{ "Event": { "published": true, "date": "2024-04-14", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-04-14", "timestamp": 1713139381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "7d678cb4-0801-4f78-9d41-7fa3346f550b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74013a5a-fa3d-11ee-a120-42010a9c002e", "comment": "Malware payload (CobaltStrike)", "timestamp": 1713085234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713085234, "uuid": "726e234b-6de6-4596-92a2-8b3111b2e6ad", "comment": "Malware payload (CobaltStrike)", "value": "fb1eaeac9d731a6cf7a9613fb2ea6eac", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713085234, "uuid": "8c7bf243-f266-4099-b35e-97ca008bc052", "comment": "Malware payload (CobaltStrike)", "value": "003b780abec3cf77df45838f40b0fa63602501499fce9fb980545003e4804c3e", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713085234, "uuid": "658780e4-82e6-4ecf-b5ce-397a8e89d091", "comment": "Malware payload (CobaltStrike)", "value": "8db7b75b0e1015cd0e00a6295c580623b0693ef3", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713085234, "uuid": "472cb25f-3fe5-4c5e-99ff-60d2260241ee", "comment": "Malware payload (CobaltStrike)", "value": "1d67b34ff709bb389e4d4849c8381f48aa66112abecaae591893bd837bfc6916dea3111af1f52b76136d0cfeba846eb1", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713085234, "uuid": "d78ee7a9-75cc-47c5-9f16-b90571b5eff0", "value": "T12354DF687CA807F7CEC477F922DB966B16E4B4F34C5D6076DA041E18B3862296BCD708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713085234, "uuid": "fee3e512-3de7-47bb-9c50-02b2d4ceb41f", "value": "dc25ee78e2ef4d36faa0badf1e7461c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713085234, "uuid": "c7e24d9d-061c-42d9-8890-af72de0820c7", "value": "6144:0R+fWsVZOq6kS8olP10luBnmyJJ2TrpAXiFxkmF1:0KdVZOJkS8auuBmyorpASFTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713085234, "uuid": "5e6c78c4-e0e7-453f-b97c-5b598ea5f554", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713085234, "uuid": "fa8427a8-3fad-4b4f-bb7d-b442e16b3b41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713085234, "uuid": "539b69e0-cb88-4b95-b9e5-5fab6cd59283", "value": "FB1EAEAC9D731A6CF7A9613FB2EA6EAC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dcecf79-fa6e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713106215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106215, "uuid": "8d87c086-4a61-408a-85f6-a084418d9976", "comment": "Malware payload", "value": "d40b251f8e9d8c5147772b4c0849decb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106215, "uuid": "831f5f08-4b05-4c67-bc77-9051a735de51", "comment": "Malware payload", "value": "0211abb28c2c5ecbd217342feb635a294a5fb1cda3d1690b2f198040d5d41366", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106215, "uuid": "1150afd0-00b6-4be3-baea-60fb5c357bff", "comment": "Malware payload", "value": "8ee932ade8bd246a0fa66fd4022bc5973f40783b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106215, "uuid": "36e38254-7acd-4aad-904d-1f686670a8bd", "comment": "Malware payload", "value": "014ea0a77cc2ef16565be28c78bf20c84108fa1cd66d7f89f7f2cf811138f6d840c738d111fff438e53d0e9f97c9bddc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106215, "uuid": "590f2375-e871-4d92-bf70-b9bc4de3f08b", "value": "T141431894B991AA16CAD443BBFE0F43CD37262398E2EE3607DD252F5137D652B0E6B101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106215, "uuid": "f1ca5a98-24bd-4369-a2b1-2ed6f646089a", "value": "768:vsnF5dDITUoadpcWO8uzfpy4CTjacbL10GbrlTHDSwlsCRcPSv8jtsMy89CDgkbO:02udWW4oacbL10GP5eM8SvmtH9bs0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713106215, "uuid": "a6d8c5d6-bbcf-47ea-936d-4ef9d8bd82b7", "value": 59608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713106215, "uuid": "e89da60e-744d-4214-92ae-21213de2f6a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106215, "uuid": "67a1ae5c-a274-41ef-ba3d-f86a6cacaa61", "value": "la.bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d355a00c-fa80-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713114170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114170, "uuid": "7db87038-6d3a-42fd-b9e2-6c0a02574447", "comment": "Malware payload", "value": "b2b746d7d3169a22687a5dd6ce22489a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114170, "uuid": "9886110f-0912-4a4a-8099-86920a2c21e3", "comment": "Malware payload", "value": "049d41d6914b334127f3616599848a5000cff327173cf196234c7ba1607d0f27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114170, "uuid": "e647d1dc-2780-49ef-afdf-d643a0dfdfab", "comment": "Malware payload", "value": "c3da0b9619132ac45131e83636fecc8ec4b80759", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114170, "uuid": "7907fd27-4670-4813-867b-f81690b09b9f", "comment": "Malware payload", "value": "8d3dcceb4d9e170c6cc0bbf5032d9d5253e97dc72120403fa0b2bb03bf2d76c3a97a354a8d71c00bbc7730abf8dea2e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114170, "uuid": "3647e17f-fd59-4a66-ae6f-73c7d46aec6c", "value": "T1E5E2E1C2F8D3152BDD13C075C55CBC4A4A757982C78C1192DFF6E89B2A6E843A438877", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114170, "uuid": "5df1dc10-5182-4cdd-90b2-42b3a5b506ed", "value": "768:W/ZcTLiPxzZvOyP2uz8aEis+iBOsNSy7s:W/+viXd2Y8qs+iBONh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713114170, "uuid": "700f40d7-a512-49fd-bc1c-ddc387fa23b5", "value": 31180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713114170, "uuid": "38b37e0e-7a65-4f92-8b65-6e63d9114fbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114170, "uuid": "b080bc6d-ffbd-4f4d-8084-a9b08bc7d3a6", "value": "b2b746d7d3169a22687a5dd6ce22489a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900a8ed8-fa8b-11ee-a120-42010a9c002e", "comment": "Malware payload (RustyStealer)", "timestamp": 1713118781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713118781, "uuid": "280e2636-bf69-4d65-a34c-9cf8bea0b5fa", "comment": "Malware payload (RustyStealer)", "value": "02fb726ccf9a550dafc00f7dbfe5c1ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713118781, "uuid": "b0130fbc-4398-43e5-bc31-7f7eacd4043c", "comment": "Malware payload (RustyStealer)", "value": "060705db94b7ea673486db72ffc54fbd5e3c898758f9a16575d636c78e95dffb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713118781, "uuid": "6ee6c3f8-389d-4bf8-abac-e221cd5534a8", "comment": "Malware payload (RustyStealer)", "value": "cc76c96c3da76c91fd577f89fcf7c4cbe32a1f43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713118781, "uuid": "1e95a8ca-0347-4aab-a85d-25563faa7446", "comment": "Malware payload (RustyStealer)", "value": "37722b0c976ca3948c282085e7e008e3742fa0998d3720339cf05163b2741788a556d9c9c4946f13f0d8564cd44835a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713118781, "uuid": "efb6bdd2-63ed-467d-9658-f7895dcfd52f", "value": "T1B29533837B1B73FCD02204B472DCC7245B56624A93046ED6BBCCB7EE81969519C0AEDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713118781, "uuid": "e7a96072-1951-4575-a996-e896697c2e29", "value": "9761d7f3317a7cc87eb18d6e1e095949", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713118781, "uuid": "dcca34b1-57f8-4f36-950d-6d717a8fd51d", "value": "49152:/wxb3o8TXMk4QM9ILbzYXaQGvLrWVRcjenoiCGYu:4S8TXMk45gz+GvLrWVmenovRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713118781, "uuid": "90aa58a2-65a0-440e-a567-f6702e32c0ec", "value": 1895424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713118781, "uuid": "247feda7-e28e-4718-b177-fab59d21a491", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713118781, "uuid": "874ee78c-17ab-4af5-a01e-001f367ccc78", "value": "SecuriteInfo.com.W32.PossibleThreat.20321.17771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846a709c-fa1a-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1713070229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713070229, "uuid": "3c8dce1e-7f4c-45d5-92c8-1743e13de04c", "comment": "Malware payload (njrat)", "value": "f0ff2a2046a4fefcd2d04c92c812fcf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713070229, "uuid": "ed364e5c-1bdd-41bd-b1f4-d0023eb2785f", "comment": "Malware payload (njrat)", "value": "06b314e6e7127b58bdafcd05252a28af38233afe2b188584eb4d27ab372c8762", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713070229, "uuid": "1f198fa2-1b67-4da1-88c0-1a31a5b4b520", "comment": "Malware payload (njrat)", "value": "d2004f23d6b5a90888395c1f2d72d288b2dea821", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713070229, "uuid": "6a85083d-b8b8-4c20-aa6c-54813f995d75", "comment": "Malware payload (njrat)", "value": "6c07e355b43ed6babf632b4b04816aefe720149700c21e57903ac07d56141e436e799f3af81259af343eb41b009df645", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713070229, "uuid": "1240b86d-e453-4c92-bf04-082b6409a453", "value": "T12293E84D37E55065E2FE4AF3A870B2400FB9F0471742938D49E1A9761A33AD88F94DBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713070229, "uuid": "4363d7e3-0a46-435a-99bb-3e9d69162ea1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713070229, "uuid": "130ddff9-3642-4e40-a028-35d0213a04e9", "value": "768:eGZefAM+0uGAfIi+qXuzMywjZdLJakHX+xWvYR4SYzkYFI3tr3/iTnRVOR1MY4qn:YfAl0pUjBjZdL4kHG5mkYQJVR1/LpNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713070229, "uuid": "07b3c701-fa4d-42fa-aa46-26726283dfaf", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713070229, "uuid": "0d38f94e-fd13-4d57-90b4-398b60e36dc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713070229, "uuid": "1479d493-8b1a-4cd2-86fb-a999b92e0048", "value": "F0FF2A2046A4FEFCD2D04C92C812FCF2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea302061-fa14-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1713067823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713067823, "uuid": "abf4615e-09af-4f65-868f-0f056acc4d34", "comment": "Malware payload (DCRat)", "value": "ef5bfcad3c7aa6158767b798d657a292", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713067823, "uuid": "80ce6a88-5c47-4800-9352-a9da44d6a9b8", "comment": "Malware payload (DCRat)", "value": "07efd31e78e6442f68a9fb7b15ad7e9bf98b4824c8b78b08f03b7d3de9fec017", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713067823, "uuid": "bda0a18c-76cf-4725-aaf7-e686c038d3a8", "comment": "Malware payload (DCRat)", "value": "e466c81d2210c054501c17485260ad798dab9eb7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713067823, "uuid": "2326c720-7b05-4264-b2c4-845ac55024f8", "comment": "Malware payload (DCRat)", "value": "ac9a9b9c5b0856c74fe8410225d48d4e5f39388ef3ac487e87483c205565b73feb786894173207ae739b45d0d8f3cb5f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713067823, "uuid": "6450adb7-1cc2-43d1-bf85-25759781cc58", "value": "T1E1D5B0303DEB502AF173EFB59AE4749ADA6EF6B33B07585E205003864713A81DDD163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713067823, "uuid": "565f70b5-2e0d-4bc7-ab90-35c7e0e54c49", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713067823, "uuid": "7b5d71d7-61a1-4c6e-b255-c4d106d63ca4", "value": "24576:2TbBv5rUyXVMtypQ+LGQrOCw7sULqPyZwSxIshnWIjm7vZAjX+ez87TkQPI1Q7S7:IBJUyp9JrolwSx9WkiLekTk1JMTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713067823, "uuid": "e3af5dcc-2e81-4792-8a7f-b3ce9fac16d7", "value": 2839329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713067823, "uuid": "f6579f42-f5c0-41b6-98db-b2599a411bef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713067823, "uuid": "59597b08-debb-4a01-8f9f-266f0346ec5a", "value": "EF5BFCAD3C7AA6158767B798D657A292.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a88c1ef-fab5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713136784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136784, "uuid": "4e85cab5-8404-4465-bf50-586dfcd55051", "comment": "Malware payload (Mirai)", "value": "4802e109f2ab30a3f5e44b717e081cf1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136784, "uuid": "e53ff403-a9b5-4b49-a1eb-ee06431db7ed", "comment": "Malware payload (Mirai)", "value": "0a2939e9541be55d8649fdf4fc3eff713f104a2e29242f4675390b93b52a993e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136784, "uuid": "00059a66-934d-426e-9972-ed7a044d24dc", "comment": "Malware payload (Mirai)", "value": "d402d0706fa26ae929a587bc65e22e28167171af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136784, "uuid": "01c20c82-e1e6-4d74-b336-9181ae3ce103", "comment": "Malware payload (Mirai)", "value": "020de9469121f71e784ae6f320dbf485d0c76506a5cd33ba7c25d5459ab656d73fc0a503c968198721a9f8210cdc555f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136784, "uuid": "09a5acd3-9163-4b48-ad23-595e401a13bc", "value": "T1AD13F974381AF3E8DC982238E4471EF22A9209583EEDE6D3F0575121F9F578CB955E0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136784, "uuid": "3f7bab05-e6d6-4541-ab2b-03b2c6b9f055", "value": "768:By3JVyXfgPJ3kp9S+O+9qrpa7zN9nSCkOg1Jm1NnwRIDoEgRaQj+X5y1TRCHXyVd:BCJcXYFppa7zuvmvwb0g+X5y1TRqZchf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713136784, "uuid": "ade928d0-fa08-4dad-ba6e-077aa0eae3d9", "value": 42608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713136784, "uuid": "97e548a5-ccd4-4bf4-9077-4372e33113ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136784, "uuid": "36831333-8dbf-43d6-89f1-3b186b9dde44", "value": "4802e109f2ab30a3f5e44b717e081cf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11648379-f9f4-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713053715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713053715, "uuid": "88ac90ed-7a9b-4bc4-94c0-e04ffaf84561", "comment": "Malware payload (RiseProStealer)", "value": "18e9236574dec293b11218d5fda96900", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713053715, "uuid": "51d43451-7394-4b2e-a9d9-8f3bd2c07e5c", "comment": "Malware payload (RiseProStealer)", "value": "0b2c7652633890afad7653ad3df00a3766e0270a0c383197a2592f184abcbcd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713053715, "uuid": "069cc29d-48ab-45a1-9b86-3d9757deb20b", "comment": "Malware payload (RiseProStealer)", "value": "1c43f8769769063a9437243ed29bdddadbd0fd28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713053715, "uuid": "22496629-0b52-4754-9f9e-0c9ff4ae195f", "comment": "Malware payload (RiseProStealer)", "value": "9d173aa6635d8fd2e24b636a1f1175816730ba1a5be377ae1f95591c49a9637102f064e7b6ddced814d300061dbaaa4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713053715, "uuid": "f0f83b25-c9cc-4a57-a21f-26715a97e785", "value": "T11AB533561F392122CCE54A7293D329AA05B1B5A44E74BB5E6CC77CF7760FABB0301C4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713053715, "uuid": "afb4d5ab-6283-49d3-a734-37621fe3a390", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713053715, "uuid": "97543420-d3cf-44e1-ace6-324983522fe0", "value": "49152:ASUl6vD5DxN6HHLJFwBH/6nVWJylCxn2I4CBwhGxTPSmfUdKIdEsENDL:ASSwD5DxkEfJylCgI4zhGxTPfU/dEtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713053715, "uuid": "35e98114-dccc-40a4-9cdb-66de004001ae", "value": 2298880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713053715, "uuid": "f7fa86a1-0a1c-49f1-b04c-50796a0003f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713053715, "uuid": "5af31620-083c-4957-9afa-b51c8b2a283f", "value": "18e9236574dec293b11218d5fda96900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20eda1d1-fa2a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713076934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076934, "uuid": "9187f5a5-fa67-4afa-99d8-647cbe728940", "comment": "Malware payload (Mirai)", "value": "8e98a612281e3a9f6a5bf3b6704d83cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076934, "uuid": "1b849206-cc77-4870-b574-d1b3cc76b4e9", "comment": "Malware payload (Mirai)", "value": "0b301aa2101489ac8b888b16a86bfb4fa1f91af7d2bd885c7575168407b89785", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076934, "uuid": "c643ca27-3d01-489a-b6d7-e4f9524ea2df", "comment": "Malware payload (Mirai)", "value": "6b3b0de3e49d8a43284cdd3e49ab56fa2b78ce87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076934, "uuid": "33cdbfec-70fd-4bf5-b77e-ad92a5a56f44", "comment": "Malware payload (Mirai)", "value": "c0866caca34992de8e77588db9fc6696172478a7df3239c3d76f3deeb3da18b2a2da4027088015f0fdd1d7f62b0d5baa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076934, "uuid": "1c14200b-c96c-4d3e-b84d-7a37b66af86a", "value": "T11FC32B37922C0643C09B4AF12DB76BF24F69ADF313A51184921DBFC05B73AB22552F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076934, "uuid": "2217b730-55ee-472d-a7b8-ac20cd6ea4df", "value": "1536:eGcGYJier4ZQi3KOt13rXSNhIPri1ZBecFL1Uuk7qd1mrOEzZTtNMNu:5RNer4ZNKgi1Zj1j1mrnzZZNMNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713076934, "uuid": "b8829439-77f6-4b9e-9863-4f131e900025", "value": 127704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713076934, "uuid": "812ed01c-e947-4f28-bfa8-f95a8e1b23b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076934, "uuid": "202a7cae-cb7d-4485-8320-4a2bf9fd6201", "value": "8e98a612281e3a9f6a5bf3b6704d83cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa52a440-fa6c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713105511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105511, "uuid": "bb41c38b-11c5-4eb8-8bfb-a53110c2b923", "comment": "Malware