505, "uuid": "937b8c52-4512-488c-924d-47256c00bdea", "comment": "Malware payload", "value": "73d0742a04a423fed6918ea47c3bfa8ee53a457b56b2e5110512a6a4aece93ad33da516c6f0d5e1d4818520fa707c290", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838505, "uuid": "fc8e7568-f3fa-49a4-9a4f-f37e1d8f1267", "value": "T1ECA67B43F26290F8C16AC075935A6233FA217C4A4B3579EB5BE08B253E65FD06B3DB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838505, "uuid": "04f2c50f-dfec-4359-9e21-bae159b00d56", "value": "1db37dcac48c321599df86fe40c07f0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838505, "uuid": "94336469-776f-4643-adaf-b1f977344b5b", "value": "196608:HsIFux7+WZLTpdunHa7kWhTLe4+eIdSV:HF87s6FhW4+eIdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788838505, "uuid": "12e1e3b0-fac3-4fbe-9fb4-b46accf60131", "value": 9683968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788838505, "uuid": "3e9c0da5-f17d-4cf0-b28a-d7c1b41c08ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838505, "uuid": "a3b31e2b-e09c-4f06-b401-0cc3beaa9fe7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6f9910-ab89-11f1-915e-42010a9c000a", "comment": "Malware payload (ChromeExtractor)", "timestamp": 1788874291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874291, "uuid": "3e52285a-10f4-4b29-ba78-409a7d329de0", "comment": "Malware payload (ChromeExtractor)", "value": "b9f457ca8bc03372d031c2d8861b9a5b", "object_relation": "md5", "Tag": [ { "name": "ChromeExtractor", "colour": "#B295C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874291, "uuid": "c13979aa-ca80-4cf5-8465-750531bca80a", "comment": "Malware payload (ChromeExtractor)", "value": "c452c05c333222e3186635d3058f6164fea4e85507ef7f767abf7b51964bc8dd", "object_relation": "sha256", "Tag": [ { "name": "ChromeExtractor", "colour": "#B295C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874291, "uuid": "ca915596-748f-4fe5-9165-3bf2c67ebffd", "comment": "Malware payload (ChromeExtractor)", "value": "b7cc932b412bf1c46bc6b78488e7ddbf0ca9c48e", "object_relation": "sha1", "Tag": [ { "name": "ChromeExtractor", "colour": "#B295C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788874291, "uuid": "8d18b054-64d2-4ddb-8c40-5ae58c750bbe", "comment": "Malware payload (ChromeExtractor)", "value": "6418076909e167aaaea9982cbd793673cbe9b3f6fd13d671f5c31d899839226bf9261e6dd213c2785767dd7787beb8fb", "object_relation": "sha3-384", "Tag": [ { "name": "ChromeExtractor", "colour": "#B295C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874291, "uuid": "54058eb1-1048-4aa3-8e37-4ee06ec13abf", "value": "T171A59F17A37800ECD1A7C1B9CE165503EBB278450734ABDF17909AA71F23AE15BBE724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874291, "uuid": "df965da7-7de5-4aa4-9da8-70fbe01367ab", "value": "7e6fcedd723d66dd792403bfc1a87979", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874291, "uuid": "71845318-b1c6-4673-ac82-e99e455766b5", "value": "49152:GM5eacwdZ6PlyoE2NcPWx/hpJdjn9LKm0gwEYGMUDC7:GIzG/hpJdhLKfgYUDC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788874291, "uuid": "6870e6b2-0969-4702-923e-327fdedb563f", "value": 2120704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788874291, "uuid": "6b438b7e-17bf-4b0b-8973-d2e88dbb8b04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788874291, "uuid": "5039cb3b-cda1-431b-bb71-73f24eb254eb", "value": "c452c05c333222e3186635d3058f6164fea4e85507ef7f767abf7b51964bc8dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f321c1cc-ab52-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788850817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788850817, "uuid": "9b99e1ab-dfe2-447b-9f4b-59058ec2f041", "comment": "Malware payload", "value": "6bbd5ed2d581c175b32e4b3542d0635e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788850817, "uuid": "cbbda6cb-28d8-47da-b8bd-8a096e685d7f", "comment": "Malware payload", "value": "c5241b375440a0dc96b26330498896834f7fafa267a8ee482ba51f3095df2cf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788850817, "uuid": "fab16997-74e6-4ee1-b1ed-b16c0a8460e5", "comment": "Malware payload", "value": "30f6863170322a33b95ade51bab68fd05ad9e535", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788850817, "uuid": "a8596e73-90e5-414d-920b-5c525afadda8", "comment": "Malware payload", "value": "67e45d41a049c7573acad26e1245ccb578d7261a4458f0a7d4278df84e50a570f068f1355e6fe10745497f39bbad9c6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788850817, "uuid": "4673cecf-140d-44c8-ab21-464f4cc89b96", "value": "T1F9E68C77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788850817, "uuid": "12b969a1-c122-4938-ac96-c19f2c5967bf", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQV:cqYUQuVDt0TZEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788850817, "uuid": "9cf67cdc-350f-49b8-8297-e4c26ff2bd63", "value": 14385152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788850817, "uuid": "9382de61-e98e-4f06-9318-5e05d5cb80ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788850817, "uuid": "d7ed0252-d3d3-4f5f-8ffc-2d74ec747989", "value": "c5241b375440a0dc96b26330498896834f7fafa267a8ee482ba51f3095df2cf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dbbbb21-abcb-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788902402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902402, "uuid": "0be529d1-bd33-4497-9bd5-4239b608d6f9", "comment": "Malware payload (Mirai)", "value": "e46ec6be9b706648c313f54d48e872e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902402, "uuid": "452bf0e1-d547-4876-a910-a1ee3d8dc145", "comment": "Malware payload (Mirai)", "value": "c55604b959e8c9850dc7124df0a9a1c77e286980de39d6583029949bf4a2d690", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902402, "uuid": "081b2749-a722-4183-a686-d927be600191", "comment": "Malware payload (Mirai)", "value": "0cc35c1365ff4e0fd5f77f35e7149ac94451a052", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902402, "uuid": "300e2114-3d29-455d-8469-fea7e49dece0", "comment": "Malware payload (Mirai)", "value": "cf76dd282ab916d7c15e28abcb7b4573cf92f20fbbb023d44ea91aabe0047cc148c4fa13f7f62e84e86996d52ebbfeb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902402, "uuid": "0141df61-8d62-4b63-976e-24fdd971f109", "value": "T16DC32901E5908767C2D2137AF79F429D37336F68979B33219A24BBF42B8179D1E39221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902402, "uuid": "66c5e7b1-f837-4f18-90e1-2a368cb65e89", "value": "3072:zcP+wadgzyj+AmM2aTXOwszFib3l3yQRb6EPvqUYmcQY47aGgp:zD+AH2aTGibV3yrmqUYmcQY4+Ggp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788902402, "uuid": "1b04e7a7-7d62-476a-9bfd-51bb56a9cba7", "value": 125952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788902402, "uuid": "357c894b-8636-4238-af16-176a827b9a26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902402, "uuid": "0a166d39-a617-41e5-a634-76fb981821c7", "value": "c55604b959e8c9850dc7124df0a9a1c77e286980de39d6583029949bf4a2d690.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f62bf5-abda-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788909212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788909212, "uuid": "e871895f-7ff5-48b6-9e92-b77aa55222d3", "comment": "Malware payload (Mirai)", "value": "f85fc8056e1313acce0322073538ea78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788909212, "uuid": "7a795d60-018c-4090-8c6f-bf712b06059b", "comment": "Malware payload (Mirai)", "value": "c630cb386ed061f395b2527513b40f45d5c857637856cdacef856a6b061ff277", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788909212, "uuid": "fe584ded-ccb9-41a4-8569-da86a4be2023", "comment": "Malware payload (Mirai)", "value": "d2e13e8caea45015169d3f34d609220dc8824129", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788909212, "uuid": "408fa6fb-89fc-46e9-b91e-96f1e818586e", "comment": "Malware payload (Mirai)", "value": "48e22b07839fb4ef1188024426eb544fdb11078d4872bfc0ddcbc43b1c847c6eeaa1cb1b19cce6df1f6244e508fd03bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788909212, "uuid": "f5e93165-118d-431b-977e-265f59a2ce65", "value": "T112B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788909212, "uuid": "1951476d-a398-4ac2-a36b-f5e418cd5643", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1x/LWy:c9sSyzz36YaWWgg1xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788909212, "uuid": "b1222053-73db-4580-9ba8-aae7a29091e8", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788909212, "uuid": "d5d74095-ed12-4fb6-9735-714941819a68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788909212, "uuid": "43c21adb-5df1-453e-8213-527201fe2a93", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78b7b55-ab72-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788864569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864569, "uuid": "1bd92b3b-b0fd-4fe5-b17b-e645e44a2014", "comment": "Malware payload (Mirai)", "value": "913fc4b4392ae001541f8640bcf2b522", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864569, "uuid": "0b27d1c2-de40-4ed4-b3c4-7b5595f767e2", "comment": "Malware payload (Mirai)", "value": "c80f2e7470a497ef436e85b658c0c8b9b4a3c343f5f085cf7071d72cb481e31e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864569, "uuid": "2674cb77-40f4-4b7c-ad32-8b1546e69741", "comment": "Malware payload (Mirai)", "value": "fd92a14ecafbe290f0c35ab6cc2b7873b5140449", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864569, "uuid": "ce0fc23e-2d4a-4d65-9282-ff9af8b32c05", "comment": "Malware payload (Mirai)", "value": "6a6ce7dd28ae694556ae23fe8cd775160bd23b072fba228ffc2ded2f75cfaf5811a9a4cfe9b1f43cdcebd2d9405216d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864569, "uuid": "6fd54822-a802-4b56-bf3c-746de217250e", "value": "T12C230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864569, "uuid": "cb0d94ef-d502-4863-ad32-00fdccd3f786", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THH:5DmKF7Gxyk8cqoHAmWurAufsG5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788864569, "uuid": "b8a1d6c4-c14a-4ade-abc1-dca1120ca6e0", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788864569, "uuid": "3b212f71-84ec-4c03-8cd9-a1fb5b2af45c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864569, "uuid": "6509657d-6724-4287-b5d1-3a0bdd60182c", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c8bc86-abc3-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788899083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788899083, "uuid": "a097257d-ad1d-4ed3-8b32-9b3243cb5713", "comment": "Malware payload (RemcosRAT)", "value": "ba1940d14705b912cc92012e782e62f9", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788899083, "uuid": "39ceed81-82ef-4b5f-9ef7-5dedd3d9b1e5", "comment": "Malware payload (RemcosRAT)", "value": "c910cad76e5b688af7b887840912b7a49dbf39cc545d4052740f984e06a05e52", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788899083, "uuid": "86fade91-4266-402e-ae37-3235880ab329", "comment": "Malware payload (RemcosRAT)", "value": "8c28a9049b1b21894f70259764001d251ca7bebb", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788899083, "uuid": "edc375f8-0418-49e7-a3e0-734a218f96cc", "comment": "Malware payload (RemcosRAT)", "value": "6803dc6fb8baa30d54dd1bf4cc340f17c953f54086948f1d9beac650c01bee4fe0b0b663f18f0ffb563634f5b4fa0c3e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788899083, "uuid": "09d9308b-fa7c-4177-9a65-37209ab290ed", "value": "T19EC27C65CE2713554E8B1AEADC441C71C4FC4056221300B8BEBDB21D9D05B9CBFBEAAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788899083, "uuid": "36acc8ed-9dcf-43e4-9e59-329ae97e9a9f", "value": "768:TnWmJqq/emiWSJcJFRJBVD0XnoLwbgIDUj3oTZ:qmoGemifeFjD03LDnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788899083, "uuid": "375ace9a-6b8a-4393-aa3c-591b62557df3", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788899083, "uuid": "9a923e84-6df8-4753-a7eb-49804a9d738e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788899083, "uuid": "c3f5b252-e26c-4e3e-a502-a74fe53a427b", "value": "erythematic.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "206405e4-abcb-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788902433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902433, "uuid": "3df6c697-7963-49fa-9de9-c0907276b187", "comment": "Malware payload (Mirai)", "value": "90b5985f096aad09ad26e81059ec0750", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902433, "uuid": "f297f882-755d-4192-ae0b-24dcd091890a", "comment": "Malware payload (Mirai)", "value": "c9b0003da146ddc53fc6d4b77e91942b1298d9bd159a2a02dc2fa4ef20c7148f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902433, "uuid": "98af470a-eb77-49e0-b998-c9b78351973a", "comment": "Malware payload (Mirai)", "value": "0fe59d07e87f75b900e4eb9dafada0229f8e9ed4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902433, "uuid": "470eb1a3-c3e0-491c-a1bc-27d26543a9ce", "comment": "Malware payload (Mirai)", "value": "9af00d4eccfa8ad8141dd7ad8097c1dba5fa6343e701c49d7ce451ebe561a6b27dfb649c88ae30a29ff347767fe3e2b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902433, "uuid": "a139fd60-ee9c-4e39-ad7e-db6c0fb5b4ed", "value": "T1A3F33B06B31C0A47D1633EF43B3F27E193EF9A5120E4E644255FAA899271E331586EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902433, "uuid": "16df90eb-f0e4-4cd8-b40c-2b3a31747951", "value": "3072:hLydplNUEClBN1plBN1FDz6xdoOcpxmM1YJOx+zPgoPW:hLLFntxmM1YEkzP9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788902433, "uuid": "8e73f1e4-cdbb-42d2-9447-17740c63df5c", "value": 158552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788902433, "uuid": "5aad7edf-138b-4a98-a34a-df7b45522a61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902433, "uuid": "803b29b4-dc5e-4fad-aa06-d432a1dadf03", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8e50bf-ab38-11f1-915e-42010a9c000a", "comment": "Malware payload (VShell)", "timestamp": 1788839638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839638, "uuid": "d82c5d88-db3f-45e9-9261-46c0c56aede1", "comment": "Malware payload (VShell)", "value": "df00636dc2f2cb48a08c19b43aad554f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839638, "uuid": "36e25a8d-ac51-4682-8fab-37f94caf9897", "comment": "Malware payload (VShell)", "value": "ccacb9d7641368e043bc4d41d84c7327523bad8f9d4d11265e1e6cc5089f3a72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839638, "uuid": "e1850745-7f20-4b6e-bd79-9bc92107cab1", "comment": "Malware payload (VShell)", "value": "452c34125c53a4d4c01c5a16e48e0a09607eb7ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839638, "uuid": "baa6d2b0-1aae-4897-b1dd-bf67dfd2d70c", "comment": "Malware payload (VShell)", "value": "afe453ce7b7b3460c40da5ffd7699ff40ccccff36d81227d3f81d8abac0ee1f8db5c1f8606871703a95f63401b4ab252", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839638, "uuid": "84b2fc60-c000-4a9c-9f04-cb888de6d728", "value": "T1F791C64170B999E7E85C45BB4C0FB8A0B919740A41C483A60338A5953E3A57BF5BCB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839638, "uuid": "bac295f1-0d5c-48b7-a3e9-688c4b25d1c7", "value": "e82dd51b077167be63c004bed23d0c1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839638, "uuid": "dfa3276f-8b95-4018-a368-8ab091542c95", "value": "48:6IIF9BlQaexXgZS7An0cF5uduvxRxUjbON9XM/ge93ahr0/:y9BOaM670cF50uDxUOvXeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788839638, "uuid": "70606f11-3023-4978-a19f-0970bcc9f012", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788839638, "uuid": "17d55292-3139-409e-91fb-2a33b1b233e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839638, "uuid": "bc4951ed-32b2-4505-9f9f-14d91195ec1d", "value": "ccacb9d7641368e043bc4d41d84c7327523bad8f9d4d11265e1e6cc5089f3a72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e1c32f-ab27-11f1-915e-42010a9c000a", "comment": "Malware payload (Meterpreter)", "timestamp": 1788832119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788832119, "uuid": "07e8c77f-e26d-424e-89e9-91ce541761d3", "comment": "Malware payload (Meterpreter)", "value": "3634ca954e7861fd852b7c006da9b8c1", "object_relation": "md5", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788832119, "uuid": "427a5904-18f9-48fa-bf8d-459209869475", "comment": "Malware payload (Meterpreter)", "value": "ccb05e8e1b680a6766c9cfffe71e5543f0b9b0432d2ea10d8f4661188ec5b951", "object_relation": "sha256", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788832119, "uuid": "57b44ac1-ca07-487c-b979-c2d4916ff04e", "comment": "Malware payload (Meterpreter)", "value": "87529e33b41f0f7cdf313effb8dfa8761cd34781", "object_relation": "sha1", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788832119, "uuid": "b34c5c4d-c258-4b02-aec0-5a617c66e6a5", "comment": "Malware payload (Meterpreter)", "value": "3c5826bf1c998930f00a1797795e5efe85e642af08cbb5583273ff51876a33afbf1693d78acf15145395d6c8e991da69", "object_relation": "sha3-384", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788832119, "uuid": "52ba61d0-3b83-4b35-b704-3df51cc98d95", "value": "T128F3C7373600A331C14607368A9FD3E58F6AAC5B4F67112731AAB35D2FB1D9056B7AE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788832119, "uuid": "5fb60041-7c52-4c69-9c90-a2b2bca239b0", "value": "384:iHpe4ZvJXK7gzFM7WuuoXgZs+5BCq26yy3M5BCqPN:Zmxa7gBMyuKDCUyWMDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788832119, "uuid": "27e87151-ab1c-4a6b-afd9-63310b88b0d6", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788832119, "uuid": "b661a857-cfdc-4e8c-a67a-b485cca00886", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788832119, "uuid": "fc52f4e7-da58-46bc-a614-4da22691f0e8", "value": "ccb05e8e1b680a6766c9cfffe71e5543f0b9b0432d2ea10d8f4661188ec5b951.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a42b356b-ab39-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788839948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839948, "uuid": "9e15eac9-5ba1-496c-a1a4-fbdc0320fbfc", "comment": "Malware payload (Mirai)", "value": "d574d2b0e8f991b63b8e582756e5a3d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839948, "uuid": "731121cd-37c1-48bb-b69e-8378cafedb46", "comment": "Malware payload (Mirai)", "value": "cd1aeeb1c4ae2db81b5e1d1b92ec8f1ac6895fc0af48e3f13b09f9c72e27974d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839948, "uuid": "50a6c181-8cbc-4e1d-8eb3-dd77bc6e866e", "comment": "Malware payload (Mirai)", "value": "ed426b5a53f26c2d800b815c9a285309ea118b9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839948, "uuid": "359dac7c-0fc0-437b-b14c-4091322e982d", "comment": "Malware payload (Mirai)", "value": "1a075e75d1b1e0a3f9afa79282c522ccfe6d3585bd90d4fc931b75cf0f6587c142f1ecd64ba60af14b062bc999b1308d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839948, "uuid": "36495c56-c7c4-4212-9230-e7512a84e6de", "value": "T1A0C31282C2759C92D96E1C1229173919F078538D78380DF466DC7BB630FEE993BAD18B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839948, "uuid": "0bbd3098-0979-4df3-b93a-5938312334c8", "value": "3072:Lyk1ranrmzjACFqbvFTGhez0W4TaEvpTg+zgkSUpNYxI4yZpmoutS:LygranrmvFiEpRhTg+zgdhPIpmoSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788839948, "uuid": "2507df00-d078-4957-afce-afc9a878abb2", "value": 121700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788839948, "uuid": "fda588b4-fa94-4bbe-95ea-595aaaca29e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839948, "uuid": "1d8da51d-7a9a-4e81-bdff-4ac0a173ab0a", "value": "cd1aeeb1c4ae2db81b5e1d1b92ec8f1ac6895fc0af48e3f13b09f9c72e27974d.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f633ea-ab36-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788838444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838444, "uuid": "07aea735-38e7-40ea-b71a-bb16dffd0158", "comment": "Malware payload (Mirai)", "value": "6262b68c89cc9989778c4eba9b2e659c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838444, "uuid": "9918039f-0c7b-47b3-aa5f-6e18999f5a92", "comment": "Malware payload (Mirai)", "value": "ce117467c9cf24287a7c87c780c1527118748299f32c8a69bf535d5ee4dba2a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838444, "uuid": "54de7c2f-75b7-4056-b15a-d2c05aa03135", "comment": "Malware payload (Mirai)", "value": "4e7a6e677ece412ccb8b3db1535a07caa414072a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838444, "uuid": "a296b58b-be3d-4422-b9c7-5037add109ca", "comment": "Malware payload (Mirai)", "value": "79000ec06f20fa994ff9cfc70073ca1c6010e196ef2da545aa10c59e138c14085b13db2ac5fc3d958ecb3a3ebad2d7f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838444, "uuid": "501d58b3-b9c0-4623-baff-8537634db66e", "value": "T19AC31248935535FFE5DE7EF29CA42B6090C5EDE8C4661BAC01479C907242A70E23FBCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838444, "uuid": "93467cc4-9e7c-4e90-8b8d-46cabb8a6678", "value": "3072:Xw1QMm9yZ0LvFtSwY1OORgF4tQQGt30Rj+GIwbLhD:XOQNyiFtSc+gFtQfbLhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788838444, "uuid": "0a5b418d-cbdb-4ba9-bb3a-35bccb219319", "value": 120436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788838444, "uuid": "c8ad2853-9b01-4872-9d98-f8bd4bcaaf44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838444, "uuid": "950b7234-433f-4474-ae80-cd91ff08bfac", "value": "ce117467c9cf24287a7c87c780c1527118748299f32c8a69bf535d5ee4dba2a3.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc3685d3-ab93-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788878669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788878669, "uuid": "758a447b-6ffc-475c-b1bc-6b346441673b", "comment": "Malware payload", "value": "e5e81a69afeaa0ea5994a3dafdf5b998", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788878669, "uuid": "cb9f9422-f6cf-45f0-9ac8-c2889aa5711b", "comment": "Malware payload", "value": "cf6c05f1edb906c4d8f331f0a80809c53867b9a1e8df1a916ad5c95d9e1ad354", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788878669, "uuid": "569163cf-f0b2-48a2-bd2d-4b3ec2d4e8b2", "comment": "Malware payload", "value": "74b054565701eed49ae8aebb0b00bc7c71190a9b", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788878669, "uuid": "96405b34-4f74-4e11-9d46-7ed7d38411ce", "comment": "Malware payload", "value": "cc765e7746f2681f7c8065d023bd317dd254c1baf53c347bcc58d07fe1a1c47d4b594f7ff7bcc974150c1ccbb3aaba83", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788878669, "uuid": "020c31e9-cb23-4409-8230-34b409fc7511", "value": "T10568337257D1CEFAD337647383836F61A86916534F0917EA7AA13434B3B13EB28184B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788878669, "uuid": "952157dd-c478-4e23-a7b0-90f452ea502d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788878669, "uuid": "f38e41e7-5747-4a7d-9269-06fbb37b2105", "value": "3145728:0BPl5dpk4v5zThdSeQAtP3lIRA4ehjUrH05D7s1hssLaBE/LcR:upk4v5LjP3lIa4eH56ssLaKwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788878669, "uuid": "a0d75645-a629-4fa9-9a43-b3950b2a5581", "value": 146222061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788878669, "uuid": "61e2c7de-735c-4547-b9d9-1bd9ed51585d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788878669, "uuid": "a509f5eb-52dd-4523-8366-e2bd937f29b9", "value": "OpalCraftSMP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26863f98-ab75-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788865507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788865507, "uuid": "8b1886b4-8aa7-4752-8bca-3c62c61b9c42", "comment": "Malware payload", "value": "14b4e5a1385053ea0ad688f6d981844d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788865507, "uuid": "897af4d3-f54b-412d-9f98-f05ec19312af", "comment": "Malware payload", "value": "d0ee008d3c480d5f9f75332851ae94373158c13541f3c88be63465b975334e0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788865507, "uuid": "de4b3086-2bfd-4d62-a48f-aa713be45571", "comment": "Malware payload", "value": "a52074000948336c280572bd4b392deaa1c572ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788865507, "uuid": "7d84ea54-d9a9-477b-a07c-ae5ec2d176e0", "comment": "Malware payload", "value": "7c96359168e627baa1077d31b66a25a44eaf16f6380a7ce283596fecf24acdb9df6c8b9bcb94f5f2a675d90a13702fc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788865507, "uuid": "1df6d00c-b225-48a2-8269-eb62fc87e84c", "value": "T1CB133B0BFAA354FCC1D7D578429B96B1F832FC140121AD6E0AE4EE326E55D4077AFA09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788865507, "uuid": "6e2e8c0c-a047-4873-9a23-9e4e2171703c", "value": "2403759ebed1338c66b5b34f93b21e89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788865507, "uuid": "37a06827-bdfc-4bb3-b545-19b2a1b10590", "value": "768:rOa/FfGkc/kPJ2Efvq/u0mQfotNsvr6L1MePrGrWj1K5yhUudcd:rOatfGkq4qVfysvrM1MCISs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788865507, "uuid": "67e192a4-2425-4f15-ae8f-fa3f4655ba04", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788865507, "uuid": "d785af9d-2668-482b-9a28-38205206e0d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788865507, "uuid": "08439cb5-e474-40dd-859e-96ba6457d906", "value": "d0ee008d3c480d5f9f75332851ae94373158c13541f3c88be63465b975334e0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e78c1e-abb4-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788892826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788892826, "uuid": "77a715e5-a25e-47fc-87c5-e53ece579c5e", "comment": "Malware payload (Vidar)", "value": "1839171331f31743bcf0f713c8731fa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788892826, "uuid": "80d7c9d4-fa15-492b-b6a2-2439334ce83d", "comment": "Malware payload (Vidar)", "value": "d1bb6e69ec1d9e53c7f26c5be80dc05b0133202186f27c98ec2cb3bf34b2b130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788892826, "uuid": "1f9e4c2f-ac80-414c-84ff-bd8f369aa334", "comment": "Malware payload (Vidar)", "value": "5174eb109a0b0c61d6a1edfb22777bf4363dae34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788892826, "uuid": "4cf04dcc-027b-46c6-96e3-5e7833c584a6", "comment": "Malware payload (Vidar)", "value": "af8e6982c13594086ab4b12e3d5d7bd457069a6ca124debe5b0d74639171c35464dc850291eb71069fcab52a198f768a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788892826, "uuid": "9b9f2b74-c1c3-4ad7-ada2-3e74f53cfa7e", "value": "T181069E07BED15ABAD4AA933184B703517B2CBC194F3233D72E91B2792E717C19A76B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788892826, "uuid": "419aa461-dee1-4d60-add7-ddca9b7e0a46", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788892826, "uuid": "4cf3c1a7-3d2b-43a5-845b-39c921821ec8", "value": "49152:O8/nSgyxpcm8ggzTgWLnXYVPSYfKm9E52eMgBRi0Q3b8oS7qF4ka1nkQOprq:O8P15kgXYVPVCH52VgBbUAhEKarq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788892826, "uuid": "40bb9ba8-0065-402d-ba95-424851c17da2", "value": 3861600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788892826, "uuid": "7b3bbfa0-f819-4b4c-aaa5-4c4c49aac4ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788892826, "uuid": "825108a5-0a8d-4df9-b854-a9825973c811", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "552b7085-ab59-11f1-915e-42010a9c000a", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1788853559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853559, "uuid": "0278f32b-c504-4357-9bf0-6555e50304f0", "comment": "Malware payload (PureLogsStealer)", "value": "2b30c1d4c01cba4ba4bed0d36c73b726", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853559, "uuid": "8087ee15-950f-424c-b2c7-0484b78d2e16", "comment": "Malware payload (PureLogsStealer)", "value": "d22c47a0ec8719852fe2f1f295eb67ae2666d8d09edbbe7412e5208816be7765", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853559, "uuid": "5d9d2c98-8f2a-4041-8f0a-d1c1d3082637", "comment": "Malware payload (PureLogsStealer)", "value": "106bb6995cdb33e67e5605b11f9f323dad566457", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788853559, "uuid": "f517e00f-a8a8-49a4-acb5-e8478b9eda81", "comment": "Malware payload (PureLogsStealer)", "value": "fc33c18c2e0beae611052bbd3bd4b20cc791fb712b08012a45f4399993aece9ce8eea857e0998ca9f68f86b32f01df9b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853559, "uuid": "9669b366-d945-49c1-8745-721ceace7d5a", "value": "T1D405167782FD2F3EC4275658CE7A3C0C98B054A20B4EF47AED3764C5D97CAEA66A0150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853559, "uuid": "cc6db400-2336-45cf-b5c8-ac8c6e9a9861", "value": "96:eZ+A49OxmDxn8JfNlzYcivak3CrYkqGaNtAJ5sUHHwaIOYAkOJ4bTov/J7af5JNj:eZ+AYPtVAJEVwLWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788853559, "uuid": "66fd2fcb-e1d9-427d-a127-2c17b8505586", "value": 807542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788853559, "uuid": "5bcdc2fd-dec4-4ae1-9669-bc7d4c24a81b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788853559, "uuid": "ae890dc5-e5bc-46a1-95d4-63d1d720a5cf", "value": "Signed POs for 500 kg and 100 kg Shipments.