payload (Mirai)", "value": "7b3f594a266bdbcc4d4629f5c0c5c08e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105511, "uuid": "95060916-1741-48a8-8f04-99e9518fe329", "comment": "Malware payload (Mirai)", "value": "0bbb44d916da7dcef63bce899f8de857fd1235059295524b2fa83522ea94bcc3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105511, "uuid": "b5243a34-963d-4dbf-9ca8-33e6420d89ca", "comment": "Malware payload (Mirai)", "value": "2b859db9d7a021e23f920570b699e9ad0e0d0207", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105511, "uuid": "0b2b01cf-e7f7-4841-ac41-a2b3fff417e9", "comment": "Malware payload (Mirai)", "value": "c69793ee73222334ea29c2221a44d0ed32971d0777b322fe618ae7ff30d1d6e3733759e9c7f791f66ba65a0f68447830", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713105511, "uuid": "0c99ff4d-5360-40f9-87a5-e26f79bfc045", "value": "T14253AEA6C819BD94C4008334B422DEB42B63F40596671EB98E8789955487EFCF61E3FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713105511, "uuid": "a5032b36-3fa5-4d99-bba2-315341dd727c", "value": "1536:Oa8tF/MUQ75ifwt1AR+AWJx/Naz/TlHmrmCwM:OXttMUQ75QkzCTlmrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713105511, "uuid": "a6fbc52d-e5f5-42cf-aa6a-8710252643d2", "value": 63884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713105511, "uuid": "463780dc-1dac-45b9-9a48-b56356168693", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713105511, "uuid": "58574dda-895c-456b-bef3-74dde429d09a", "value": "7b3f594a266bdbcc4d4629f5c0c5c08e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2bcfbd-fa5d-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713098991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713098991, "uuid": "e50a1271-5e10-4009-97b1-2042421af3df", "comment": "Malware payload (Mirai)", "value": "cee01240d45219070e452d237cea7768", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713098991, "uuid": "31fbcb74-97ca-424c-ae44-c8199209490a", "comment": "Malware payload (Mirai)", "value": "102ca1bb1e781cf3d07f856331484e84c89bbd3840e88b3f59856682032c049d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713098991, "uuid": "d5577d95-56f5-4b4a-a29d-ba1faca7b0fb", "comment": "Malware payload (Mirai)", "value": "1d7496e7b6721a62f39061bda9a13d7e13bcde2d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713098991, "uuid": "d70d9df9-c3c9-4057-b540-794c4caa5ae5", "comment": "Malware payload (Mirai)", "value": "fe5be25fe010092943f4a53937a5f6179db5947250eaa057c6b262dcb0c2939f59d0299f78cd4116f48a2e87e1cd7073", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713098991, "uuid": "d2ac06b5-8bdf-4136-a6bd-bf85667d9090", "value": "T1AB4112CD1B715FA8F4AAD13843334E7176AD5A88A7D18241F1ACD9000E9138E99AFEE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713098991, "uuid": "826c3554-f77d-46c9-919f-7c91e8fa1216", "value": "48:ZS+chzgkZ2zEClQximcpcDZJrE8EvqKR4lrpy4IVlK+5m:PkZ6lrmuc3rE8ElR4lrpy4IVT5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713098991, "uuid": "47c22d9f-361b-46e4-9d65-7858a1b71f6d", "value": 2096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713098991, "uuid": "ff714753-27da-4aeb-b67a-f4b70de3339a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713098991, "uuid": "b3489d45-4a30-42b7-aa34-82e5a04de6b0", "value": "mips-20240414-1249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496b2d57-fa6e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713106208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106208, "uuid": "b6d65885-52eb-4e9c-9abf-0311851a54f6", "comment": "Malware payload", "value": "5ff789b520cf1b1d81f87eba295c25ba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106208, "uuid": "20ca079e-a760-4bba-b40f-d10c5c38782f", "comment": "Malware payload", "value": "11696fec138919ea3de0edcca4b34d8f1f6abeb5430a5e6cdcacbafd43d45a0d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106208, "uuid": "37e7a965-4c8e-4ab4-9c3f-833638831841", "comment": "Malware payload", "value": "155db6d421948a5a75d2fc980c77b4e8d8583bde", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106208, "uuid": "2bf44518-9da5-4bd9-ab5b-0a0db7d1a5c4", "comment": "Malware payload", "value": "6189632a6cf56900673b028b19021d888b435232ff58a7a08f8066d954ebba31993ba68f1904fc1e04ff168c1e880ae7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106208, "uuid": "605da7ee-a107-45d0-a561-fa2271f47d48", "value": "T1404328C8A913D8F5EC25053424B3E7724631F5391029FA93DB99DE26BC42F22BD4639D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106208, "uuid": "e85d5a49-e052-4931-b125-2df6057cd741", "value": "1536:2CTEI1vjzOe9XDfugr1fFiNGkbkv0GbI5w4ljyoQRN:2CAkvjzH9T2gxfFiNGE9GbISAjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713106208, "uuid": "2aa735fb-940c-4890-ac4d-81b9c84377ba", "value": 58000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713106208, "uuid": "713b6aa1-f374-4616-a551-77f054b3c4da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106208, "uuid": "b73717ec-c772-4a1c-880f-04b723404823", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f13dc49a-fa1c-11ee-a120-42010a9c002e", "comment": "Malware payload (Amadey)", "timestamp": 1713071270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713071270, "uuid": "1ec569a4-9271-404e-9dd1-a1d18d1f0713", "comment": "Malware payload (Amadey)", "value": "9fae2084f15f67cc3549bdcdba10e595", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713071270, "uuid": "b1607061-001c-421e-8480-4ff90dbf95db", "comment": "Malware payload (Amadey)", "value": "1249e422fd97163201b6a38b48f2220a6262133b4302ad2d850669d71e144b06", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713071270, "uuid": "f428e6b5-88ce-46be-a679-f326b3ee48ac", "comment": "Malware payload (Amadey)", "value": "372f1fa71e6956647ed4087f063e9601458f926e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713071270, "uuid": "5897fc72-6b30-4547-9010-b6727c2ddb76", "comment": "Malware payload (Amadey)", "value": "0ce2c160b942b291dd32ccd48ea3d269aeb2a50d22c347d62a6895b552609331e1a349c54b3042feeaaa8f36a40ff7be", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713071270, "uuid": "b78e1e80-7bc7-426d-9cee-edca4bfd1f04", "value": "T1CDA6AE16A3E901F8E1F6D1BC8A579907E3B238160731A7EF069146275F27BE49D3B720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713071270, "uuid": "61caf62d-16bc-442d-a8f9-96dd2076d964", "value": "92ad1eef9d9db8bbe25d3fde9a911af8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713071270, "uuid": "bd1e8fd2-b298-42b6-a0fc-bd8cb50a7e7c", "value": "98304:A9MGsP1O5ytaNopUeCEnOX0a4GXgt6RHVHSNzQpvzk1bpbEd5QDc:AI1O5ytqQw0a4GXgt63HIzj1aoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713071270, "uuid": "bb11da9d-95b7-4fa9-bd47-7ff6648d06a1", "value": 9888656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713071270, "uuid": "4e59d547-b4f1-4b3a-968d-b6002632f4d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713071270, "uuid": "79c73916-7107-441c-b4bc-7a3e90d919a8", "value": "SoundTune.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9645406b-fa1c-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713071118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713071118, "uuid": "0af22efd-10ab-4382-be26-c2a75e3e1fa1", "comment": "Malware payload (RiseProStealer)", "value": "f7ce24a6d55bc577cfba63128443b22b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713071118, "uuid": "ab81cd26-ee94-4872-9a2d-5cf9846a2ed9", "comment": "Malware payload (RiseProStealer)", "value": "136e449f7f762ae92d81a72fe3403e8a89060815a69714b40524a5aa6eba4892", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713071118, "uuid": "00ae5715-010d-49cd-a780-9ba49b19ec38", "comment": "Malware payload (RiseProStealer)", "value": "775cbc38196113c14f803abdf753021f41a4b10f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713071118, "uuid": "249b42f8-f8de-44a9-a314-2caa08b713e2", "comment": "Malware payload (RiseProStealer)", "value": "46f218b624d410e298ea01999629163b6b5032b062586ab9f6622b509acfcbcc7e212048de98c709d0a9733886d2a900", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713071118, "uuid": "ad2266cd-eeea-430a-88f1-d9fb36a9c498", "value": "T1CFB533880BB4662ACD917B301B8991067F207628C875648F18CF7D73B66EB2D5F0F993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713071118, "uuid": "5f682edd-4211-4ecc-889c-019797502b08", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713071118, "uuid": "557406ee-91af-468d-8ff2-721b54677671", "value": "49152:SSUl6vD5DxN6HHLJ9tuacPIbv3U7wpMGBm3ePZRsy2lsXhLqQYuBn+i:SSSwD5DxkAaGIb3U71heZRfXhmusi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713071118, "uuid": "1cc24e09-ec3c-4e95-a95c-8b38b2b88434", "value": 2270208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713071118, "uuid": "c8d2a938-3ad5-40c1-acf0-39f46d3b469d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713071118, "uuid": "7b0d480a-7e35-4149-b7da-d530eeacbaa7", "value": "f7ce24a6d55bc577cfba63128443b22b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ab4328-faba-11ee-a120-42010a9c002e", "comment": "Malware payload (IRATA)", "timestamp": 1713138754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713138754, "uuid": "617fd823-9f63-4b4f-bad0-3bf444a6e598", "comment": "Malware payload (IRATA)", "value": "e6995652396ac7a0219cfb57a95b6374", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713138754, "uuid": "322c2ad3-c222-47cd-a60d-d9660aad60db", "comment": "Malware payload (IRATA)", "value": "14786e3fe720be26cbd551badf135dda21c3d0e664d962b95b1ed88081ed5843", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713138754, "uuid": "460de61a-d9a0-43e2-8eff-639be944216d", "comment": "Malware payload (IRATA)", "value": "8a5aaae0b26e62a39a75831c1b5e5461bd522abb", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713138754, "uuid": "fc9762af-1e64-4a67-9574-3ece504a3a73", "comment": "Malware payload (IRATA)", "value": "b80769db9b0a36120da40e41d371250532125b524ea66169d5d27174cd171cc1458b7b7ae135b94a80a0fc980c625fa4", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713138754, "uuid": "4af2289a-bdde-46d5-8874-1cd8454f1de7", "value": "T13B06AECAF7C4A91BC4F39335C27A52A2510B8D258B83EF875904767C29BB5D00E5ABCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713138754, "uuid": "b8500156-295c-45e4-bcbe-473323cb2443", "value": "98304:+1+hKSo6QcUiazToTwr5LXMmFgY35gy88XY+tEaI1:+1WKSo6qiccmyAXFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713138754, "uuid": "da5e287c-c5e7-4ebe-8e9e-26a56f4a29d1", "value": 3736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713138754, "uuid": "5ac2731a-a0ec-4eba-9a78-d29dee19dba3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713138754, "uuid": "dcc99e08-387d-4ad6-9a78-cb83b08af100", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbadd19c-fa80-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713114184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114184, "uuid": "1b661623-93e3-4fe3-8895-5b4f488d1c04", "comment": "Malware payload (Mirai)", "value": "dcf88f4cfc0773cfca17fbc37002a819", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114184, "uuid": "d39b9cd3-6b8f-46ac-8091-cb6dfc6bb0f6", "comment": "Malware payload (Mirai)", "value": "163a99990d9ea01e29a78e91fc125f17d106ab5d0d8397d0fe6d140278882819", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114184, "uuid": "5e6c320c-8c13-4c62-a4ef-4fca71604296", "comment": "Malware payload (Mirai)", "value": "5283e8221bf606ae762f9a9cf23ad70abe512f8e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114184, "uuid": "b28d6cc3-55db-437d-8a8a-767a00cf5014", "comment": "Malware payload (Mirai)", "value": "3694cad18418b2b2568b688120513992ea5e821339435ffdf891748f715ae97f98a399ddb825ab29b71fc49c74cc2f4f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114184, "uuid": "bf4d3695-b1b3-4331-921c-487e61288b38", "value": "T173E2E186B3E69EEBD4A641BD630A704B5427CDDC23FD171A34521BA58C4620D1E2E8BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114184, "uuid": "96bb08b6-c10c-4b78-955a-1d625a0421b3", "value": "768:41HS7SPqYv9BAWmkTeLqKZkC2xEkwB8wN9sPRQyvNHMg:KHS7SPqSBAWtKL3Zkzi2QUBMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713114184, "uuid": "68b7cf6b-8915-4164-b902-31cb609a8276", "value": 31888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713114184, "uuid": "fa310a07-5de3-4751-9d1c-4fce8097b858", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114184, "uuid": "f419db63-2518-4be0-a8de-a9231781a5b1", "value": "dcf88f4cfc0773cfca17fbc37002a819", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50f9ea1-fa72-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713108160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108160, "uuid": "c2bb6bf4-26cb-463d-b1ce-d353bfe555c3", "comment": "Malware payload (Mirai)", "value": "53f05b2d24fe62b5ab8c2cdfc26a8ca4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108160, "uuid": "70b4ae34-e436-44fe-bdc3-ca79e0fdcb29", "comment": "Malware payload (Mirai)", "value": "19cd43a6d1acf91b58acc94f1bf6d321ab0d726bd5072202e1d05b2e28a8c1a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108160, "uuid": "32fad350-5909-4e1f-9bb9-bd7c11c8b7c4", "comment": "Malware payload (Mirai)", "value": "32b2e3d453361ba3a22973936102944b96b044d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108160, "uuid": "5835b5d6-f3fa-41fa-b579-fbd9162af800", "comment": "Malware payload (Mirai)", "value": "7500bf1ca7d62398d6ebe67b983791c2be453a17d6e69b387e1560cbe55db9c51a4356055289493b483d8a5b1275277a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108160, "uuid": "a0cd0dad-8e9c-46c3-ac81-ee7090ca91aa", "value": "T1D9832996B8C18B11C6D512BAFA1E118E3313177CE3DE72229D206F2477CB86B0E77952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108160, "uuid": "bef63110-3d55-4e10-8549-0986c43e2ce9", "value": "1536:A0nmnWY5FiTMCC0sDSF1YYHIUCaHy/QbuQPMtLi7Dg3OmQ7op5uSirc:10FoFX9IUCaHwKDg3OmQEpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713108160, "uuid": "62aac07f-da6c-465e-835e-1296dd4da889", "value": 83448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713108160, "uuid": "70a8d9c8-3614-4d57-931c-79e3560e5545", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108160, "uuid": "5604dff0-7e91-4d12-96c3-ddcbca785a5a", "value": "53f05b2d24fe62b5ab8c2cdfc26a8ca4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442da0aa-fa4b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713091166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713091166, "uuid": "b6a6de45-4157-453e-a774-f58dbdcf8c28", "comment": "Malware payload", "value": "b5602601b4d7baacfc144311d09c7e6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713091166, "uuid": "e615ac5e-cc5c-44d2-b33d-8f7a38558420", "comment": "Malware payload", "value": "1b6e098367a606d0b6eed5d45fb11e1d7595ba24bd248466458580d8bdfb5d83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713091166, "uuid": "44f99cd3-4092-4890-ad72-a851bda6e914", "comment": "Malware payload", "value": "cef9b19babe7df2bd51ad51602f5b3f248588a8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713091166, "uuid": "2f5dbe82-0eae-48fe-b1dc-cbe8b34eac4f", "comment": "Malware payload", "value": "eb18fc9784009be404e3121925ae55170a4840084c813f90a86a49fce6e537d8baf14bfd21207f043e275a59c8e8b171", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713091166, "uuid": "23609737-d0ae-4506-8f7d-2acbbc45ae24", "value": "T110D4CF50A39D6CE5F44229BDF2DFA3B98C3A5234636758E7CB496B5058021E0AF7F10B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713091166, "uuid": "13ef2cd4-66c7-4dc3-abb0-b1992397d144", "value": "c7a19df34b14b62b6c4638a75f089976", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713091166, "uuid": "cd4bdbe0-b217-446e-9bc9-024f931ea36d", "value": "12288:bFDBupvaVJI38M2E58tswKUBsK+4C5GogLFpg:ipctojUBsrxSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713091166, "uuid": "d6bec567-6031-4e85-b708-bf6ed384f240", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713091166, "uuid": "e49db115-d5d9-44a2-a7ae-a4d6bfc77977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713091166, "uuid": "7d23da4d-c596-4ba9-a7de-132f76d62b01", "value": "b5602601b4d7baacfc144311d09c7e6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418a1887-fa2a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713076989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076989, "uuid": "594df0a0-dc33-4dbf-9a49-50a6e917bd38", "comment": "Malware payload (Mirai)", "value": "b9b3bfc45a4192e4e7170feb71c1d6bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076989, "uuid": "c4f316b3-82f8-4801-9e57-0898a9aad2ed", "comment": "Malware payload (Mirai)", "value": "1c3386fc0793cf98e7e8c2477af5a79107a549a9488c6a6373dac7b65bf5468c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076989, "uuid": "a436b359-4b5d-487b-9072-475108f22569", "comment": "Malware payload (Mirai)", "value": "2a7d1ce9ef44c37006ac1ac165e56fe347ce9e53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076989, "uuid": "6fec3b4c-2256-46ac-acc2-fab031b9e65f", "comment": "Malware payload (Mirai)", "value": "568692ed9361ffc1f7e7dca71f9e9b8aa61fe7674c1b86c7638328c86d5e24fb4dde8555caa905188cfdcd727392e3cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076989, "uuid": "92a03613-abc6-4cb8-8184-3304790a3ef7", "value": "T1E9B32B75D212C5B3C4830AF201A7DA3B0D21FEA7077A5A45E32D3EB0AE334C97595B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076989, "uuid": "afe47ec6-8f5a-4294-bbef-1bd9ee51d2ad", "value": "3072:SAozJEjhWNDQDECgQcmtdhH6WWImFK0AYF+ku:aVEjhWN0wahHJDmFK0AYF+ku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713076989, "uuid": "443837b2-ac8f-4de2-9550-efab403244af", "value": 114469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713076989, "uuid": "3af000a9-ef05-45b3-baa6-91a0985ba044", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076989, "uuid": "2ac4e108-53c3-49d8-b23f-85943e896b5a", "value": "b9b3bfc45a4192e4e7170feb71c1d6bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827e981b-fab5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713136798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136798, "uuid": "04f0fbd6-70b3-42ca-aee7-7e7ff1286cf0", "comment": "Malware payload (Mirai)", "value": "f5c487cad4c5ef5957562a5bd920e1ba", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136798, "uuid": "74cf0188-d19a-4d5f-a248-606471d79a3a", "comment": "Malware payload (Mirai)", "value": "1d15cf437e3979774ebf31c272051268edf8850ebc949696c8685c199c88c140", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136798, "uuid": "39405eaf-35ae-4409-8f67-4903a0fe8466", "comment": "Malware payload (Mirai)", "value": "1521f022bdb459d1a0c111132b72957d387fa68d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136798, "uuid": "2f2a89fc-605a-42d7-a517-ef9602f6d9b1", "comment": "Malware payload (Mirai)", "value": "da9bd43d6ec32157b4a93b9c0c6ce160ecfb0f6c2f5a2955600af12b1b64d626edd67ba62b150c0b3d9a1a4ea9d2fd64", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136798, "uuid": "1d795eb6-e6a7-4ed4-9ba9-76531a3fc209", "value": "T11C436C03554550FCC8CAD2F8968F692ADA33F53823B3B549A3C47A2A7B5EE503F5DA04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136798, "uuid": "380033d3-fef8-43cc-90e9-0b2115eaf44f", "value": "768:/VAk8u5WbAtQg0srCdNgFOw/1DLbORjN02S4xft1pR3mkeUIF:j5WUyzACvIOQoRjN0Gft15eU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713136798, "uuid": "07ab9e16-0882-43f7-8f58-2e03ee9ea67c", "value": 55280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713136798, "uuid": "a9f589b8-1d14-4143-ae6a-b422939bc052", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136798, "uuid": "37d87228-98cd-4d1d-9ecc-1b6cc0df3332", "value": "f5c487cad4c5ef5957562a5bd920e1ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0397863d-fa43-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713087622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087622, "uuid": "3d0d8f87-92d3-4b6b-a09a-531d7ce641dd", "comment": "Malware payload (RiseProStealer)", "value": "c0178e125768477f45d17e43d371e769", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087622, "uuid": "e9b86140-bb73-4d7a-866b-ac56122e51b3", "comment": "Malware payload (RiseProStealer)", "value": "1f2f3109d2e4dc49b073b24ed1922dbf9c7807aa876d7f68e72ff7e9d876a1d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087622, "uuid": "808a38ab-c36e-424f-a6db-66752a2fdde8", "comment": "Malware payload (RiseProStealer)", "value": "ecec92fdd143bdf2dd18f2a97a626414abfe692f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087622, "uuid": "3ce53e81-4575-4038-9a40-f5fe4629e33e", "comment": "Malware payload (RiseProStealer)", "value": "61add9f0cd36da5d5c44bffc675f44d36a86dcb3ccf8bb4ffbd132290b79bab710c258daff222cd29a162d70d7576783", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087622, "uuid": "f706967a-27ed-4b16-8e20-613ba6f20510", "value": "T1ADB533C96E34D3B4C8A7033150FB80102A663A27D8787E5E605F7D633B6B61DA74DA87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087622, "uuid": "59cf2a32-d5d7-4d7b-a6bf-877ed2df8f3c", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087622, "uuid": "4b2c4de0-7b10-462b-9fe3-18a189bd85b3", "value": "49152:YSUl6vD5DxN6HHLJ9tlhq2Otp2U6O95meFifgUZJt99LsdZYTG:YSSwD5Dxkzhq2+9lnG99kZYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713087622, "uuid": "a9fa202e-f860-4cb7-86c8-c2abfd92194f", "value": 2292224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713087622, "uuid": "0fe61e04-649d-4e35-9f04-4857d4b6e31a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087622, "uuid": "1e538c54-914e-4730-a3be-006fc2f27473", "value": "c0178e125768477f45d17e43d371e769.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7666d6f9-fa28-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713076218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076218, "uuid": "09f7a981-a87f-4df9-a1e3-a62449cf1cfc", "comment": "Malware payload (RiseProStealer)", "value": "8d9e2f348dc4b8555dc5ea3bb8bf1954", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076218, "uuid": "ae3555ac-a28d-473b-a877-29abac236ec6", "comment": "Malware payload (RiseProStealer)", "value": "205524412abf2bbaeb37cdb73e6f70e59e74fdaa45f2eb68653a78c0f1098fb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076218, "uuid": "9f192cd6-92b1-4cb3-8898-970a0ab1bb93", "comment": "Malware payload (RiseProStealer)", "value": "9c528b6c8ed3e2f3326e447bd7e9942a34dd91c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076218, "uuid": "2943ba0a-1a1c-47bb-a760-15a5dc4935d5", "comment": "Malware payload (RiseProStealer)", "value": "c0a3f79c944b9c194b47a9ad1cd4ce8cdbb57f49101cecc37c60387563ba48299f382c08aa7798653bd609ce2189cf26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076218, "uuid": "ff02bae2-ec01-44fc-95ab-9fcb415773d0", "value": "T1E81512107653A434F26E12BC8DB5FBA0266AB85252249B8B3F41323F7BB07D05617F9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076218, "uuid": "6499f250-b80d-4b87-9330-fad573f4784c", "value": "331af798bb33bd4e783ea7c89c6d7b97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076218, "uuid": "da2dc28e-e06c-437d-954f-3b4d9319ea7f", "value": "24576:F8kfI124AESnFkuFCWpT71nsL7KFtfyxQnxiW:Fhg12lFxgW7ns2U4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713076218, "uuid": "bf9eb165-fa12-409f-bc7b-cc0a6c921b75", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713076218, "uuid": "237b481e-b6fa-4091-ad18-15c689ec84ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076218, "uuid": "e1013d3d-a446-4d4d-b9be-273b34b773de", "value": "8d9e2f348dc4b8555dc5ea3bb8bf1954.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b0784b-fa14-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713067516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713067516, "uuid": "8ff3bba5-2bbd-4512-8f19-a35d6bccdb08", "comment": "Malware payload (RiseProStealer)", "value": "81713557ea8d0af915183a948912d141", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713067516, "uuid": "e67b8c33-b097-4b7d-80bd-0a0243c85499", "comment": "Malware payload (RiseProStealer)", "value": "20f56c766225ccd9d19edf9021ab2ce69071fb6ad80a69637fd9a7af02273a4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713067516, "uuid": "4cff8289-497a-4872-8d8a-1deb60d535e4", "comment": "Malware payload (RiseProStealer)", "value": "a8bb761c5eeb489f723eaed913c4f249e09ee466", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713067516, "uuid": "c182b7be-1719-4af1-9617-ace01fb08bfd", "comment": "Malware payload (RiseProStealer)", "value": "5f860170727ba8c5f8b6a35831fdd8e8dd944619fa26d7c34d1e05c9804dd248047bee76cf60d5d73af43e005651cf17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713067516, "uuid": "4e25996e-7128-475e-b9d3-b210828bd6e3", "value": "T161A533960E356521CCFA833496F7E4549FA5BE060536689DF7CAACF738B733E021A406", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713067516, "uuid": "fe06e2e0-b29e-4cb6-8ab3-dd1ec17bb1e4", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713067516, "uuid": "0ee1ee8e-02ad-4a44-ba60-cb02093257e0", "value": "49152:JSUl6vD5DxN6HHLJFwMh90uMu2zRbqf1aAzhN4JK0sHncU011Q:JSSwD5Dxk5eQmK0mm11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713067516, "uuid": "f92e1d30-4a9f-446e-9028-33d88ca3684a", "value": 2177024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713067516, "uuid": "25e81d7d-7ef8-47a9-8094-bd6b271980a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713067516, "uuid": "b12a1213-18e7-4ea7-b66d-1ae3ae276b47", "value": "81713557ea8d0af915183a948912d141.