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62cb35f-ab26-11f1-915e-42010a9c000a", "comment": "Malware payload (ConnectWise)", "timestamp": 1788831871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788831871, "uuid": "b3cc7754-e628-4587-bcf8-a57f22c089e3", "comment": "Malware payload (ConnectWise)", "value": "b0a8d7ab2c65b6357c23069a2bf5f777", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788831871, "uuid": "dc47809d-65c2-4f3f-b6ba-e33ace13f56a", "comment": "Malware payload (ConnectWise)", "value": "d2305c675ac7cb8f607c06fff1268ae695213ce2de21f8bf78b65a17792a0c3b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788831871, "uuid": "27b660b9-3fee-48b3-ad8a-a5a958e6204f", "comment": "Malware payload (ConnectWise)", "value": "ab662cb1567b3f5a8114fcfc0f641c8024a4858e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788831871, "uuid": "9a3ceac2-6ab4-4ee0-b3ed-fb59b9cad88b", "comment": "Malware payload (ConnectWise)", "value": "eb5d28e7abfd5769078bb5fe2e9508280b3d4783426ee35bf9f616c46e291b558f56b6b98ae3dc1c26a442ecb71a15f9", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788831871, "uuid": "aeedca06-212c-4e99-9039-eb8ba7808550", "value": "T17546E111B3D695B6D1BF1638D87A52696734BC049312CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788831871, "uuid": "4ebd681f-7d1c-4463-b8e7-93ad02271c49", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788831871, "uuid": "e7a833ec-675b-41eb-966b-466cb39a141b", "value": "98304:BzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:BhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788831871, "uuid": "5e77c789-a5fa-47dd-9d6b-216d4de5e1f8", "value": 5665856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788831871, "uuid": "910540aa-7e67-431b-81a8-1097b19ade32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788831871, "uuid": "f98ca72a-d7b7-4748-a955-36a546d3fe56", "value": "d2305c675ac7cb8f607c06fff1268ae695213ce2de21f8bf78b65a17792a0c3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daea5667-ab72-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788864521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864521, "uuid": "ad459da4-687c-4d45-80a7-c5142dad32b1", "comment": "Malware payload (Mirai)", "value": "2d0630540fb93ea333eba16b28b8eb4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864521, "uuid": "3d63b4ba-b67d-47b4-9889-110a24d76a4a", "comment": "Malware payload (Mirai)", "value": "d245af197f11d29edfb076f4704c17310327c1f3cd4a7c0a0b1404d6cfc540b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864521, "uuid": "5b2bb7de-f776-43f9-8330-1f475c1f300a", "comment": "Malware payload (Mirai)", "value": "60b257763d8b3fee8710921d94ed06a0cd57140e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864521, "uuid": "f3bfc8ac-856a-4bde-8709-5ef27ddcd13f", "comment": "Malware payload (Mirai)", "value": "dc57297c9288e5f75aab6577e3751bebe68c41e6e7a9afe8a15bec00317d25ca1dc095d00890aea8b9fc92d2cd0eec4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864521, "uuid": "4fcaf45d-7e76-4483-98cb-f954c6a30db4", "value": "T1BB334A42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864521, "uuid": "4ec298ee-f8e0-4a8c-bf8c-dd292a817590", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8TwF:ivW3jdQGqt7Y+Z+zN9cGgI6bF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788864521, "uuid": "e9be31e1-fbae-432b-8c36-be69ff39b278", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788864521, "uuid": "09d66b8a-547f-4e07-aaf8-aeefb62cffad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864521, "uuid": "21e55328-39de-4e77-84b4-10210eedeba5", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab88d77-ab30-11f1-915e-42010a9c000a", "comment": "Malware payload (OverlordRAT)", "timestamp": 1788836039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788836039, "uuid": "0fa344b2-0768-49ee-bcbf-ed7dda3ab1da", "comment": "Malware payload (OverlordRAT)", "value": "5fb24ac011130aad542d3e2f2fcbda91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788836039, "uuid": "9d930c54-1738-45b2-af07-1adccaed0a36", "comment": "Malware payload (OverlordRAT)", "value": "d2c05ef0cb036c7db832e8e7cdf8048ed3ff6bf7ca453f7eef1b6429a06c8ecf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788836039, "uuid": "5ab93f28-913e-45c5-8977-0e7e104dc0c6", "comment": "Malware payload (OverlordRAT)", "value": "bd24169029857aaeadd1bdca359ce03b78e803ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788836039, "uuid": "44a67524-b100-491a-a4bd-8fbcd13094d8", "comment": "Malware payload (OverlordRAT)", "value": "35b99d144f47440070df23dd94923296cc1b2c8518d397bb708d6a67e74abc7503021ee427d6c808989dc2d228515aff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788836039, "uuid": "2d626a4b-47c5-48c0-bc7c-11fb202fa475", "value": "T13EC6B1607FE62595F437FE12CBEBB696D66FB3722A07594B1204434B0623942CE83D39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788836039, "uuid": "c56a39e5-3716-4bf3-901d-923e213e3aea", "value": "196608:pu4/hvrR6NMbB3RRVqaqzCtF65kGRYBjiv:pu4/hTMyxHVqmC5D6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788836039, "uuid": "58f39cef-250e-4af8-8e9f-8f101d3fe78c", "value": 12048896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788836039, "uuid": "c41e0c1e-462f-41b5-add5-85ec619cd661", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788836039, "uuid": "d71827b9-6393-4274-9941-56bd10673e93", "value": "d2c05ef0cb036c7db832e8e7cdf8048ed3ff6bf7ca453f7eef1b6429a06c8ecf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4958a02-ab5d-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855410, "uuid": "81ce1775-694b-419d-9eef-b5cef4f97f0e", "comment": "Malware payload (SilentNet)", "value": "3b3edd11664db32f90e3eb304cfefec0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855410, "uuid": "b767690d-c67f-45e1-8e64-f4157c21029c", "comment": "Malware payload (SilentNet)", "value": "d34d804aeec8e428dc75b2f00db75e4744d94de7d7d4f541a44bcb0ba4e05c67", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855410, "uuid": "342a7e08-878c-43d9-a620-9410b9e90d6b", "comment": "Malware payload (SilentNet)", "value": "2740e425dbf56a66a3cacd19bc3fda9858090e81", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855410, "uuid": "8736912f-8763-4436-9376-93818ebdf549", "comment": "Malware payload (SilentNet)", "value": "1f07dfc744cc322b821d1c032396cc687b5e507578e258141d2134860b3eadb9a19464eec273fb5bf2eff581b8e69fec", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855410, "uuid": "8b9c029f-2c9b-476c-99aa-fdb9dc23d853", "value": "T1D6042381920A0C14DB6E4B3153ED13F3DE3709748B14194E01E6B6A7AE85A9CFBDC5EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855410, "uuid": "7b4764ca-0a13-4786-9777-19c06075cca8", "value": "3072:jZI+FKbYMvL0Nb+m2Dvmx4MJcGPgLNKHZUzv9uJNTr3ZggKlxBYf:jPcYiL0Ym26x71oBK6zvcRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855410, "uuid": "43d44b5d-2704-4ade-92fe-7a015116739f", "value": 179458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855410, "uuid": "b1780c98-495f-4a53-aef9-2f9e1859b02d", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855410, "uuid": "c21c76a7-cb78-47d9-8c61-b24cbc3a05cb", "value": "1777812311135-Donutdupe.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31cd2ee1-ab39-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788839756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839756, "uuid": "8897c1ec-1f58-4b4d-a729-fe25597289b6", "comment": "Malware payload (Mirai)", "value": "03ff63b23f419cb905ba07b63c619594", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839756, "uuid": "c67f08f8-371e-4bd6-900e-217127f01bfa", "comment": "Malware payload (Mirai)", "value": "d3adf0e7fe36d2a62fdf1db3977c52bbf5e0b709e959af601fba04e54de02dbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839756, "uuid": "a2f84cf3-87e3-4aa6-8526-de553cad65a3", "comment": "Malware payload (Mirai)", "value": "f7542322965e1eebfb819e5efbed9c4c6ad6dfcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839756, "uuid": "1fb8a17c-840a-4737-9f0f-dec75b13b0fe", "comment": "Malware payload (Mirai)", "value": "0e52af70d818dc74588190029eeb97a63107d09cb96f40d96fc279ef72022358455fa9433ebd1005908f1de1c805a9e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839756, "uuid": "06006324-b821-42f8-8b89-3175a5513ef7", "value": "T1EB942903ABDD2F9AF0A7CF3548362066445C1C6A7B94CD3AEFB86909710B7950F4A58F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839756, "uuid": "221d1fa6-e2a4-4848-9e48-408df4759fe3", "value": "12288:dx5uMDJxODZBZ86agdICQGknmfwa8JQJB6:dMDJ86aIH9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788839756, "uuid": "c2e298a7-310e-4e6e-87f6-9bf28d971818", "value": 418816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788839756, "uuid": "cb5d4933-f416-4712-8dd8-4d15316e1d52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839756, "uuid": "0610abed-078b-4a1c-93a3-c73defb08656", "value": "mips64l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f995a3-abcc-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788902852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902852, "uuid": "76d35847-4bbb-4768-887a-429fc5aca885", "comment": "Malware payload (JOMANGY)", "value": "7b0f241254df6369eb212877606beb20", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902852, "uuid": "220bd06a-bc17-4281-9ccd-cc91d4b75c79", "comment": "Malware payload (JOMANGY)", "value": "d49b6364096bad20e30d3c2be46c9aac136626f26f78ba0dc19ced6f897b073e", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902852, "uuid": "f92b1915-fc53-44b2-acf6-afa987047be7", "comment": "Malware payload (JOMANGY)", "value": "79bcd1bf0a7889812806aaa59ae953ac728d9c9d", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788902852, "uuid": "f30243db-4f5c-43b1-b703-381a218b374f", "comment": "Malware payload (JOMANGY)", "value": "71dcc09570e27e0456f50f7dc2fcc4098734862a0a821bdab92b54a12d5b76f7bb351782b25fa1efa64f313f28c7cf2f", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902852, "uuid": "79ce0ecb-a7f3-48c8-ab4e-1cceb68e92b0", "value": "T1CE235C6516857C24AE98C4361C7E2F0CB9AD43E6324452EE7FCF3CF68C4A6AD9109B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902852, "uuid": "e71a4492-b83e-46b1-8fe4-94a52afd3a49", "value": "768:G+M9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:G+hcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788902852, "uuid": "4a4a6bd5-1711-4da8-8530-766fcde3e5f3", "value": 50075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788902852, "uuid": "51923b20-46a5-42d5-9e3a-8948de99a936", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788902852, "uuid": "ff2813e3-7a28-4ed9-a723-5310e5599ac2", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c8113a-aba9-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788888082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888082, "uuid": "a1540805-1073-46e3-b4e8-945e3d59ea8d", "comment": "Malware payload (Mirai)", "value": "55192f1f4f82b418edac4528d5881480", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888082, "uuid": "765e72b1-77b4-4f42-bc86-7f72d351dd62", "comment": "Malware payload (Mirai)", "value": "d5f460d7902d829e8143724c8f1a4a11d974b3d87e31650c4f364c9f62a89f23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888082, "uuid": "64b03875-f3c2-4ea8-8079-38fcecc6d4b0", "comment": "Malware payload (Mirai)", "value": "5bb6cc4f187b75fa15a8718a80748ebbc5cfbac4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888082, "uuid": "70deb4a4-4abf-4f31-ad49-b0af4add73e0", "comment": "Malware payload (Mirai)", "value": "45bb240af8f503c734f5522296fd7f0ce6e5aed0b2492eb6f52843bba70445e80316a42577c143dcfc10ac102e35c1d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888082, "uuid": "398ce913-ae6f-4698-94d8-aca2497dedb3", "value": "T13F14B61E6E228F7EF278C73447B74A34AB6923D627E1D644D2ACC2105F2025E545FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888082, "uuid": "b223a928-83df-407d-9461-db27b6f2267d", "value": "3072:JJdKCUs+Kzt6x1TA7mM6c2Ts47CJxKMXoxIig4ZJX99:JJoC/+at6zAq4O7MI1g4Ht9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788888082, "uuid": "7c682001-ca03-4925-b461-8fc4fcf2470c", "value": 207684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788888082, "uuid": "f17ecf42-52de-4b68-808c-805123da2ace", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888082, "uuid": "c0c7bd0a-94a1-4bd1-9dcd-9f8fb4798852", "value": "270267430c9c545640a214dca3efd60d9761c309969c2e728f9968f56719c46e.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24dacf2a-ab34-11f1-915e-42010a9c000a", "comment": "Malware payload (ConnectWise)", "timestamp": 1788837586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837586, "uuid": "baba2994-75ba-4674-8d2a-933b099dad85", "comment": "Malware payload (ConnectWise)", "value": "acb1d27db20663a5932ead2861185a08", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837586, "uuid": "c5d7b743-379b-43b0-8309-a28d88d5b2ac", "comment": "Malware payload (ConnectWise)", "value": "d8fbcb21a5a5e2a30dba034a5ca4e9fb401529b2d86aa550bbc3fc1525804c99", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837586, "uuid": "624bb13f-62c1-4597-a8cf-55eea4f7b13f", "comment": "Malware payload (ConnectWise)", "value": "35f2216a006b3cfcf359a6c629950da7a7f42bd4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837586, "uuid": "37ad4bd1-4c4f-4d08-8138-9d2e77797abb", "comment": "Malware payload (ConnectWise)", "value": "83ce47db1d95b2699cb690458c40a5e1ee7505ac39556085bde8e5b998ffb745cd0ac1f7ca528107f93e14f3f58c0d47", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788837586, "uuid": "24990078-64d5-4fde-88cf-adcf42a5e6c3", "value": "T17BA6232123FAC168F1B61B35D93965B56936BD12DA22C04F1364BE6E3C31F949A72333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788837586, "uuid": "77d0e1c9-8d79-480e-84ec-cefdd7782a53", "value": "98304:WMn1Giy8E1PqhwG6ztZNK9aNGnMn1Giy8E1PqhAMn1Giy8E1PqhpMn1Giy8E1Pqh:hZWiGz3I96rZWijZWi4ZWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788837586, "uuid": "686b5581-a102-4039-af60-a46d8d9f7859", "value": 10244096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788837586, "uuid": "39b10376-42e0-45c3-b73c-ac7d695a012e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788837586, "uuid": "9d713eb8-8b6c-4b12-b52c-69846f14f88a", "value": "d8fbcb21a5a5e2a30dba034a5ca4e9fb401529b2d86aa550bbc3fc1525804c99.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e122beca-aba3-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788885577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788885577, "uuid": "bfb9b1d2-7894-4524-b17b-82342d7521ec", "comment": "Malware payload", "value": "6f38368e958d8875ec36d703431d0e15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788885577, "uuid": "127ed001-d6ca-4ab0-b253-54980e179597", "comment": "Malware payload", "value": "da4561c8596384aabfb7c8a19114600c2515592bcfcb59b9d58c52da13c415c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788885577, "uuid": "e93a7e5e-e8f3-4e3c-b308-e3260e4726c9", "comment": "Malware payload", "value": "4f9cf002372574444ab213ab39336c95132d4df7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788885577, "uuid": "0ec6f4b2-8973-438b-8b24-433871e57f1d", "comment": "Malware payload", "value": "efa6064d5a0d90b13dfa896622f67acc3b37c3c93805cbc5d7d7bb18a09f3094989be5b077381b0a7821d842b93a6502", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788885577, "uuid": "398a1cc4-a9eb-42d1-999d-17131a8b0e15", "value": "T1EBF523D5FAD66EB0C057F7B4819F677CF42E37958A619C07735C2B400E63A08A63AB81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788885577, "uuid": "e5aa45bd-962e-49ff-912c-b9293ac0d079", "value": "08e7493c0378f0a74cc4179181b4c610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788885577, "uuid": "0c9adeaa-bb8f-4d30-b2e2-e95b6db8939f", "value": "49152:ylxqnMX7wSKqwoLWjaAGtiPmZ7ChrivN5MOUvULewxfOE+CF:HuxKUseQmdUUwdMLRxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788885577, "uuid": "da9e2e12-f913-4d18-bfcb-e42269002a75", "value": 3347968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788885577, "uuid": "041c4d56-18e4-4ab7-91db-1875c0d5a521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788885577, "uuid": "3c60752c-f7b5-4f0c-9deb-e21f20b7b444", "value": "cbjew8jc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909c0661-ab9c-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788882435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788882435, "uuid": "d284c986-7e5a-410a-8cba-592d71285359", "comment": "Malware payload (JOMANGY)", "value": "8cc439e875ff8020bb5429d8d6061080", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788882435, "uuid": "c49ca16c-5a74-4907-b140-67bd519e539b", "comment": "Malware payload (JOMANGY)", "value": "db466c97f5a2810533136bb65be98d76658ca2182404e9b137b17c6e3d4ca33b", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788882435, "uuid": "e6b1d07c-06b9-45e9-9a1d-92dbf2f25c0f", "comment": "Malware payload (JOMANGY)", "value": "5855e1935fbd38877abc4588bdc6eb2fb998c7cd", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788882435, "uuid": "017e26ee-d409-40ef-bf4c-1685561f82fc", "comment": "Malware payload (JOMANGY)", "value": "88e2cb56340a3f6481f2ef08af4db2c21022330d880744b70fec92fc26bdc91b560fa1a6f781685367650b9e68ed86b6", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788882435, "uuid": "92987859-bc66-4868-8a6b-5b50e33b5bcc", "value": "T166C27D966A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788882435, "uuid": "f6b87c22-eec1-45ff-b1fc-99003d88d596", "value": "768:18vCB+25j6es8Rx9FYpMSUpi+20qUpi+20YQX:18l25Jnd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788882435, "uuid": "92d4392a-d142-48e3-a9d4-d4287673c2c6", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788882435, "uuid": "4b7470d2-213e-4fa8-9b44-039d7dffe168", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788882435, "uuid": "055dd190-905b-48a1-a8bc-8e59a956471e", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c96b083-ab5d-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855155, "uuid": "96c464aa-706c-40e7-8074-62382b5a137e", "comment": "Malware payload (SilentNet)", "value": "96c5651516be9c772c27fe1e3e98a0aa", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855155, "uuid": "5b6bb174-483a-490a-bfb0-f03b93e89a81", "comment": "Malware payload (SilentNet)", "value": "dd1c08e168854adc54bc6a59a9cebc5d438aa8fafc6a256668c2e8587c4a2325", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855155, "uuid": "559c5077-541a-445f-9934-4a997ed36826", "comment": "Malware payload (SilentNet)", "value": "7a96224ee81b306260b59b9ffe2ac14213f3e19b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855155, "uuid": "d9ecea19-a054-4fec-8672-1fcf8849e9ae", "comment": "Malware payload (SilentNet)", "value": "fcfb4313d37fe27a0149f3f2f605319340192bac39f7569d9dc6fd5adcd47e27a9a13d2a67c4a03c86d063ccc5022d8b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855155, "uuid": "0b04dc33-baec-432a-8d0e-b997d52a8024", "value": "T133830206490C9937E9976BBD0CDB1BB1AB2C15A14007F02FD5B428B997D7B7F4720386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855155, "uuid": "5600b6fc-7bfc-403a-bd5d-7acf705c84fb", "value": "1536:JcAMb5ioR7eHQAHN7ozO1gpybY3ao969TX5cbO3Vj8tQsjiZZhrdqSaP:JQ01VtozOCp/fQcbCj8usjAZVdhaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855155, "uuid": "fb3cb935-9dda-4978-b087-6b34a2328518", "value": 87720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855155, "uuid": "ba283180-49da-4b76-860f-e88a8d2230bf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855155, "uuid": "c5ba032b-db5e-4184-97fb-5622be0875f0", "value": "lrkeedupe-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184b3c19-aba0-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788883951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883951, "uuid": "f638485e-efd9-4d49-af01-a457fbdccf7e", "comment": "Malware payload (JOMANGY)", "value": "55c7a2cfbc9cfad1ba2f0279d1838e7f", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883951, "uuid": "da27b72e-9cad-4198-b24c-103b9648f97c", "comment": "Malware payload (JOMANGY)", "value": "dd9cd43c2d0cc3da45ec97302aab4b4c7f84b6e9921396de70244fa9eb8aaec0", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883951, "uuid": "786171d0-d690-4704-8d45-7c2325d6b847", "comment": "Malware payload (JOMANGY)", "value": "2202054f16aa9cde65db003be206149529b0e6dd", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883951, "uuid": "5c3ba463-a0c0-4a2b-84a0-cdd864ba82d9", "comment": "Malware payload (JOMANGY)", "value": "af856e5ebd029d14b88554b4852675f21a57d26372a81e6102790926d4ead3209585e9c4308516a639a20259e1c40df7", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883951, "uuid": "b531e903-a3af-4904-aac9-4911b24e5983", "value": "T1DD236C651A857C14AA98C4371D7E2F0CBDA943E6320452DE7FCB3CF28C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883951, "uuid": "ea536f58-76b9-4b84-98b5-7e414a7dbbdf", "value": "768:ZVEJVIhtMG9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:3EJ2Mjcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788883951, "uuid": "0e0279d3-057b-4c08-98e3-9eb8dd644adc", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788883951, "uuid": "e2934482-8904-4119-8e5e-693d443568f8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883951, "uuid": "c0192d8a-c52c-4a35-8ee1-92d4d52d04a9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc618d1-ab4a-11f1-915e-42010a9c000a", "comment": "Malware payload (JOMANGY)", "timestamp": 1788847076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788847076, "uuid": "41b76899-d74f-4d3a-b04d-4d25b99c1adb", "comment": "Malware payload (JOMANGY)", "value": "a82c54c5357eb243fa90895046f09444", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788847076, "uuid": "eb127ad7-3d87-4ac2-9fb9-b0899760195f", "comment": "Malware payload (JOMANGY)", "value": "de57451c69cc1d6f9a82861a8fa271e1f42d9582f16c50c74ee8c407c7436ae7", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788847076, "uuid": "2bac50fd-c01f-4fd2-849c-edb2b5abf228", "comment": "Malware payload (JOMANGY)", "value": "5a4ad2887d1c23dd48014a931a7a635f7f3f80d9", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788847076, "uuid": "18e3d64a-1ea1-4383-97e1-738e934ddbca", "comment": "Malware payload (JOMANGY)", "value": "4544d8d079d089534ed5393f4e48a94bb1f226ea1cc7a784016efed5d41a8f3ef535f8024d9b2d488006096f278617a8", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788847076, "uuid": "fb61985c-398b-4408-8bef-4717aa3866fb", "value": "T10A235C6516857C24AE98C4361C7E2F0CB9AD43E6324452EE7FCF3CF68C4A6AD910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788847076, "uuid": "aa1f140e-f2e9-4d7c-b997-baa83dbee95c", "value": "768:2+j9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:2+kcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788847076, "uuid": "068bad0f-1377-4349-b3a5-0775a6e8d731", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788847076, "uuid": "4894b4a2-3f0c-45af-90e0-b37940c70476", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788847076, "uuid": "af73fb9f-f433-4a9b-adc9-e5afd49c1d51", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b03554-ab3c-11f1-915e-42010a9c000a", "comment": "Malware payload (JOMANGY)", "timestamp": 1788841071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788841071, "uuid": "9873d029-3d0d-4d9b-9569-fb3219e1f8b7", "comment": "Malware payload (JOMANGY)", "value": "b2be4eedc93f7e31793fd24f56975c51", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788841071, "uuid": "a0c41e33-9105-4638-9e32-f48cb88651c5", "comment": "Malware payload (JOMANGY)", "value": "dfbe82bf78047d171e5f6e0f394708569de73a3786fb6920f87074be4a4dffb7", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788841071, "uuid": "5424015c-69f3-4fdd-acbe-d7e71b1c1f08", "comment": "Malware payload (JOMANGY)", "value": "47e04ef75f30826b6aea87ddd8d1e01f90a62980", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788841071, "uuid": "5a020141-6206-4924-a14c-9111d45e02b7", "comment": "Malware payload (JOMANGY)", "value": "a3ac3766a3d6f3df4307c477b937c0cb83f6b530e85b27788957de6fe238ed4c73dec8b48e69d7adba4d63c8d175ac8e", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788841071, "uuid": "46b0c46b-54f5-4940-968d-8fe830bab86e", "value": "T1AA235C6516957C24AE99C4361C7E2F0CBDAD43E6320452DE7FCE3CF28C4A69DA20971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788841071, "uuid": "31a9e1b9-74a4-46f2-8194-02e474f39f8b", "value": "768:Dsr0a1ldY9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:ghFcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788841071, "uuid": "591584f8-91db-46e1-a056-a2705c35e405", "value": 50079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788841071, "uuid": "030dd3f7-62b0-4119-96ad-f4d9249693cc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788841071, "uuid": "2e356b5b-c173-41a0-ab82-0a5b745f7e82", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5328262f-ab7f-11f1-915e-42010a9c000a", "comment": "Malware payload (PhantomStealer)", "timestamp": 1788869876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869876, "uuid": "e02c90ab-30b4-449b-b5a4-65ea7836bc96", "comment": "Malware payload (PhantomStealer)", "value": "6ef12c817d2fa9db469a642ae5756873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869876, "uuid": "3cc18de9-07b2-4d60-8cc6-abced3e0f59b", "comment": "Malware payload (PhantomStealer)", "value": "e0c7e26e5b57860b4820bab234bed9d48edff4e092744ddfe5065de9a7f3e8c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869876, "uuid": "307acc19-629f-4f32-ad6c-7e7d716f1b48", "comment": "Malware payload (PhantomStealer)", "value": "8d8c93bbc556230e568df771b1bec7b51f4cb693", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869876, "uuid": "2954e897-d43e-4034-8a45-218c805097cf", "comment": "Malware payload (PhantomStealer)", "value": "d9dfa32486e5f10b6771bb7d847c5725476035f8290fa46858afa8362162c3f524e1875fd1cce9976254ef48706956bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788869876, "uuid": "21e7d906-f266-4206-a8cd-bfd8df394e24", "value": "T123A63A7A121485B0996E571CF1A6D6A0BA9C238705EDFB3D70BC43483F623C7A79C9D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788869876, "uuid": "1cd96e12-a2d0-488e-8b7a-fba758e1df0f", "value": "196608:i6m25F3CV7d1tVeFMuWjwX8U4xB5DoThQsb8IzbSLC20SVnNiWoDea/8QWf8Jbrc:83um9DIOI8IzmLHZVNTVa/SqJCOrq9Ln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788869876, "uuid": "0533cc7d-a077-40b4-9deb-9bba621561c1", "value": 9941705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788869876, "uuid": "182e0155-f82c-4b5e-9841-99ee11dd90f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788869876, "uuid": "52982586-9927-4d7d-b94b-7e0e8b367605", "value": "GFG_PO_972026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71673e54-ab5e-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855754, "uuid": "68659104-5ce0-4137-a040-9b78e203da28", "comment": "Malware payload (SilentNet)", "value": "bf56f7b5f52c29695e5ba44b3cdd8388", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855754, "uuid": "d7a58ee3-5f86-4ac6-93c4-1b77211faa6a", "comment": "Malware payload (SilentNet)", "value": "e1b00fb2170bf7408f0c8f0da94320740bb0e4e7a5174068922cc9e6f35a000f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855754, "uuid": "4d577a04-f335-4ec0-b4e6-da2d5a46e132", "comment": "Malware payload (SilentNet)", "value": "f0cfd60432c6316cacafa2fdb375b18e44021fac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855754, "uuid": "83670898-872b-4d6c-824c-d715e7f8ed88", "comment": "Malware payload (SilentNet)", "value": "2341e4deaee1324cc0ea80f760541b29c7e6148a396a6240927bf4ad2c80f11e809e1dff6a0a68c5db1ea7ef099c34b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855754, "uuid": "8d470e35-da90-4c15-bca5-bee076a27ac1", "value": "T163263308FDB3E550E84AD3353E5B7A3C9015B1CAB7C6E6C34EA8A5E72D3A7814643D24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855754, "uuid": "d2d90d86-92fd-45e9-a844-dd9c9048f079", "value": "e81d90b230abc81b286482b9dba12e35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855754, "uuid": "1673e7b4-c7b7-4d39-9db8-22edf9dece42", "value": "98304:eUw3afQeks44RMi8MZ1Tfk7uZXDihYAiwmEiSqI32nghkZq/+e+lUhq:e7KfQekPuPZ1I7mDiCEiy3ALe+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855754, "uuid": "2db6204c-dc7f-429e-a781-de0270a73eaa", "value": 4573696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855754, "uuid": "202dd959-db52-4b5f-954c-d09da6ebb1af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855754, "uuid": "f15794ee-8c92-4d8b-8e4e-e6d422ad20fe", "value": "Neverlose.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab74e5a4-abd2-11f1-ab4f-4201ac107002", "comment": "Malware payload (JOMANGY)", "timestamp": 1788905673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788905673, "uuid": "fb74ec9c-a320-413e-b92c-8644b8e802f3", "comment": "Malware payload (JOMANGY)", "value": "58bd6346c89a7466fbf288e45c163d6e", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788905673, "uuid": "e0f8ef21-95eb-4dd0-9a85-4915d2a1da77", "comment": "Malware payload (JOMANGY)", "value": "e2505b685cc4ab141172a1d2d70beb2e2683e4c96fb3f29e9a9c7476a0a1360d", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788905673, "uuid": "2ce307b5-735d-4d61-a03b-4a7b5e0d81cd", "comment": "Malware payload (JOMANGY)", "value": "4a19c446e5e65d613e3a7933be423f213214a3a6", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788905673, "uuid": "e27055c7-0fbe-4652-b062-dbd7e4303634", "comment": "Malware payload (JOMANGY)", "value": "f084f23bd6567b8acd38cc900e480caf319398da1c7776b6236ccf6120e57192c89304f06067a4c59f7a687dde274a84", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788905673, "uuid": "460cfa40-ca15-49f1-82f9-b17eebac8477", "value": "T15AC27C966A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788905673, "uuid": "19fb7bc2-dca2-4188-b665-3d11181eb686", "value": "768:38vCB+25j6es8Re9FYpMSUpi+20qUpi+20YQX:38l25J4d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788905673, "uuid": "116e94e7-8f84-41dc-9df1-be4b3c1abdf5", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788905673, "uuid": "6dd93306-9bd9-46a1-93c6-4fb7bc523b91", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788905673, "uuid": "fda5c5f0-9686-4468-b389-63e5817cc447", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7c0769-ab72-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788864471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864471, "uuid": "e304c2a6-a4e5-427c-983c-6d9b8d414e13", "comment": "Malware payload (Mirai)", "value": "8efdc181a6ac5d6dfddccb98362c668e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864471, "uuid": "fb464ca0-15b6-46aa-ac6a-2a50ea557b5c", "comment": "Malware payload (Mirai)", "value": "e2bd2df04d99a41fbf40500e1de3fbf3c69a5ad952e4d23102d22d6de1246138", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864471, "uuid": "ff79d75c-f271-422f-8668-103c27cf6cee", "comment": "Malware payload (Mirai)", "value": "02f4155ccef33f0d2d888a130428ece703755767", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864471, "uuid": "881ab954-d1f1-44c9-978c-8e4bc055b2af", "comment": "Malware payload (Mirai)", "value": "295be668fd592cf7d8b5230ad9b25d58f1ce7a823dd8db361c92b47857790be8659a0bce6a146bf827b0a325dc2caab2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864471, "uuid": "be77cedb-dae8-443b-941f-e60ba67a0939", "value": "T184336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864471, "uuid": "f5e03d56-1e41-43a8-b04c-3a7cd2c4ac05", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788864471, "uuid": "c36953d3-be0a-4dbb-bb15-812c670f6441", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788864471, "uuid": "b0f14b02-a85b-4f0d-99fb-ffd21bc71e59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864471, "uuid": "efb75ef6-6848-490f-b2c5-d244c90c4ca0", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611df52f-abd2-11f1-ab4f-4201ac107002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788905548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788905548, "uuid": "b46b4dba-cd44-4d6b-8367-22610bbcb5da", "comment": "Malware payload (RemcosRAT)", "value": "cfb19edda3d4df6d44cbf0d1f047c17f", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788905548, "uuid": "45fe5c9c-bf67-4140-b9d7-c9351ceff94d", "comment": "Malware payload (RemcosRAT)", "value": "e3da33cd23e733ec215120582627110a37c6b97bfdefd36534240fd29b807016", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788905548, "uuid": "0e361458-657d-4dc0-b3f2-cd6c5b0fbab3", "comment": "Malware payload (RemcosRAT)", "value": "9bf1136a9f76e8ccdd8426f7ea626369cbabbe74", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788905548, "uuid": "cef00dd0-0b28-41f3-8618-f144879da76a", "comment": "Malware payload (RemcosRAT)", "value": "37ca0c508833b9d465871169ab5c2631ba6a35b4ee832174a1b8e076e0200ccb63b60613e07dc8855ea86d2f37112712", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788905548, "uuid": "4b5b73ab-e0d7-4623-b912-ea49f66da594", "value": "T182C25BA0AE2622E74A5F36F7CC998D70C9A40052012744B0BDFCB359695834CB7EE77B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788905548, "uuid": "63810e8b-77c5-4933-9b02-33741cc0c748", "value": "768:GpSmJqpwDZzeWmqAzUHAuu0JcLSS6DMkD+hLw6qj2yFTe:Nmoapmqd1oUzD+Kj2me", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788905548, "uuid": "7bcf7ca4-72dd-4133-8c61-32ad9b5e6af1", "value": 26488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788905548, "uuid": "6fe75038-2606-43f1-9cf0-739a305a3a0e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788905548, "uuid": "d1a8e5d0-4c84-4d1c-b2ff-89e434c1bf22", "value": "Taiwanske.