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80277dd9-fab5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713136794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136794, "uuid": "2ab16015-862a-4a81-b3be-24535778d6c5", "comment": "Malware payload (Mirai)", "value": "ead2210fc7e1e7cc171e41cdea2ccfc9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136794, "uuid": "2cc184f2-875e-4fe0-b905-da33220479f3", "comment": "Malware payload (Mirai)", "value": "2516fb7416808b24c8ccc59fc0102ad620a397fad4ba8e60903ab86a90b273a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136794, "uuid": "175c3e31-127a-4340-a525-ee79a8fe59d6", "comment": "Malware payload (Mirai)", "value": "1676cc8df9e8ee18a2c9f82f4b9d14eae576fb08", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136794, "uuid": "c6273521-0252-4f99-a8d3-7b84e07a3cfb", "comment": "Malware payload (Mirai)", "value": "1236bbe41aa9183040f84d3260c237e0aa4c5f77eeeae9fdbac39178fb3735b0cd46b09afbfc6dd5eccefad2e2cafbaa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136794, "uuid": "93b31652-f099-4b95-b4c1-f452e1715f8d", "value": "T12263944A3E218FFEF36CC6344BB74A20A75923D623F1D684D2ACD5081EA438D585F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136794, "uuid": "f94e85a7-fb24-43b0-995a-c446debd6e1d", "value": "768:KZmJdMSNKgropTx173gJMfA5PzgNBCFxa5DvA+BqxFq81b+AYEM3J08ZnyoNFeG5:nJdMTgOx1jgCA0yr5bIO+/eGuSrVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713136794, "uuid": "e4f8610d-d34c-4997-a8d0-fec2e7954ec5", "value": 72504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713136794, "uuid": "341c4e68-7db3-4d00-bf25-77070c70949e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136794, "uuid": "120fb0cf-9f26-4e97-bdff-4a3e98b38200", "value": "ead2210fc7e1e7cc171e41cdea2ccfc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c773e4-fa80-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713113817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713113817, "uuid": "4c6f0567-db25-478a-96f6-20c595d49182", "comment": "Malware payload (Mirai)", "value": "b385f083e5676a34adabc7a8f1b1bf1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713113817, "uuid": "03e0198e-f14b-4b58-8cf1-e548cd38908a", "comment": "Malware payload (Mirai)", "value": "2534fd1dc6d3d723daef2fb8819581ca0b83575c15ab092c3836e5072cf6098c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713113817, "uuid": "225dfcab-4a6a-4ced-99b7-4dfeeeff1530", "comment": "Malware payload (Mirai)", "value": "7da5b244cc038e15e793cc421033793cc18a34f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713113817, "uuid": "cfa17d40-4012-4ba9-87a0-ea7e66fdb5c8", "comment": "Malware payload (Mirai)", "value": "725a659e6691ecbe35b29779c78eb00a3036b5b1def38625c52a8b894f3f1bb2153990846b488ab1318862736c331cc9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713113817, "uuid": "3d1860ab-4a67-4d21-b58d-b743a28fde19", "value": "T16CF2E17EBB014664CD7F0C3915CF0F914B51A1DA30A24FEA06798C2AEBE4E5F34451E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713113817, "uuid": "f94ffcae-0f2d-4fd5-b4ad-b3948939f95f", "value": "768:ssPa6WAliwH1ChwpJrFXjki3Ge4cIqsHP/BQc0dWw:Bfi41Ch6hZjkjcSv/BQc0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713113817, "uuid": "a50075c7-d0cb-44e7-9ecf-45ea2a88baa4", "value": 36888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713113817, "uuid": "f30b92bf-5a49-4e37-ad6d-4d96c93f27ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713113817, "uuid": "0fc096e4-05b9-4d5a-beb2-122fbb7f333f", "value": "b385f083e5676a34adabc7a8f1b1bf1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abcd1480-f9f9-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1713056121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713056121, "uuid": "f4d25c80-c9c5-4940-ab23-c58b87c654e2", "comment": "Malware payload (Stealc)", "value": "e6fddff89f3f159db71a4386d6917f40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713056121, "uuid": "e6a9dece-6a7d-48a4-8b55-71ad08ee634a", "comment": "Malware payload (Stealc)", "value": "2598f84bd5959502f0a470aad1bc4510478af92978eccf574913abcc6d8f3452", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713056121, "uuid": "b9f9bd1a-2e7a-41bf-a474-1ad7a1ce5589", "comment": "Malware payload (Stealc)", "value": "ad23349629218e3aeaecde56928f76a236a1a152", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713056121, "uuid": "1f6c4e12-8395-4a30-bac5-62da483891d3", "comment": "Malware payload (Stealc)", "value": "0a047ace6735e6cb36367551908c3afb6b8f0075a182feeac378b4614cc0fc6fde3a56b20dd743dcdc4eaba1baad2cff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713056121, "uuid": "c1140ad3-0fb7-48f6-94b9-9b5f587736b2", "value": "T14FF33A10E103503EE4A205FF66AE5F7AE59879A20355C1C7E3D06B9827F01F6AE7462F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713056121, "uuid": "7a54ad87-2fdf-4b8c-bf08-27f3f4617635", "value": "1ef0d6e4c3554a91026b47d9a27bf6db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713056121, "uuid": "c4a7246b-d7e7-4abe-82ef-fb9b39857a89", "value": "3072:EvnlGc6fgpJSG61doHN4N4QSUukO/yI2aba8gWoBJuO:EvlJryZoI4RvkOK9nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713056121, "uuid": "3c79139f-a8dd-47ef-a2ff-c4ebebc92189", "value": 159232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713056121, "uuid": "1700801e-3b22-406f-85c2-9dca191bcbdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713056121, "uuid": "5029d075-c39c-424e-a943-4045bd9b2300", "value": "E6FDDFF89F3F159DB71A4386D6917F40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7355cc64-fa2f-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713079220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713079220, "uuid": "c7f6c5f7-17ca-418d-801f-f3516fa2a56c", "comment": "Malware payload (RiseProStealer)", "value": "4a45b626f2c5ae065e4bfae8fa3bbac4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713079220, "uuid": "10851483-8ee6-455a-8438-a3a82beec5b7", "comment": "Malware payload (RiseProStealer)", "value": "26d9cf9c90535d892a26eaf8e24dfd13ea661fb69beac834f4edf3f4a93a3568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713079220, "uuid": "44ff5b7d-6b1c-418b-a341-c60aee94a667", "comment": "Malware payload (RiseProStealer)", "value": "671fe33bf339ae7823b4a46b585ebfcb613b53b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713079220, "uuid": "f1bdb0f7-881a-4542-bd2c-dc0972f3f814", "comment": "Malware payload (RiseProStealer)", "value": "1a1dacdb59a717f9a503661d53ec06f02a7ea2dd2b0bdbe4be2a1ee4fd26e16cf5ba8fed97454d46c330b652dcc4d50b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713079220, "uuid": "cd77eb9a-7c02-4a89-8c6c-091d1a633309", "value": "T126B533A91B3C6700EE0063310AFBD6236E61F56201B4966D72C53DB3FE6E67E276C911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713079220, "uuid": "12882b56-f738-432d-ac86-78ac89b54010", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713079220, "uuid": "df902791-7023-491f-beae-6d0348a87004", "value": "49152:USUl6vD5DxN6HHLJFwP9qQG4lYvrQkfgpS7Ftd1L9KIMqYpj:USSwD5DxkawQGCYv9rptd99tRYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713079220, "uuid": "26243a28-bf0d-4ddf-8a54-a4b8c79de675", "value": 2278400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713079220, "uuid": "47d71496-f467-45b5-ae21-230b81909df6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713079220, "uuid": "edbd1cbd-1937-4a81-bd0a-538efe8fbda5", "value": "4a45b626f2c5ae065e4bfae8fa3bbac4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4f4d58a-fa80-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713114146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114146, "uuid": "d87c37cf-d90a-4f8b-8cfa-9499ae92f40c", "comment": "Malware payload (Mirai)", "value": "34ddfdb61a5d3bfe0084479edf563ba4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114146, "uuid": "6322da9b-6718-4e9b-abda-6823b0804c29", "comment": "Malware payload (Mirai)", "value": "27299222bc813a68dee91c3ebc792ff227616724b792a8d89d475a5d53d97a06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114146, "uuid": "a414f968-e578-4383-9dd9-193e9d5197a9", "comment": "Malware payload (Mirai)", "value": "22c0b22492b494f5da4626de2dd33c75b0db0916", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114146, "uuid": "44efd28b-937b-4d27-a032-8725477866c8", "comment": "Malware payload (Mirai)", "value": "0d76d3fc9a543366491ab9da9f07d633fde3c3a5eb149206f88a02d86268e5b2816691d6853373238d96134aad112c88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114146, "uuid": "a1edd313-bbdf-4f51-b472-1fa1e8f705e3", "value": "T1A243BE76C82A6E84D18E46B4B4344FB41B63E54881976FFF1664C2798043EBCFA0A3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114146, "uuid": "4736d99d-4ff0-4484-94d8-d0bcdedd750b", "value": "768:eahwtH4vpmgq3UMvb7uLK0zQ7Cc0veKPk79aoordH5CQQA1wffi+DZI:eahwtHgK3fx7nKPk7wHV5CQCiQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713114146, "uuid": "31d7a829-b01a-4e50-861c-943c659bed80", "value": 