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027978f7-aba0-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788883914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883914, "uuid": "8b4f8721-a051-4ee9-aa61-e9c0714cc133", "comment": "Malware payload (Vidar)", "value": "e083ba5de7aaa69bf9d20d9b2456f82e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883914, "uuid": "558495c1-2a1c-4a31-bcc7-2d936e13aa25", "comment": "Malware payload (Vidar)", "value": "e43782136726b254c25fa86638cac6679861ad657004416c846a48a41299d771", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883914, "uuid": "24c60759-f4a2-44fe-af6d-142a9b7354d8", "comment": "Malware payload (Vidar)", "value": "d81e02e2046d8765b1a97331defe7a453ddaccbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883914, "uuid": "00031f68-ee47-4bc9-9e2b-0f9c1587fe83", "comment": "Malware payload (Vidar)", "value": "b824aea240d20ccf94622e344ce8d4cb1316ee9bf653f7ab3b23625862aac37504e160eb70074a29c854b446441aead7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883914, "uuid": "dd043f44-4e87-4ab2-96dd-1dea465dbaf1", "value": "T1FD668C47BDA105F8C49A9735C8BB522276787C4D8F3273D72E50A6782F76BC0A97A700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883914, "uuid": "04d8530e-ea6b-4568-97da-48799716b99b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883914, "uuid": "ec00010d-1e9c-457f-9e8d-daf3965993cf", "value": "49152:D2GlYCAxNsAmW5ew/ARhlP6VVIiKYDqEROEXm3ZeXILqqIWUDvU:D6xgF6VVIiJqbEXmoXCL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788883914, "uuid": "98202898-e8e1-4347-9a7f-673acedeb980", "value": 7061504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788883914, "uuid": "95668c6a-2d47-434a-936c-b86fc3b300c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883914, "uuid": "3c283097-d2bd-4984-864d-ebb83fa8e685", "value": "e43782136726b254c25fa86638cac6679861ad657004416c846a48a41299d771.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20c4f93-abc3-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788899349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788899349, "uuid": "54717c85-b9c7-43a6-9be3-26d8a4b79581", "comment": "Malware payload", "value": "b90ebc308e723063b1892528c6ea59fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788899349, "uuid": "bd3c7768-1923-4e89-aaff-dfcaf157dffc", "comment": "Malware payload", "value": "e6038b2155bab0b94a9cb8320257b1c39e455ea6bb0452f3187f93c660d1f11f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788899349, "uuid": "788ce537-f8ec-4d4f-b448-2a8ac6628ae7", "comment": "Malware payload", "value": "0ab2fcbbea02909ded096777dce83cb6e1a74813", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788899349, "uuid": "b3d3515a-007b-499f-a605-12504500df3a", "comment": "Malware payload", "value": "31f04a845a18370c589dc6b7ba196b2b280b5536794f9ed1a10135c79fd7a680f5c52d54d416509b13db38ddfcbc9a33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788899349, "uuid": "4f7bdbf2-9a74-4f76-a3c9-a0dab110a369", "value": "T10486DF17A2E501ECD17AD13D8E9F9A03E372340A033197EB16D44E666F5BAE05E7EB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788899349, "uuid": "b864dcdc-26ed-4e8e-bcd9-46d73f01d55b", "value": "5e9a33e4cb8eadb34c2140bafb4d4f2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788899349, "uuid": "5361239f-2227-42d5-b8c7-90e28fb62737", "value": "196608:9IhTu0BVqC2MeLYO8VEj9MM+SA0UVZhUb:KhTuqsC2KlQ+SkZOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788899349, "uuid": "b70d96bd-6379-4692-9074-c8c950d8ebd9", "value": 8201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788899349, "uuid": "8ae297c0-185a-4971-9a3f-104694ae4135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788899349, "uuid": "a6c855ef-a8ea-4087-9599-fbd5f1110007", "value": "e6038b2155bab0b94a9cb8320257b1c39e455ea6bb0452f3187f93c660d1f11f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8791ae8f-ab37-11f1-915e-42010a9c000a", "comment": "Malware payload (ConnectWise)", "timestamp": 1788839041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839041, "uuid": "e832201b-93b5-498e-8382-c771db939f4c", "comment": "Malware payload (ConnectWise)", "value": "8dea02e0d1e30a3c029794c19cedb5ed", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839041, "uuid": "adf67712-54a2-4db5-a23b-0523e0754365", "comment": "Malware payload (ConnectWise)", "value": "e61caa4ae68ddd6af6473564eed06fb7d2cd7cc964f34ca50fb88dbb99e46da2", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839041, "uuid": "f58bb9c9-cc6e-4686-ace0-809b49fe49c5", "comment": "Malware payload (ConnectWise)", "value": "ca6f78eb9b94374e9d0d8b7860610143f7c48181", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839041, "uuid": "b2616756-2fdb-46db-9761-8d470d663e8e", "comment": "Malware payload (ConnectWise)", "value": "226eee194632e02d390dc89402939e835cad46f5bd2e91479156a884658eccf6b259301c84b118a972e66b0060aa161c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839041, "uuid": "40a890c4-8063-4582-91a6-e7f382030b5b", "value": "T1FDA6232123FAC168F1B61B35D93965B56936BD12DA22C04F1364BE6E3C31F949A72333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839041, "uuid": "722e75fa-7fe9-47e7-b315-8e826c1b124a", "value": "98304:sMn1Giy8E1PqhRG6ztZNK9aNGrMn1Giy8E1PqhAMn1Giy8E1PqhbMn1Giy8E1Pqh:fZWiJz3I96jZWijZWiaZWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788839041, "uuid": "8d83c44d-a634-461b-97b0-c00524fb9432", "value": 10244096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788839041, "uuid": "0c11fd3c-a1da-4633-b963-657cd6f1d0f5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839041, "uuid": "5686613e-6351-40bf-88ae-cc92ca7b1a85", "value": "e61caa4ae68ddd6af6473564eed06fb7d2cd7cc964f34ca50fb88dbb99e46da2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64004e81-ab62-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788857449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788857449, "uuid": "ac1293d8-fb15-4785-8eeb-45d77b56936c", "comment": "Malware payload", "value": "2f48f46fddcf94428569a311e0a35606", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788857449, "uuid": "b0053891-ace7-44a2-810b-b821f4b7000c", "comment": "Malware payload", "value": "e61ed4f393916be88461e2090a44b39928f50907b654183dc77bed10b63fdf4e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788857449, "uuid": "0b11f977-a865-486b-8eef-64ad798689ac", "comment": "Malware payload", "value": "99c84b70d0bd6bacab5b473ab16f34135eaf16a6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788857449, "uuid": "3c8f39ae-cad4-4ad7-9db0-f82aa0592e39", "comment": "Malware payload", "value": "3c150e0c21f6adeb59a7352eff9781d484d1856224ded9bd2d8c1091c4a0f73894e4c8b67d6822ccfac52c7feede7bd3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788857449, "uuid": "7823bc60-335b-4dcd-9e38-85c8cd629768", "value": "T1ABF479606D203D3FA5F58C26DBA389910FCCE9D21A32B4EDF624256D0A6D322FD1953D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788857449, "uuid": "ec339ab3-e8cb-42ce-a6e4-9aea434e2b19", "value": "12288:BtuCMRuwzXi/F6bp0jVqgP7+f4BUfXwQVFRYNPt1a083y2Nk8N4lhOK:PuCMRuwzXwm05jP7P2AQXRYxLZ8iS6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788857449, "uuid": "fe8acfe6-d129-48ed-800c-2f74e2a5285e", "value": 736628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788857449, "uuid": "a95d3ff5-bdf8-4839-9c27-02c95c8ab1c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788857449, "uuid": "8937e119-eea3-4303-b3a1-81115a4763c9", "value": "Estimate for Project AHG168592 St Georges Court 08.18.2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8434a544-ab94-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788878978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788878978, "uuid": "57900811-6e56-40f1-a1d0-0f9af5398baf", "comment": "Malware payload", "value": "28c80085d084cecd06f271931081a035", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "snowstealer", "colour": "#BBC2CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788878978, "uuid": "e0460a83-bf5b-4072-9e20-999e340fddf0", "comment": "Malware payload", "value": "e811cc7baadaba58c3c5e006f16a575afd827f2f04ec9b7243754d295f8e4205", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "snowstealer", "colour": "#BBC2CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788878978, "uuid": "1c46c824-a345-46e8-8e35-aa654f1eee39", "comment": "Malware payload", "value": "95fed640c14d796736143d3eb3cb4d03e804a1b8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "snowstealer", "colour": "#BBC2CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788878978, "uuid": "dc9fcc15-e4fc-4b3a-8d69-499c46f58b48", "comment": "Malware payload", "value": "ea24653119602a911a3f00ea5367c8d47a436146c958c6c9b8b1d727581f6888499444c3364fc37bcee6d44214f67a52", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "snowstealer", "colour": "#BBC2CB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788878978, "uuid": "d455c8d5-2d9d-48cb-98fa-9d8139276c06", "value": "T151272317BEAAC939DAD7D4F253838356642915DFE80BD02F8AE049948972D4E0312FFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788878978, "uuid": "86f0d0c7-0bb2-4c13-bb9d-64c76acd3e22", "value": "393216:npxAqeQhetBGRm/NGtb2Kd/ZUjzKuAsu7/5bfEa+fRQ8brGBbb7Y5:mdGRaGtbrmjz5Asu7/5SdrGtM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788878978, "uuid": "73807ef4-93ae-450b-8a69-2a4b02cba78d", "value": 21183149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788878978, "uuid": "51c4a1b6-607e-4d41-8fca-cc2d7be97b3a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788878978, "uuid": "8566e9a5-e9c8-45a7-8bb7-56efdba91bc9", "value": "payload.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1b19f2-ab82-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788871078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788871078, "uuid": "4e443fc7-d823-47f4-8d2d-fd9622a250d4", "comment": "Malware payload", "value": "874158a0577002d1e416ed56092d9da8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788871078, "uuid": "667cbf33-d3aa-4625-9049-4aaaa9fbfbac", "comment": "Malware payload", "value": "e91b81560b36e728f0f599e3b7d93ed31ea0aeb9c4bd6d08f48f1188e57fd7d4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788871078, "uuid": "59868ec4-2169-449c-9ea1-17ffcb332c79", "comment": "Malware payload", "value": "0dd45cc9ea0396c4575809fe8960a6d9bee4bdbf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788871078, "uuid": "250be5de-cef5-4f49-8f45-ad3b312298d9", "comment": "Malware payload", "value": "cb7f3864ae82340bf87a178bf31abe6ae6c750be6f19f30633ae6f7232b5ab2cfd5967716715304b142f8cfb0423ba04", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788871078, "uuid": "1e4914f4-c54d-454c-8d4e-6acc077a8940", "value": "T18C613481FDE79627155594B988BDB0382077337353D6BC30E7F638674FA8689122846F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788871078, "uuid": "526e6955-31b2-4c95-8111-9badd48da9c2", "value": "96:sSr2vBOPmf2/CSr2vBOPmf2/aSr2vBOPmf2/wSr2vBOPmf2/gSr2vBOPmf2/w:si2vBOPmf2/Ci2vBOPmf2/ai2vBOPmfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788871078, "uuid": "25bc4e7f-fb66-4fcf-b1be-923da534ba14", "value": 3463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788871078, "uuid": "89f255d6-fef4-4dd4-b873-aa12d1ad734b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788871078, "uuid": "f3704240-e1c1-486f-9603-19d928c65099", "value": "e91b81560b36e728f0f599e3b7d93ed31ea0aeb9c4bd6d08f48f1188e57fd7d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24148519-aba0-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788883971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883971, "uuid": "3738c50a-42fe-4a65-98d3-9413b99f6c59", "comment": "Malware payload", "value": "6bb41610c0a950f67c0eb4cfac160130", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883971, "uuid": "ad0b9312-46fb-4f15-90e6-5659499cfa79", "comment": "Malware payload", "value": "ea2c5fc96fc0b8000136c19c83eb545c96bf382af019e177f57d83df72bb82b5", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883971, "uuid": "dc7b35b1-cd53-4143-8af2-bab2ad53d052", "comment": "Malware payload", "value": "ee8ea642b51aae8124941c423f1e4a389d03944e", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788883971, "uuid": "4dbcfacc-fd35-4334-b706-9520febcab6f", "comment": "Malware payload", "value": "29d4e158d743f6e6a913303cce13d1b9fec70fcd92f7d8b9bc658735eb0050431c2ff923bffd8a67f19d987d8496f517", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883971, "uuid": "56d4254e-5f3c-47db-9f09-0e2ed447deec", "value": "T1F3E423795F538016CFBB81FAE367A68E7161BD9C217062B31F7115B0BAB7A3617D4008", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883971, "uuid": "b4dff169-dc18-4d93-aacb-118eb1b3014d", "value": "acb06808db35753dd3fb41d8c2e2f63b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883971, "uuid": "d7d0a90d-342b-4d34-a6a8-eaa82b2e9851", "value": "12288:U/AE0jPlR9Rgi51Ii6BOiymN6ZpYZF+BlTyOvFuzdb+R+t/xpv3kSuqDIpnEg:UnQBRgw6Em4WP+jTylzd6Ri7kAIhEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788883971, "uuid": "40cfc563-ae64-4595-9d94-082a5392caff", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788883971, "uuid": "024987d7-bbdf-4a09-ac26-bfabf2108380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788883971, "uuid": "8d4f672f-d270-492b-92eb-b017c03dec60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9497a8-ab96-11f1-ab4f-4201ac107002", "comment": "Malware payload (ConnectWise)", "timestamp": 1788879982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788879982, "uuid": "0e288791-2d1a-43ee-b7b8-90eaa0ec2d75", "comment": "Malware payload (ConnectWise)", "value": "e932eaa6e3b9e143f3286baa1865fd23", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788879982, "uuid": "15d4faa4-82c1-44af-ba2e-90c40c121d20", "comment": "Malware payload (ConnectWise)", "value": "eb7272fb38b2354eac2c245b55ea06b4f227d211d237419e34f6d460763ea2e0", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788879982, "uuid": "80267f38-6e24-4a49-89c6-0642248bc081", "comment": "Malware payload (ConnectWise)", "value": "a02ed526566497d2a78d997719fee95822af4e0b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788879982, "uuid": "bae52fc7-0493-4a0a-b1a0-5ae359b9b52e", "comment": "Malware payload (ConnectWise)", "value": "39a037509a7d9305af92247d0e3156b85be7059b0a4f67c4b3c804fd3fba7a696971fae584d335cb24b8e09860630626", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788879982, "uuid": "987490c8-f495-4881-8e1f-8b57c77abb09", "value": "T1ADA6232123FAC168F1B61B35D93965B56936BD12DA22C04F1354BE6E3C32F949A72333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788879982, "uuid": "d86dc3a6-5fca-43b1-89dd-c31479f34d0e", "value": "98304:8Mn1Giy8E1PqhTG6ztZNK9aNGiMn1Giy8E1PqhAMn1Giy8E1PqhjMn1Giy8E1Pqh:PZWiXz3I96cZWijZWiCZWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788879982, "uuid": "e5e7f381-b4ad-48fa-989a-a82228e132e7", "value": 