56184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713114146, "uuid": "540df6e8-d8c0-4cad-be50-b34004efea4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114146, "uuid": "78a3bbcc-a4f3-4578-aedc-4440edad593e", "value": "34ddfdb61a5d3bfe0084479edf563ba4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac44dd5-fa80-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713114155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114155, "uuid": "052ef70b-2c4c-4ca5-8d88-c89ee2e2ee16", "comment": "Malware payload (Mirai)", "value": "19411467009980b8e1a73d76f249e583", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114155, "uuid": "7bfb7fac-d143-4aa4-8ce8-9704b53d10e2", "comment": "Malware payload (Mirai)", "value": "283afefa7c703ef2b92b92d951b6f503b08fa22ad0b6e29bd1e3d0105f35eb0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114155, "uuid": "306de5bd-5377-488a-a93e-936fb27b6c0b", "comment": "Malware payload (Mirai)", "value": "7eae297d63d9548fc1643980bbe30c92afcc29fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114155, "uuid": "66ebc3f6-09f1-44a0-ab79-7508fd8bbcb3", "comment": "Malware payload (Mirai)", "value": "cfcecb1e6ae7be841933641d54f895bb0bc021efd81274574811c1aa845b3788c9559b192a389ae6548b5b652285a77e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114155, "uuid": "86e4146c-9399-4deb-bd09-d8c29e2b8a29", "value": "T1DA936C8992A3C8B3D4871A7401A7FB374532E4D6176EE742E36CEEF4BD029C1704B65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114155, "uuid": "ee3c7026-01c0-48ff-bfd7-57b11859a388", "value": "1536:pJZyk6ddb868VWYnw87biKfW/oIHjZM11rqgTSkOYe3+CL058wWg:p/x68Vfv7bizjET5OYe37L07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713114155, "uuid": "d21d2810-bee4-474d-ad4b-26b33963ba6e", "value": 93146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713114155, "uuid": "f7c5b69e-f183-4241-a86a-793392d39b66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114155, "uuid": "854b0090-e848-4c16-ab70-ed2fc047e51a", "value": "19411467009980b8e1a73d76f249e583", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2791c8-faa6-11ee-a120-42010a9c002e", "comment": "Malware payload (IRATA)", "timestamp": 1713130479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713130479, "uuid": "a9ecdeac-19d1-4553-9540-c92729c461d5", "comment": "Malware payload (IRATA)", "value": "4f9b84a780b172905aa3bbb23797dc21", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713130479, "uuid": "a8cf2b95-1121-42e8-a11f-2b079e4c9efc", "comment": "Malware payload (IRATA)", "value": "29e10e48615c69ef475ea6f203d30281869f5a1979e1e15b84bd74c0643f76ee", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713130479, "uuid": "86d169ff-74f5-45b2-8c2d-91d9b2a83a30", "comment": "Malware payload (IRATA)", "value": "791e0d2ef94162227d588df66918dd4fd5301c8e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713130479, "uuid": "fa71e37c-f9ef-4eff-8d4c-95fba51b0a85", "comment": "Malware payload (IRATA)", "value": "cf69431d76a215b2b21832b4ff8b51f9012873e006132cf246006380905fb0b9e12885c5284b27b7fdc5ce1b47eebb81", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713130479, "uuid": "4be0fca6-95b4-4d39-b2cf-da2ed1684b30", "value": "T15B16592EDB115D2EC9B40F364FAB05F6620D07074642EA3D19B8A4A5387BDE83750EBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713130479, "uuid": "9022409c-853d-4952-b7f4-e77ccf9af321", "value": "49152:xKjjqMqY4nCZcomDQyhFvLkuN8KYn+xETg0pJf2wc8ljXhe7sxkk+j7ZzwrUYisL:+qMqYS5oNyhFIz+MvvXFkk+JQUY0OtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713130479, "uuid": "bbfa285a-1a66-4046-b212-8f7efac6f29c", "value": 4328501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713130479, "uuid": "f1f68b37-e061-4a1e-a124-10421b06f7aa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713130479, "uuid": "eba9d118-5dbe-4396-8423-d87a80229aaa", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e6fccd-fa9c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713126202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126202, "uuid": "f00b3ea5-b69c-40d9-9a01-177dd7e51603", "comment": "Malware payload", "value": "e9ff7c477cc755a97c67a5c0915e12b2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126202, "uuid": "91c89349-f719-4df2-b334-5d6eb0c9b7af", "comment": "Malware payload", "value": "2c1bc8d8a760fea6b05d9d139efce9bd1ef1992bffbc805527f45888d4add17e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126202, "uuid": "fa2a263a-5bba-42a9-bcd8-9292a6080a61", "comment": "Malware payload", "value": "2e67586384cbb41c5eb4878148ef2322a93ef242", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126202, "uuid": "c111710b-6ed1-4263-b068-acbc6ccc7973", "comment": "Malware payload", "value": "00bd73356eed019a0d83c7fad4e959f727a453d5e24899e5c0f5d94d582299c9b967f9b917ca2a73e8408158e88d8b6b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713126202, "uuid": "9b1ed6c7-b95d-4a8c-879b-33542881d534", "value": "T11F14D819AB510FBBDC6FDD3702EA0A0535CC655722A42F3A3674D928F54A90F4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713126202, "uuid": "5956d002-9cc4-46bd-847a-c93b0cd8efc4", "value": "1536:DAK//e/1YpliemPdflSe7PlMJA6IDh3gbbonpwulMOZ+UyM2M+ZaBUydyMmarljA:U2Wflrblz7wUH+AaIGdc9YSRet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713126202, "uuid": "5a556840-8cb8-471d-a753-2ac4923d6b18", "value": 203616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713126202, "uuid": "d73d12ee-e020-437e-aa90-c7abe918e248", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713126202, "uuid": "728943ac-4e8a-4c35-bab2-30db60316f53", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab7eb2c-fa67-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713103445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713103445, "uuid": "61f56d5e-9e6a-49b9-98dd-65fe277d6d59", "comment": "Malware payload", "value": "81c63bc70fbcc8420249b3d6f5773d3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713103445, "uuid": "d77e450f-d200-4bd3-bee7-a87b4222cf31", "comment": "Malware payload", "value": "2e944ff55afdee7c044c5df7b3bfa7da76480ea4baf88a14ec1dd8d858f0c4ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713103445, "uuid": "88afcd2e-3c22-4a07-827c-c025d0b9183f", "comment": "Malware payload", "value": "36dc62d893fac0335d13c7d2a71c274eb032d7b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713103445, "uuid": "b911b68e-029d-478b-a1a8-a801053eaef4", "comment": "Malware payload", "value": "dc37eb297aedf88a34a66ee7cf957ecfcad0bdf4ecd0092370caf6bc42f162f60e68a04b788308995bd101330af23626", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713103445, "uuid": "ef563d96-7979-4991-86cf-1af88a1ddd09", "value": "T1E3241294AB60413BEB2C023904D372CCD7E9AA11646EDD5BC6E9040FEF7CBA195BB506", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713103445, "uuid": "3ab154af-b3ed-4bec-a5bc-e2a4213c7c41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713103445, "uuid": "b850ebce-75cb-4628-8e28-0646fcbb3574", "value": "6144:8vuzQFAjrBy0lu6ZmC2dtnkeLKG61OkZ+LSDus0pMEodi+4:8BFAjDLZsjRN61OkZ+LS1uWN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713103445, "uuid": "c1e78c24-dce6-45ba-ae9a-45ff3bdfa8f8", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713103445, "uuid": "d9ceed9c-ff5b-43cc-8ff8-7f4f58d65967", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713103445, "uuid": "481e3153-7fc5-42b8-b9c2-259b49f720cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8869e42e-fab5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713136807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136807, "uuid": "b8ee882e-c11d-4f8f-82c1-b7449757f9d4", "comment": "Malware payload (Mirai)", "value": "3774d0af4009eba828dc8bea752e2f25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136807, "uuid": "60c1e3fa-600e-4bd2-b64f-fd418ed25d23", "comment": "Malware payload (Mirai)", "value": "3122f37ff2cc3db083272d377b0e53a7ede456278894512f9cc28dd0afbf4212", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136807, "uuid": "e363d142-c7e7-4d29-ae9e-7bf2b5e49e05", "comment": "Malware payload (Mirai)", "value": "b7ab317457bd7df1b56b25bdfb89ed6b48172c3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136807, "uuid": "92a1c2b6-b519-468a-a3a8-3326b906eb53", "comment": "Malware payload (Mirai)", "value": "6086397a9d142157fb03b5c11dfa73168347bff32d3122ceee69a0dfce3d40bad923b48c5d1bb96bd6906c1f820977d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136807, "uuid": "46636764-ac4d-4fa2-bd06-154a10c473cb", "value": "T1C7237B53CD762E18D21885B1F0758F7D9BB3E55892CB5FA9D022C32D9113EDCB1922B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136807, "uuid": "1e278209-ce22-4739-82ea-76505aa19351", "value": "768:CgXgxrshVZa9JZpaI9oHtm5c9nv5oVKd4FpamoI1n1LCJOvpjfEPJRpOI:jhPa9fpJ9ok5cwKd4FE5ITLCJVPvpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713136807, "uuid": "c75aaba0-7299-40d4-8aec-7210360813c4", "value": 48032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713136807, "uuid": "c686c144-7eaa-4ba3-bc20-8c2c827a1219", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136807, "uuid": "9cdc1a20-d7d0-46a1-aac1-23f3888eb57b", "value": "3774d0af4009eba828dc8bea752e2f25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c071578e-fa2e-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713078919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713078919, "uuid": "b6d60ac4-5d44-44d7-a215-55e8c60d6fe5", "comment": "Malware payload (RiseProStealer)", "value": "2b5d45fc67362a404f37628b80b37d72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713078919, "uuid": "d66bb1e5-2bb5-4bc0-adb4-3328a05e4373", "comment": "Malware payload (RiseProStealer)", "value": "3144ebb1c25368ccd0a30dbeed85739dcc7180e7ec365fa45362f6331d881b8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713078919, "uuid": "19ab2af8-0d08-4027-8041-110c05b4908a", "comment": "Malware payload (RiseProStealer)", "value": "625cd7642f65cdfdc04734098df3c10a1a9d687d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713078919, "uuid": "f6eeec16-f1de-4baa-a89c-27299ed76e32", "comment": "Malware payload (RiseProStealer)", "value": "875f5303913728ffd2777ed532c1872e01b051b602b7b62535cc5cf67cc74170c0004364da9482952fe8653f0d9cd163", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713078919, "uuid": "bbc2c8ac-2420-4d4c-bb43-8bd8b056ad52", "value": "T1F0A5330D2D70A6FACC4FA3358DC3D75696807A4186B05A6D668F0C2BFB7B636470E907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713078919, "uuid": "773592f9-c023-4993-8b2a-80aec13ef745", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713078919, "uuid": "91c409ea-09d7-4dbb-894a-086c8579362b", "value": "49152:ySUl6vD5DxN6HHLJ9tjq6kGG0YGt6Ux4fFHuk4bN/+SS23o0guwsPqv:ySSwD5DxkRqrG6NUx6AkIN/C0MsPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713078919, "uuid": "99cbb3bd-b32c-4f2e-9d50-ea931bf47ba8", "value": 2251264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713078919, "uuid": "20ac14c8-b1e1-4c7c-ac64-d622fa43f00b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713078919, "uuid": "d58285eb-ca5b-450a-b2b4-653795bdb2bb", "value": "2b5d45fc67362a404f37628b80b37d72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037da490-fa80-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713113821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713113821, "uuid": "92db031d-e85a-47e4-96f0-0e2b6e50ddf1", "comment": "Malware payload (Mirai)", "value": "230c5da2ea9b16c8435ec6ae067cc43c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713113821, "uuid": "c70dff12-6008-4bbf-a508-d9719c6714c4", "comment": "Malware payload (Mirai)", "value": "315d0ab5929349624d186bd05f2491ccf0ff023f2eda95f6c880a7d2315a67ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713113821, "uuid": "2811f752-83c6-4a92-98bc-c23025e21383", "comment": "Malware payload (Mirai)", "value": "7a8e327b74d89b32e7b0e548a9690df7a4d4a2cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713113821, "uuid": "79afc1af-510a-4d81-8fbd-d3fc6220e357", "comment": "Malware payload (Mirai)", "value": "6350a16cc1bfd2ed9a33390feb790e5597e911032f8bfc78b1dc9c903b8a00b097a636ad107af7f3ef5c29a4320fe008", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713113821, "uuid": "a10e1e0e-3f89-4bd1-afba-bcda83083a0d", "value": "T190636B76E40D5FE4D4541870B9F8CF781B63B88881A73DB36A5682E91887D98F600FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713113821, "uuid": "27b6b2b4-5333-4d10-820b-d41e50fd8088", "value": "768:cYvVlgFQXLi0Y0ov3/766TKUhyTlKzaNB5HOHTJBARq72aIw6:cYvVlgFQXLi0Y0m760QRB5HOtBARjC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713113821, "uuid": "2ab11eaa-f2aa-42c3-9a08-bd016c663c67", "value": 70808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713113821, "uuid": "76216550-5f1b-4a10-80cf-e81dfd3fea65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713113821, "uuid": "881c73be-8e13-41ab-8128-5295601be240", "value": "230c5da2ea9b16c8435ec6ae067cc43c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed9b2d4-fa42-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713087265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087265, "uuid": "9f8e4972-aaef-4194-9c5b-60270f3a2110", "comment": "Malware payload (Mirai)", "value": "b67bc3edd17ead44ac39b7311b446cf1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087265, "uuid": "80aeb1e3-8d3c-48c3-b286-a94256e90c36", "comment": "Malware payload (Mirai)", "value": "31ab5fb90c028a1e27d32318a6e3a4370e20d27a5e377ef13517f3deb37894da", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087265, "uuid": "8dcb2a64-5b11-4287-8ad6-34e7edd86248", "comment": "Malware payload (Mirai)", "value": "6dd44ebade70d2b31b3f1dfc96ea3cac102addba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087265, "uuid": "feaf5452-fd7f-4960-975b-027aa838b3f4", "comment": "Malware payload (Mirai)", "value": "4a15b33cd3c03f526bd4b7013452c0ed51c0edeee134ddbe443493af8056276d28facd06de575e7f2d3942557927a30f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087265, "uuid": "8a3ce5f7-451b-4c59-9ca6-5601c7b85e73", "value": "T11D04E91AAF550FBBDC6FDD3702E80B5135CCA45722953B363278C928F54A94B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087265, "uuid": "0982057b-7492-4c62-8c4f-9b80d6e5b7b9", "value": "3072:7fBo8gnfa1PNGkRxsFUDDugBlF2DIp9Zi:jgf8FAFehF2DIvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713087265, "uuid": "4aa55676-ee2a-4747-90a7-0edd9b536679", "value": 189684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713087265, "uuid": "ddd40676-2555-4560-993d-c7770f8a90c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087265, "uuid": "db2ac4f7-1263-4428-9ca6-101465ce2c15", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6d9420-fa0d-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1713064526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713064526, "uuid": "a2107aba-7a6f-4b60-be16-315715df36d0", "comment": "Malware payload (njrat)", "value": "ed1ea689d80a7fab60271d8d24267a5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713064526, "uuid": "3de9c244-aff4-4070-b83b-ac3631c6a2b7", "comment": "Malware payload (njrat)", "value": "31f61628f0dbaf14ddacb7d271a91b281038d3c6120c7ee082cc00c30112f1d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713064526, "uuid": "b0c8c63d-05f4-4eb0-b8c5-c030cb979504", "comment": "Malware payload (njrat)", "value": "cbc58903e5ef9a21f32bd86c158039eead84c2e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713064526, "uuid": "72bc29e8-240d-4aac-a32f-06b62b9968b7", "comment": "Malware payload (njrat)", "value": "c7ac265dc3311c721f3b104c05812845bac23f56aa9b0d71fce16d017078604f9ff19d7807f6bbd6c6deca1dd42de8d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713064526, "uuid": "16205919-c191-4eb9-982a-8cbe5d04172a", "value": "T14EB3EB387D952133C67EC1F689E50A8AEB69223F3191E9ED4CA742C418B2F166DC1D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713064526, "uuid": "17ec224a-b4c7-4422-b9bc-d33306360fdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713064526, "uuid": "3902ecdc-56d8-47bd-8901-ded99bb2b2bf", "value": "1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegoe:w5eznsjsguGDFqGx8egoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713064526, "uuid": "17db65a2-e4d1-4064-8a84-73e425fcd3d6", "value": 108992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713064526, "uuid": "d0b87d17-db50-4f03-8ff7-d035b6710e92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713064526, "uuid": "f89c7b02-7ce1-4099-9082-c89e07ed76fa", "value": "ED1EA689D80A7FAB60271D8D24267A5B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da7e367-fa5d-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713098994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713098994, "uuid": "e137fba5-4074-4e2b-ac37-2941e2832960", "comment": "Malware payload (Mirai)", "value": "7fa0ffc3f9690595b8e0f145ab1f78f3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713098994, "uuid": "efde18aa-c3bc-428b-9edb-06013e882dd9", "comment": "Malware payload (Mirai)", "value": "327650419033571dac324b7c61d91fcc54dbf4029402c8fa803c47e4