10244096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788879982, "uuid": "19c22102-1866-4117-99c0-b8828bf3f878", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788879982, "uuid": "94cc1c74-a00f-47bf-80df-4b41ca5b700d", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4dde53-ab6d-11f1-915e-42010a9c000a", "comment": "Malware payload (JOMANGY)", "timestamp": 1788862272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788862272, "uuid": "3deb9375-431b-46c4-863f-3a5bc9b96f08", "comment": "Malware payload (JOMANGY)", "value": "6abebc2d8c06872a5808f6ae478d407f", "object_relation": "md5", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788862272, "uuid": "17b5a69e-b0aa-4422-a625-4f55e79af5e6", "comment": "Malware payload (JOMANGY)", "value": "ebdf3d10fbbfe32a9bfe484b640519d8f7f22aeadd599d2b2bc140ba250d89d7", "object_relation": "sha256", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788862272, "uuid": "8dc278c5-3077-47b0-9099-fb9832f9ef0d", "comment": "Malware payload (JOMANGY)", "value": "1efdab3d8719cb1421781c0c3e85a7dda5d0fe3f", "object_relation": "sha1", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788862272, "uuid": "6dadf507-5e3a-4952-bbc6-5c811128bd9f", "comment": "Malware payload (JOMANGY)", "value": "3b39ac9f7c5afdcb3d35a28a9cbd51305eb06d2f30e8482b03c2cbe591b334301b3499bc0a6b0989ad18ebf03823785a", "object_relation": "sha3-384", "Tag": [ { "name": "JOMANGY", "colour": "#270D66", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788862272, "uuid": "2a3b86b0-13f9-4d61-9788-824e4e9c2670", "value": "T12F235C552A857C14AA98C8371D7F2F0CB9A943E6320452DE7FCF3CF68C4AA9DA10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788862272, "uuid": "49fd0a86-7a8b-4dfa-a0e5-307c7b2458f1", "value": "768:3CFWzZx5m9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Skz9cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788862272, "uuid": "d0b667d4-f8c4-440c-8b66-772958fe4de5", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788862272, "uuid": "45f3f622-9e7b-48b9-9373-b065724feb1c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788862272, "uuid": "fec17557-199c-4a6b-91ac-8f05ac585711", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af034dc-ab5d-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855233, "uuid": "ad27e48f-a546-4464-b7f6-8ecea7a8b11c", "comment": "Malware payload (SilentNet)", "value": "790295cfb9c4fabbc83c91a4177343e9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855233, "uuid": "7caa7b13-c7a9-4f7e-b102-bfce335a5c73", "comment": "Malware payload (SilentNet)", "value": "ec3be663f5d3ee980b9c68d491b0c006311c48240ad39e1d6f2bf782414ba445", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855233, "uuid": "f6d53b2f-6725-4568-87e2-2cec9c66cbd2", "comment": "Malware payload (SilentNet)", "value": "dd098a33ef50ef7964590ebaacc075ed407f1bd8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855233, "uuid": "cb5f48c5-3653-4390-bb5e-3ba2fc875c25", "comment": "Malware payload (SilentNet)", "value": "4ef007894508c78b2cacfc2735a09ef0ef34e930d57c26100989ba0f7f9fee495c2e2a2f5d41a3b17d15a986d1be706f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855233, "uuid": "96217b48-b34f-4a7a-9827-3c44be9454d0", "value": "T14E64237B8C38AE60DF9FDCFB9AD0260879156D1A88DF5C8B1D9C487060D46DE06686A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855233, "uuid": "62c06071-2dab-4a2a-8422-1272c9232862", "value": "6144:aDtOMwOHWj3zaOqAEuPOgfw+jA/80ixcJahu46FPysYiDVJE40WAvm:akzK3AEuPDfw+jm80irhr6FqhiKLvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855233, "uuid": "40769b5b-bc32-4762-9a99-e459e49e5fb1", "value": 337130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855233, "uuid": "75e7270b-01e5-4dd5-8589-a95cd4c5c120", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855233, "uuid": "4c819c8b-e1cf-45b0-b8c0-67c0cc8aabe0", "value": "LynxDupe-1.21.10-1.0.5.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e625e348-aba9-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788888162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888162, "uuid": "cb97898b-00c0-429b-8066-02e85491f57e", "comment": "Malware payload (Mirai)", "value": "be9aab1ab82ab690110175dc0863c360", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888162, "uuid": "31dac7b5-425c-4e80-b1e7-9301fea1f9ce", "comment": "Malware payload (Mirai)", "value": "eceec0ccfa8901706fb86e2055d9e681697beb0b4d9f123b450b1c25030a744f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888162, "uuid": "dc30d65a-2804-4bf4-8034-cfb7e2bb2ad0", "comment": "Malware payload (Mirai)", "value": "1bc4591a325a5825fe204884155c72965fcefd06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788888162, "uuid": "8cae6cc6-0254-4cbf-9983-c9a727f80c14", "comment": "Malware payload (Mirai)", "value": "22b8643dce85fc8d2effcd35e651c8805fede474279f82f47a5fe7bbf2b834f1ddb700e489e047e28ad0f68be5404610", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888162, "uuid": "c1c3d666-1cc8-4305-83cc-8681068be553", "value": "T1AF63123DC8C29F69EC7E497F103D99386D49A0797CAA4BD107479C88C34F98CF6A5860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888162, "uuid": "9d8c0645-03e5-4774-8451-45ec95ae6a65", "value": "1536:hioZKs47iDvTTjhM6/Hkn9kdSmQ+N3xozRm3bNi/NU:EosDeDv22ZN3xgm3pgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788888162, "uuid": "da731557-49ec-4f7a-aa30-2cc0a451ae45", "value": 67076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788888162, "uuid": "503d5bdc-6e37-4cbe-831e-53d994089100", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788888162, "uuid": "0ab4d7df-5918-4bde-97ed-6bfb9bb6a34e", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce964e9e-ab36-11f1-915e-42010a9c000a", "comment": "Malware payload (AteraAgent)", "timestamp": 1788838730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838730, "uuid": "a41f1168-fd09-41d3-860d-9706fd2e751d", "comment": "Malware payload (AteraAgent)", "value": "99bd03075c8f795c1af0f6a7ecd7eda9", "object_relation": "md5", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838730, "uuid": "8e78c4ed-57a9-4df7-a96f-12f186d676fd", "comment": "Malware payload (AteraAgent)", "value": "ed6d05c9cfb0055bf4c00b80d6bb9c8353aa7deb6625b1861a12e994570a40c2", "object_relation": "sha256", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838730, "uuid": "f11225c1-9738-4136-83d3-b952acd04486", "comment": "Malware payload (AteraAgent)", "value": "d0b0104992b85b3f3e684c3b1ea76180ecf2f048", "object_relation": "sha1", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788838730, "uuid": "ee197566-8e63-4a08-9cec-45ccf6fdf5ba", "comment": "Malware payload (AteraAgent)", "value": "9195e8d9d721406d2519d9ab7ade639e3068c1690d930075c9b9adda2bbd7c4157b159f59e3f113a5159ba6225e12d1f", "object_relation": "sha3-384", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838730, "uuid": "c11097ac-d3d3-41e7-bca4-8c08b13ec119", "value": "T139D523117584483AE37B0A358D7ADAA05E7DFE605B70CA8E9308741E2D705C1AB76FB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838730, "uuid": "71d5a0e7-48a2-4109-9ade-b5b5a20e0de9", "value": "49152:U+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:U+lUlz9FKbsodq0YaH7ZPxMb8tT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788838730, "uuid": "5c4ef307-abd5-48fc-ace3-cb5d948917e5", "value": 2994176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788838730, "uuid": "c6d849b3-08db-4c39-aaae-1c59829ecb06", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788838730, "uuid": "b53696f0-80a7-44be-a922-aac371e687d7", "value": "ed6d05c9cfb0055bf4c00b80d6bb9c8353aa7deb6625b1861a12e994570a40c2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd7b693-ab72-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788864442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864442, "uuid": "5dbbc396-dcc5-4f10-bd86-d98182f01a5d", "comment": "Malware payload (Mirai)", "value": "45bfedf40b601e3e864ef572542a06f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864442, "uuid": "80203ab1-1b83-449f-bf60-86634745c39e", "comment": "Malware payload (Mirai)", "value": "ef45315889172143d932ea6dde28976a3af993ea81171edca137433ce1d6a824", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864442, "uuid": "ed2147b1-153c-45f5-b823-5a7a2919ed7d", "comment": "Malware payload (Mirai)", "value": "f0fad307425731dd1aa9e9898dc1dd880b5ba533", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864442, "uuid": "658b7c5c-9a3a-4ccc-8c9c-0f7e8a42de25", "comment": "Malware payload (Mirai)", "value": "4c7e273409cc2cdc8ee7e304404f73db58d6fec5090a04b8dac1dbc02abe6aa356080687f0671e4d95e177ca89701e03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864442, "uuid": "f89e88cb-177a-482a-8870-e3e706e108df", "value": "T15EA2D025D345AEF4DFAF9C946381C3C276E947C6278AC8E380FEAF026506046F789D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864442, "uuid": "24a4c348-e532-478d-9b61-684404466953", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5qM4uVcqgw05VxJK:9RxsSVsMD6xiJJE5zRWNT4uVcqgw09Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788864442, "uuid": "a594bb09-609b-46b5-a585-3280a7e6d9c3", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788864442, "uuid": "764e6a97-bcb0-415b-bdc5-0bcc99e004ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864442, "uuid": "781290f5-f69d-44c4-9440-d73b5585b799", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6c2eee-ab5e-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855744, "uuid": "6e8c4e6f-5b05-4ce4-b30a-70a130f0b34b", "comment": "Malware payload (SilentNet)", "value": "e0cd6e364229e4c5e80c39668b812408", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855744, "uuid": "dafeefcb-b55d-4d9a-960b-81c54e3698e3", "comment": "Malware payload (SilentNet)", "value": "efa09e17b62960842c08bb306d36e71d17941c00b3c3c091d7f19a3c02b0cb0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855744, "uuid": "ca37a753-abd1-4550-96c9-d401399181df", "comment": "Malware payload (SilentNet)", "value": "c614337382d36a7b35e156da088547451b35f9fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855744, "uuid": "181158cd-7719-4e30-b46c-5ab013ac29cc", "comment": "Malware payload (SilentNet)", "value": "74f9dfd780fa8867b7638da8da32306ed5d9071639f3dbda55e5ef343bc16c0bbe981e370847201c38070a38ee4f5ac6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855744, "uuid": "e6e04534-0552-46ab-9279-0e3eb415abb3", "value": "T15A357C83EBA385D8C156C8B5534FF137F9627C8E4A157196ABC41E633E67B64E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855744, "uuid": "eb150a11-7305-47cd-bf29-a0d8723e6a08", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855744, "uuid": "dc2f19b2-10ac-4172-9839-d631f98e47da", "value": "12288:JZ+OE4MmD6/Oyspc5EEBBBHGBgzGerwG+vPqItNquB:Jcb4M06WpoPrw5vP3f5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855744, "uuid": "caebd216-aa17-48dc-97b5-be9f4f0b0ff1", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855744, "uuid": "0f214d72-4502-4525-9032-664f039805c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855744, "uuid": "43f5254d-50b2-417b-8022-e1236593dbba", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d2c52f-ab29-11f1-915e-42010a9c000a", "comment": "Malware payload (Snowlight)", "timestamp": 1788833043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788833043, "uuid": "c18f3db7-323b-43a2-82b5-9b6289f0f50d", "comment": "Malware payload (Snowlight)", "value": "a1ffc032b82a259d0944f2c4ce68b0aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788833043, "uuid": "5daafb96-b2e8-4f1a-b9d3-822c148527ab", "comment": "Malware payload (Snowlight)", "value": "f0c8a0b759a6b01bf95c300056cc3618e15931573157fcb335e77c29890ac2f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788833043, "uuid": "b588a88f-cd2f-426d-af9a-09cd356a60c3", "comment": "Malware payload (Snowlight)", "value": "6c62c964417d005662e22834b50bd783ee4403e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788833043, "uuid": "768da2d1-c469-44e3-b38c-b471f087bda5", "comment": "Malware payload (Snowlight)", "value": "3087db0cf0804078ed0604d401c101d78ab994a9c3575c6c13a83c9d25f6f51dba8e5e01dc6950627cdf4f14e06234df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788833043, "uuid": "e91f2fb8-74a8-485a-96ac-6c7ffae0b17a", "value": "T1AB123047A2D0CE3FC8D953384467122472B794BEDF629713064915B63F427E81E6EB8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788833043, "uuid": "1b55bcff-2a1f-42c8-b722-acd56c444ef3", "value": "96:GqTVJWWGXzS6WH5ML09V1J9G8YmQ+hrsrwegVekrf7mxaamBFBp8sBRnsH5vZAC:GqnWWHJZMWT1YmJhrsnurfjTr8sbnsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788833043, "uuid": "657f0bd7-7bac-4fdb-8628-5daa7695f298", "value": 9800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788833043, "uuid": "d7c7a07d-2534-4d42-b265-4e2349dd2c9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788833043, "uuid": "48e86794-b09b-48b0-9137-fc871443b08d", "value": "f0c8a0b759a6b01bf95c300056cc3618e15931573157fcb335e77c29890ac2f8.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a5e2ba-abce-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788903813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903813, "uuid": "f755be8b-cf9f-465c-8951-5930978bc22a", "comment": "Malware payload (Vidar)", "value": "54eb3cae1e8ec4c0e164ea9e24ef5af2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903813, "uuid": "b885b6da-52be-434f-bad1-b2e41c49b018", "comment": "Malware payload (Vidar)", "value": "f1142e07e25d8178dfddd10b442f12a14b920c133f1a64b05a6ad58dd98068a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903813, "uuid": "a4fdb79e-9894-46f0-b2ac-b9739a1018eb", "comment": "Malware payload (Vidar)", "value": "56e119c62e3631015420445dd488496663a88d35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903813, "uuid": "ff4139f9-4b13-4e93-bd39-b5137d22e318", "comment": "Malware payload (Vidar)", "value": "dd98e3f9e97d537013d69b635f21e2ba12c8b55c6312aaf483f8b1322829b4b4182d1ca6c15d29e96fd8f078c5e2fa2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903813, "uuid": "9ffa27de-4182-4fac-b93f-8dc69b67bdcf", "value": "T17326AE07ACA560AAC2DA9739847A16107B64BC4D8B3133E72F50E7B42E737C05E7AF15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903813, "uuid": "0edbf70a-01d1-4122-a8ea-3707acd9f556", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903813, "uuid": "35312f16-7a50-4f6e-b84a-68a7cebc62b4", "value": "49152:bEC/LsD10OTSJfizBSXsLF2mTrTrEit60ynoTngzqvIZAmOywQprB0:bn+OJizgsR5D1tPyGn76w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788903813, "uuid": "dca81f21-c0f3-49b0-9c5e-0d29fb64ecd9", "value": 4759552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788903813, "uuid": "0cc2f178-b423-49af-8c66-ee9272d2f259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903813, "uuid": "f1153445-060c-4674-9030-0b127d17097b", "value": "f1142e07e25d8178dfddd10b442f12a14b920c133f1a64b05a6ad58dd98068a3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e18629f-abd1-11f1-ab4f-4201ac107002", "comment": "Malware payload", "timestamp": 1788905087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788905087, "uuid": "12196a0c-4545-40f7-9e27-bc0368fed15d", "comment": "Malware payload", "value": "17940eb2131c50138239c1d754d74003", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788905087, "uuid": "6dffca71-e43c-4b18-9781-ae19806a24a3", "comment": "Malware payload", "value": "f3194a746e0b91fa649eed5ccb0d43e1eb4cb87d41249fb5f38bd2740b9bbca0", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788905087, "uuid": "523cf148-0156-4f3b-9c74-c7d9daf26b4e", "comment": "Malware payload", "value": "1e4c76664b5a2338fe384b2a2b213da4e3d6bd12", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788905087, "uuid": "888ee771-1bbb-434a-8afe-34ce5f596a23", "comment": "Malware payload", "value": "245cfd7121de5b7ec7e8cfd7fed12bea314bd98b9274d2fbb39b309f67904e23eb178fb1a43fca940dd7e6f8c590411f", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788905087, "uuid": "8bdd4326-b560-44ad-8056-12da696b43a0", "value": "T1612633A7917B883BD4165839B5CA0EA1EC309329C1EEABB07E871C01D5F6B34D54B778", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788905087, "uuid": "092e3e02-f72b-4c98-95b1-66acc63fae12", "value": "300304ba47eeb447001eb41156f8b49c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788905087, "uuid": "7b92faaa-7ead-4421-9ab1-327dfd2c5385", "value": "98304:xXajIKvT+f6mZZJ2dq7v9HlwwoKu6LHPnZAUvWOf4uX:xbKvT+f6zd29MKu6LvN4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788905087, "uuid": "cdba1316-87e8-463b-913d-aa8e287fdb6c", "value": 4847616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788905087, "uuid": "2de072f6-1e53-4187-8d87-56c924f1a343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788905087, "uuid": "fe060dce-a3cd-4d98-88a3-0935c4c898e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa87c35b-ab24-11f1-915e-42010a9c000a", "comment": "Malware payload (Snowlight)", "timestamp": 1788830939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830939, "uuid": "e571b8a8-5d0c-4c0d-a9e4-5374299ffc34", "comment": "Malware payload (Snowlight)", "value": "7f8f00886b95131792280f389755f22e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830939, "uuid": "603cab54-5cca-4106-a138-7cd82e68299f", "comment": "Malware payload (Snowlight)", "value": "f3955df52cdc963fd91bf33001f60abbeb00b39fe0a0f52dcdbac24972fe3b21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830939, "uuid": "a374f3ae-7446-45f2-a3bf-799788f29a15", "comment": "Malware payload (Snowlight)", "value": "61186819688ede13b9e21a41acd9dc11c5670ee1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788830939, "uuid": "556695e8-51f8-4609-86ee-a4e03e3d6059", "comment": "Malware payload (Snowlight)", "value": "46755cd88aa88960953c38856be444f6c9efc6fdf431ac4a8125abef469edbe4b203814470fdb8c67f3f8a15125ccd01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830939, "uuid": "182c3d1e-c17f-434f-8078-daafcaeffaa6", "value": "T1AA123047A2D0CE3FC8D9573844A7122472B794BEDF629713064815B63F427E81E6EB8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830939, "uuid": "9b14e090-b218-4864-8db0-cda3c0eb1136", "value": "96:GqTVJWWGXzS61H5ML09V1J9G8Ym1+hrsrwegVekrf7mxaamBFBp8sBRnsH5vZAC:GqnWWHuZMWT1YmohrsnurfjTr8sbnsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788830939, "uuid": "f17d3189-b3e1-44c5-b3aa-ab6411e7c76e", "value": 9800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788830939, "uuid": "72d881b0-d2ab-4428-8fee-f6cb9ea5b1bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788830939, "uuid": "b67a7642-cfa2-48fc-943e-19ba81c981f9", "value": "f3955df52cdc963fd91bf33001f60abbeb00b39fe0a0f52dcdbac24972fe3b21.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5607492b-aba6-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788886632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886632, "uuid": "8216f914-e4bc-418c-84bc-d6658910bdac", "comment": "Malware payload (Mirai)", "value": "cf72cfed73b5314f2dc95be1888cd61b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886632, "uuid": "6894ab71-ec7e-4768-9b8d-962ff764d523", "comment": "Malware payload (Mirai)", "value": "f3972f6e2d50e1b28b83997a9e29cabebf983121195fa30b8d2f1ea984998ca4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886632, "uuid": "c683738e-c466-4cc1-a24e-115996e4c300", "comment": "Malware payload (Mirai)", "value": "d04dfc4125116952c163af0f87667284b2651863", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886632, "uuid": "c94de9c2-a67a-4edc-8d85-da65f536c469", "comment": "Malware payload (Mirai)", "value": "557c92025af7ae0904c8c8e5741fc5de4ab7c163353600cfad346f7f5fd4ec5c99f923d458e9fa3af8a5aaafb59928e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886632, "uuid": "c7a3993e-eccd-42dd-ae18-a799f0a8bd77", "value": "T1B6936D037A81C6BFC0CACAB917E7D9318523F87D1B236648B7E4BDB92E499D41E5D204", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886632, "uuid": "73b82486-14a4-4c04-bc04-f6d7fecc0590", "value": "1536:YtXYsyPxzkgx/udF+qxtpHeyzKYvQor/PqQjtWfggcdvsKOj0XTeIWhU:27gx/udwIeyHvQKHWflcdvnOj0jeIWhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788886632, "uuid": "03326910-7ade-4578-b0c0-2086bd42cd13", "value": 93553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788886632, "uuid": "565852b9-09ca-4b5d-be37-861eef3b4362", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886632, "uuid": "6385f58c-6cd3-4e2b-83f9-aa48cf452ac7", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7199e59f-abce-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788903858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903858, "uuid": "1723abb0-242d-4263-b8ee-6a4987e5ac7b", "comment": "Malware payload (Mirai)", "value": "3347855aa58333ca40d5c987c59e112c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903858, "uuid": "aaedc2aa-af00-48a7-b47f-b3f19a955774", "comment": "Malware payload (Mirai)", "value": "f527809022eef86d0921595f93229b802ea12fa3a140456c585f877da57fa698", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903858, "uuid": "0dc3af09-2496-4c2d-a9b7-a72ffa52661f", "comment": "Malware payload (Mirai)", "value": "421368d6433add88ee1bacba43c42f79cbb2a443", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903858, "uuid": "8359a9b5-99b1-4257-9a9b-94fb333b5389", "comment": "Malware payload (Mirai)", "value": "5daac8114cf587e0438cde6bb3e756b6e116bdd12974bb49e8e154c9732c1bfeaf0fb7f5b8775b85a2971ad3bc46fd5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903858, "uuid": "c45d2a85-670f-45f1-83ec-af614af5bd4f", "value": "T1CDF34C17B4C0D4FDC89AC2B44FAAE137AA32F5195134B15F67D4AF222F4EE215B1DA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903858, "uuid": "5a08bc23-cfd8-45b1-83b6-9e6325e76d6c", "value": "3072:tdPAvqRVbTqhnMjYdVk//h4oKEJdnxO9Uso2at3UVjjHgui5:tVkAVb+B7Wu+yOspjpi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788903858, "uuid": "a85c0e98-a4bd-4910-90ad-166ebe701184", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788903858, "uuid": "1f663eba-dd5f-4f80-9704-4c9635faeef3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903858, "uuid": "d7288f08-16d9-466b-81ed-ddf1f1d92093", "value": "20627e7bbf0bd28d5c9b150498e926332d9eca4b39804a6e53907d4a6597a27c.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f10507-aba1-11f1-ab4f-4201ac107002", "comment": "Malware payload (AgentTesla)", "timestamp": 1788884538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884538, "uuid": "21ca8038-ec8b-4525-9c6b-187d1746dcd9", "comment": "Malware payload (AgentTesla)", "value": "1e4754929117236e0f734120bc5db952", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884538, "uuid": "ebc53e63-db92-45a2-aea2-6b144af9e5af", "comment": "Malware payload (AgentTesla)", "value": "f55b48f3ab03d6e88acd9f0397cbba733f4af684ca3024d6729937d217de449a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884538, "uuid": "cacf820f-f2bc-44e3-befe-fd08c1138d1b", "comment": "Malware payload (AgentTesla)", "value": "43ae713ae5362cab8f57f17259f00eea56106e8d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788884538, "uuid": "11122e74-e761-434c-ad74-0faa8027acf1", "comment": "Malware payload (AgentTesla)", "value": "e88d4cb5af87a2c5200b43d49ea20a0d0b5999b291e7df56046776fe94d51815bd6865c9f0f0769f714156e81e0a8c9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884538, "uuid": "ae51b127-57be-4e9d-ad34-c8464bfe6f8c", "value": "T1D2B40EC1285B44B340B326FBD37E97A28B9114D73DE55C08BCBF1613E76498792A229F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884538, "uuid": "d9b9ecc8-0c17-41e1-ac48-352ff6af6ff8", "value": "3072:Vs8mYZYz+WhX3wZYY+6S++uwyLbTD4QnIxwNeAbMrbY3Qp79Tv6wAyMeZYZ:sBZZWfIA3YYbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788884538, "uuid": "8db94f74-5e3b-4463-9ead-dd932925bdce", "value": 499327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788884538, "uuid": "fda2a47b-d1fa-44ba-9969-2881f27cda6e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788884538, "uuid": "1218b8cb-d67a-4261-9594-35c3b9834034", "value": "RFQ2009918.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace7a626-ab5d-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855424, "uuid": "3cf1c886-62b8-4b39-a046-ffacae7452b6", "comment": "Malware payload (SilentNet)", "value": "19407dcbfe668d40a85dc5bca44b201d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855424, "uuid": "ed301cdc-a5b1-4ff6-8af8-067efc7c7a6a", "comment": "Malware payload (SilentNet)", "value": "f59c96b37f7112bed8bfc0a953a9ff09251bba70cef7e9ca23bbf948156339df", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855424, "uuid": "7ab948bf-562c-4c51-840b-ff43d274f75b", "comment": "Malware payload (SilentNet)", "value": "d72331641b0bb4afba82c821c60103787e37c77d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855424, "uuid": "d6ecc84e-a24c-42e8-82d1-77ff741ecbbd", "comment": "Malware payload (SilentNet)", "value": "b35ca0c66e2d9752b412273d85edc6855125dc6e04fb87c4188fc4a0d37557a60b2d4cda3fce470b23373307deaec9e8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855424, "uuid": "89d3ed45-786d-4086-a446-85c551e876b2", "value": "T146A41218FD6F6C3FF363F2BA60819644F03C0E9D8693242F796610B9786A2C7064D59E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855424, "uuid": "2535087b-5421-45c7-a3b4-a1fbd2158f1c", "value": "12288:548t3Uz03s30PeDpFmx/NKlHUe5wtCll7hKM6owOQY:wz13ueDpI/6HUe5welFKM6gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855424, "uuid": "849a78a4-a484-4591-9edf-0d079ebe020f", "value": 465016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855424, "uuid": "30dac321-cea1-4946-a766-5d367b740598", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855424, "uuid": "5f14e666-d06a-4177-98e5-94ba1283b09b", "value": "DupeMod (2).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57af590c-abce-11f1-ab4f-4201ac107002", "comment": "Malware payload (Vidar)", "timestamp": 1788903814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903814, "uuid": "7ca17742-1e81-49e6-81dc-b7ab8823ed26", "comment": "Malware payload (Vidar)", "value": "c31991f6adba0cd505e1e8f59cdf0b9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903814, "uuid": "a45a58e8-445f-4960-bd6b-6f1db05ee44a", "comment": "Malware payload (Vidar)", "value": "f601cde9845b729dcbbcd0b8b972baff995c8ed2b81f5469ffd1693051b44fc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903814, "uuid": "69ede6fb-476a-4560-8080-85e639acfa79", "comment": "Malware payload (Vidar)", "value": "9a90dfde0b02cb410c7f79f6529ad2aade4e1969", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788903814, "uuid": "1df59f2c-c569-4666-ba25-d83202bf63de", "comment": "Malware payload (Vidar)", "value": "c81c1f0d8fa54f56827f0c123b551c5aa7a634102c26ff666bdb682c9c722b06bb6918690548cac72db8856684a4965d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903814, "uuid": "31ad7b81-c25b-45dd-8f67-de301b377b5e", "value": "T1D926AE076C88946AC1A59B35886A11527B60FC5CD73233EB2F50F7B82F72BC05D7AB49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903814, "uuid": "5dcffab1-0b95-48b7-881c-d644a3bb246c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903814, "uuid": "4377799b-1950-49e3-88d1-bd961bb085d6", "value": "49152:CTQ9jBwm0Vh0vLf/mZZETIz3q83ISp8z8mUFQc32PfwGfysLwYMIawQwYu+:CS+h8/ITqiIoVywVcwYM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788903814, "uuid": "c0627f0a-999d-4398-9449-c6a6455ffd8d", "value": 4734976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788903814, "uuid": "73183d71-9934-4351-b716-5ebbc80e9702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788903814, "uuid": "e66549fc-a37e-421b-b8a0-fc514d6c51a7", "value": "f601cde9845b729dcbbcd0b8b972baff995c8ed2b81f5469ffd1693051b44fc7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5925d7-abd9-11f1-ab4f-4201ac107002", "comment": "Malware payload (SilentNet)", "timestamp": 1788908471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908471, "uuid": "bbdd3176-9629-4d11-952e-89fe6aec2016", "comment": "Malware payload (SilentNet)", "value": "c038d81cf591ebd5ca834c670c8fce83", "object_relation": "md5", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908471, "uuid": "972cc1dd-218e-44cf-a87f-fd3c95f40891", "comment": "Malware payload (SilentNet)", "value": "f72cecb79c59fc50cde41400d9ca422d303cd444769e7ec9423889136a7a93aa", "object_relation": "sha256", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908471, "uuid": "a75d63bf-453f-4938-956a-f8d82d49901f", "comment": "Malware payload (SilentNet)", "value": "0b26498a4c669a1ee22d65d3a4a5b170ce3b9719", "object_relation": "sha1", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788908471, "uuid": "90bc6eab-04a3-494b-a93f-b790f8c99070", "comment": "Malware payload (SilentNet)", "value": "4e5d314cdcde3a0511ef958d8fdffe80311c2978130be4d9247ab82d4ae595a82053d9987d3e7d1c4edb83d05f2c5b20", "object_relation": "sha3-384", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908471, "uuid": "fe622b0e-915a-48bb-bd4c-6b8cbe4d9ab2", "value": "T1F3E51227E9D8C07FD867B33291025AA1B94D0AF3D00560FF16FC0ABAC9859DB27617D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908471, "uuid": "2821e959-503e-4f65-bf28-89262512f829", "value": "49152:aWCBm2R3UT4+7hCLYILY757B2S6zJjnB/p2HR3MSMCbT1tZv9BV+5JS:fXVYsAFlbBUx3MJWjBse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788908471, "uuid": "61495476-200b-44d9-a693-366865367923", "value": 3286169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788908471, "uuid": "18d519d9-a924-4da8-8310-448e3487f6df", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788908471, "uuid": "f8952d1e-de6e-4f1a-94da-5263e04bb56d", "value": "meteorrejects.net__meteor-rejects-addon-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77542901-ab5e-11f1-915e-42010a9c000a", "comment": "Malware payload (SilentNet)", "timestamp": 1788855764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855764, "uuid": "ddf03747-4676-41d7-b305-12fbf4002621", "comment": "Malware payload (SilentNet)", "value": "fdba2dbf5e2ff53c0a2b155d8333c49e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855764, "uuid": "1b54581d-a2e8-4304-bec9-4d75f80e7bcf", "comment": "Malware payload (SilentNet)", "value": "f83e1d09a7ec89fb462ad890a6fe8dc359777cca51fa9008d4972cab449b3219", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855764, "uuid": "2c334745-808f-4349-abf9-22b26ec4fc57", "comment": "Malware payload (SilentNet)", "value": "bfcb53c41fb0b18ecd85c43ebdd97a2d7ea61b36", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788855764, "uuid": "f09348c0-8019-4ef8-80ba-0112381f7d1f", "comment": "Malware payload (SilentNet)", "value": "72b4cd9a2b19e4109334cf122ebebb6e5c0b933af6e91957202693a13c360c913d050183c007f3ef2fa69756b3211b33", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855764, "uuid": "29baf74e-63d9-44c9-a554-69bbef32c5e4", "value": "T16885335B8C7D2E7FCAAE557525F2EE099E0B49B0E032FCD02865550F8C94713EEACA04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855764, "uuid": "9964a46c-9936-4dd5-9444-ab38d8bc175d", "value": "49152:1sJmTal3C8afWS1vtBr6Fexj4bB7NCB67fkPUs:+Jfr0Br6Q897NCB6T0Us", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788855764, "uuid": "50e746da-8aeb-4af8-8c99-e213721262ab", "value": 1845333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788855764, "uuid": "88909155-5af9-4606-a956-781f27a9ec96", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788855764, "uuid": "51cbb370-450c-4085-9b9d-788d2da77143", "value": "silentent1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276126ff-ab2f-11f1-915e-42010a9c000a", "comment": "Malware payload (MimiKatz)", "timestamp": 1788835443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788835443, "uuid": "337e1564-2832-48ac-aa5e-53e26966da1a", "comment": "Malware payload (MimiKatz)", "value": "fec27228340485485f6902f8759bbd62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788835443, "uuid": "2a950d33-5efe-4798-8be0-142d0fe6ded7", "comment": "Malware payload (MimiKatz)", "value": "f9d53fdcc12d548e6c9bd395642f30d2b2c6a9a4204bc0948badf8a7c571c072", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788835443, "uuid": "48d4415d-5116-47e6-a5f4-4fb85a8080b3", "comment": "Malware payload (MimiKatz)", "value": "07b35a3b431e653ddcf36cecd49793d538e2aa79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788835443, "uuid": "da0469e0-4594-4928-bea1-a3e18ebaa909", "comment": "Malware payload (MimiKatz)", "value": "aaca94b895f32da5fea040638288b10674b6e1c1cb582d9e8191de568f238d182125fc0a5a455b66042bd379feeda69d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788835443, "uuid": "d9a0bb20-c396-4563-992a-7e8ef0bcbac2", "value": "T143D6F156A3A414FAD1B7C139C9538613E7B2BC560320DBDF03A09A692F337D56E3AB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788835443, "uuid": "eeaae4f0-89b1-4b7d-b582-58b11bb78952", "value": "8dac155865a010dc953bf586eeb8bec7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788835443, "uuid": "7bbd2e1b-186b-407f-9b2c-488c25ec99bd", "value": "49152:FDQJE+1A++B+O93+xG96G9Cb3NmGUdO7m9buq7M9c0zVG/mr4/YaX2:2qVruQ9Cb3N3noo6CVCdQam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788835443, "uuid": "cd4f98c8-b20d-4bfe-8a84-eb0f706d9346", "value": 13782016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788835443, "uuid": "ddd629db-6ac1-405f-b17b-1cb530ffbcd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788835443, "uuid": "e398a9d5-82f1-4752-bd5d-dae19afde8fc", "value": "f9d53fdcc12d548e6c9bd395642f30d2b2c6a9a4204bc0948badf8a7c571c072.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1805345-aba8-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788887698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887698, "uuid": "14f451ae-b66d-4ab0-8afa-b35342daf17a", "comment": "Malware payload (Mirai)", "value": "4590e2c59834c2798be2c38fa8265dd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887698, "uuid": "8a993b5a-14a0-4f60-a45a-5bea8dffd3a8", "comment": "Malware payload (Mirai)", "value": "fa4a5b7a33aff414c1ed83adbe3088a521545beae7b3ec3c596f392fc7d11c24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887698, "uuid": "c8bdeb7a-4c60-444b-9a0a-86233c7a9769", "comment": "Malware payload (Mirai)", "value": "1ca705f12cec20f0c24858daab5c903b8f2ce218", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788887698, "uuid": "7681ff25-52a0-4cf9-b943-4b7527145028", "comment": "Malware payload (Mirai)", "value": "46cde423f0ea5cd003d5d0aab134d47e1f177ad4daf92a432434be862355e579b48941bf251aca6e2f780dfb33f6ace6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788887698, "uuid": "efb6772b-a2a9-426d-86d8-a3d38d75eff9", "value": "T17043F214C0594DC2F8ADA8F966BF12803BA21B7D1E93CF6384E25F417118B11E9B3AD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788887698, "uuid": "d877f32e-c6f4-44ab-a5ca-2f363a366e86", "value": "1536:jl8bB0rzgCj+0SqQ3JcIjRhOPwLxBBk74bhS1yByI4u+qgw09E/:jlEbdqQHTOPCBk7Wk1m4u+qgwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788887698, "uuid": "d26e3db3-3e53-4d3e-b987-324d3baf8684", "value": 59868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788887698, "uuid": "a9e8e1dc-e8f7-4879-ab64-e2e1e2a77ec9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788887698, "uuid": "06de6571-5d55-4f3e-9742-b44533681a29", "value": "fa4a5b7a33aff414c1ed83adbe3088a521545beae7b3ec3c596f392fc7d11c24.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0952bab-ab34-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788837875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837875, "uuid": "ccdbe5f8-c54b-45e6-8ca2-4ce7a9149b7d", "comment": "Malware payload", "value": "5aa5552af2fdaa9750f4d4863dbf9de5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837875, "uuid": "51c1f051-a598-437b-85e4-9a70bb279d10", "comment": "Malware payload", "value": "fbd3f82f987fad70873f8d36e6492d100569e6eff9eda99ec8b2a07c09ad9d5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837875, "uuid": "22848ea0-3a9a-4a2c-8a8b-94043c274ecf", "comment": "Malware payload", "value": "4d5f507a33cfd2c7ba153470d99456f7306f087e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788837875, "uuid": "fd0b391c-e677-41e0-bb1b-b02c7c93c1e7", "comment": "Malware payload", "value": "b281cc114b887677d17c993e7c8d7c2897e686b5049ef0047d8673a819ceba2b93157e9caae0f143f3e3e8d84ab3f6f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788837875, "uuid": "5b42a6be-de15-40bf-b0f5-b6af69708252", "value": "T195B62323E14E673EE066563955B29A40853FBE60651E8CA386FC3D4CCE2D1A01DBEF47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788837875, "uuid": "368577dd-7b83-445f-a995-afe79c17c0a3", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788837875, "uuid": "47f9a318-e933-4e66-8fee-9b5a5d1b54d9", "value": "196608:IDbqCYGAqQotkvLxMgCucvxqVbO0RQmEQWjg10sIbsjGC+vsFB6yp/:IDmCYGAqyTmuJhO0RQmMOIbsGYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788837875, "uuid": "fbeca1b6-d999-4a79-8703-a3bc05cc165c", "value": 10922864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788837875, "uuid": "79852597-709e-4f37-b94a-be71eac313bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788837875, "uuid": "694c1302-0538-4a15-a21b-1766af3e1df8", "value": "fbd3f82f987fad70873f8d36e6492d100569e6eff9eda99ec8b2a07c09ad9d5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398b9a5d-ab39-11f1-915e-42010a9c000a", "comment": "Malware payload (Gafgyt)", "timestamp": 1788839769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839769, "uuid": "78d6bd09-f5ff-4fca-a6a7-4a3f81395136", "comment": "Malware payload (Gafgyt)", "value": "17e6ed28c3fe440eea3a5b44835a217d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839769, "uuid": "d5594c97-02a4-4d13-965c-3192bc0b5acc", "comment": "Malware payload (Gafgyt)", "value": "fd37ee45cc881b41cb3b14e8e24ddb92cc54d5ddbfeb3bdfcea839b9aa486370", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839769, "uuid": "c2761405-9f12-4878-b952-f6b0c16aa840", "comment": "Malware payload (Gafgyt)", "value": "204894ea363bb8cbc9c721b4fedfa2aa32cc848f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788839769, "uuid": "72bbc4c9-71a4-48c5-872a-e0ff405fb5f1", "comment": "Malware payload (Gafgyt)", "value": "97e0f531524a93be9ac10c37d6603ec041f83f04ac8a300d704d99fd6cbf96bdbff0687d5bdff768127dde4c8405447b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839769, "uuid": "0817f8b0-8c90-454c-84ce-79f81d5442af", "value": "T181C32B40FD508767C2D327B6F78E439D37365A6497DB3311A934BDB42B86B982E39220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839769, "uuid": "c73babd1-0209-4f1b-b615-6a558dd6a1c2", "value": "3072:930/d/ERYlkDgAmOAPhLn1VSmMqzD7RbiEFmZ9TQ3dL1j5B6A:yOMxn7SmRJmZ9TQ3dxj5B6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788839769, "uuid": "73949ea0-7775-4a02-b732-21d3cf72a7f4", "value": 121269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788839769, "uuid": "1348a172-ed60-4402-b246-be782d370b80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788839769, "uuid": "89b6d823-8b35-4d0c-bd6b-c7d59c2ab2cc", "value": "telnetd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6dfdfb0-ab72-11f1-915e-42010a9c000a", "comment": "Malware payload (Mirai)", "timestamp": 1788864541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864541, "uuid": "0ca40ce0-9951-408f-9359-272aba16ab03", "comment": "Malware payload (Mirai)", "value": "a80ce2bc22eb79cd7d3b717db26656bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864541, "uuid": "0008942a-e141-4f76-8812-e1270e61adf3", "comment": "Malware payload (Mirai)", "value": "fe3d59dd3798b3ea558f040c7f15e8e8e2b852d33da2ad8d72062855429f4343", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864541, "uuid": "591b2bda-8c52-4220-8aa9-b47063b49162", "comment": "Malware payload (Mirai)", "value": "fa9eb73d4d02910fabd100bb0723ea1a15304807", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788864541, "uuid": "37bdebbc-ad47-4561-8efc-5cd67fb60e18", "comment": "Malware payload (Mirai)", "value": "fd2ba0966bc450739f1013a61bcf5f0eddf6fd9f03e857ba9dc3c69dcd991794f6d1f859a20b1539d891171adcf19ca4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864541, "uuid": "61092ca6-e5f2-44c8-9600-24078ab7bf86", "value": "T1B72309C8F443D9F9DC5A09742036FB27DBB2F6BA2329DE43D7A49523AC51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864541, "uuid": "416731fc-8b20-4812-8b97-629a4acc12d4", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AGAZq/4Qw7bn2iie:Gv4QPfZfW5XTOeoEz0qAQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788864541, "uuid": "dc4c9a42-bead-4b6d-9e35-5726c9da9af9", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788864541, "uuid": "b7d6a498-4bd1-4250-a05c-2a0d5b4900f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788864541, "uuid": "6eae766d-8ee1-45b3-9fd7-ddb07986ef82", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6d359d-ab2a-11f1-915e-42010a9c000a", "comment": "Malware payload (XRed)", "timestamp": 1788833308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788833308, "uuid": "cfc7bdf6-ba39-40cd-90a4-55ba5abe074f", "comment": "Malware payload (XRed)", "value": "19f88273e1076a090e4ec439c2ee560c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788833308, "uuid": "e7ef4e2b-2ad2-405b-a9b6-ad22f37ea2a3", "comment": "Malware payload (XRed)", "value": "fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788833308, "uuid": "0c683e60-851e-403d-a03c-192fde453455", "comment": "Malware payload (XRed)", "value": "6fe767347543cf94386c17d98306ffd2798b2438", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788833308, "uuid": "5fc10337-fbe8-4f95-b047-ffcc470c17fc", "comment": "Malware payload (XRed)", "value": "329b089b6cda6a855178e04a32a3e6528504aed1bf45bff15b89844739a4db849df45dbe347f4e6b3c24b5b31f9b1865", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788833308, "uuid": "27c07443-c07b-441b-bc9a-3365c38f1ba8", "value": "T118161222B2D18437D1322A3C9C6BA3A5583EBE513D38764E7BE91D4C8F396423D652D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788833308, "uuid": "5df959b3-86dd-47a1-8732-84f706e6af2e", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788833308, "uuid": "4ed40fcf-95ce-48cc-b1b8-9bb888fe64f3", "value": "98304:jnsmtk2aaAD1e6OE6wDSUIEgzD/NrS27fgAf1HKcU/Y/:7LhADzOEpSUhglu27oAf5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788833308, "uuid": "a96f7fa3-bc21-4640-96ee-fa2288aa0ff6", "value": 4404736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788833308, "uuid": "2b957d70-d8ae-4d76-8517-d4dcb8ad564d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788833308, "uuid": "7eca195a-2cbe-43d3-ab95-e0a479bc338a", "value": "fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee10370-aba6-11f1-ab4f-4201ac107002", "comment": "Malware payload (Mirai)", "timestamp": 1788886620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886620, "uuid": "414a70f4-6f02-4ace-abfc-f2a7d8074707", "comment": "Malware payload (Mirai)", "value": "b0b90f5c4543d97ebc2ae7b86b63681d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886620, "uuid": "832bc6e7-5d18-4f1b-a6c6-5d7000fd89cd", "comment": "Malware payload (Mirai)", "value": "fea2567c15cfa36d7a159525519358c255d73330bd0f9304f2c9557eee002c0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886620, "uuid": "b3e0e1a4-f889-4ffc-bf0e-95d37cdb09d9", "comment": "Malware payload (Mirai)", "value": "735a6fce41355718b9bd4a37beabf0c0b843f109", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788886620, "uuid": "cc61c0b1-12f1-45d2-8a58-bf3cda860b5b", "comment": "Malware payload (Mirai)", "value": "1a4f177b36d0157156ffcad66e978ea3e3fabdd3430edff7b9383d428e5d1c91d5fa4a194eb1ea757deb8f196a2eda59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886620, "uuid": "b8529c79-6acd-4ab8-ac17-3bf6062e1972", "value": "T1CB230261490A8EB115303C76EB95D793B9E02AB1C6773023D6280A3C6FB9B131E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886620, "uuid": "d66e71b9-e807-4c29-873f-1cceab7cdf26", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3fj9q3UELbUXfi6nVMQHI4vcGpv6:DECFd+A6YHAxfiLRQZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788886620, "uuid": "20b1216c-0900-4910-ba89-4c02189ab9bd", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788886620, "uuid": "a5efa567-b97b-4b00-9254-9eccd93c8215", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788886620, "uuid": "2d775d71-4692-41d9-a2a6-ef339e278026", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33ec1fb-ab7d-11f1-915e-42010a9c000a", "comment": "Malware payload", "timestamp": 1788869259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869259, "uuid": "9137f362-5a00-4ad6-8740-8d24c8c3716d", "comment": "Malware payload", "value": "e2c12341a98c99c4ad253a4e64b6ecc6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869259, "uuid": "1eb0e461-c54e-491a-89de-4713a4334464", "comment": "Malware payload", "value": "ffa0c1d98447b57a3087cfa9eceecb24483f481fbf52ac37ec9c7ddaaa77be03", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869259, "uuid": "47b21f22-2f10-4695-8982-efee9ef71475", "comment": "Malware payload", "value": "3840a35a68c288cc6d1af4fef374a91db50f0d46", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788869259, "uuid": "4b2575b7-0c06-4951-8cfc-b6016b6561ef", "comment": "Malware payload", "value": "a303742cdb3893e648d31541ce015dcc7013a587dcb75f803a998c30bb2e24ffedde019478eea7acd3c36e87e66204b7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788869259, "uuid": "9008a0f7-d1c8-42e8-bd5d-8ff35ae597d0", "value": "T1BF531BCEB6D1A33119E2A0E2809B250E52BB65195C9818AEFD06F7F46DB0DC7407BF25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788869259, "uuid": "6cc02939-e9a9-49e2-8d1c-ebdef3720f2c", "value": "1536:j9Ugf0OlfljpaXP6qKq5t504cpd8V1WEkM:x2Kldaf6y1039e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788869259, "uuid": "8847b16e-9087-4578-a94a-61adc74fe63c", "value": 66099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788869259, "uuid": "1ee2ca20-1ec7-41bc-85f2-4fffb6fe2bba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788869259, "uuid": "28580b1a-e2db-44ff-a66b-4e0cfa6e1131", "value": "_6DB2YRHtXowh8-p7O7LJEg_SB-_Uqw37Jx92qp3vgM.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }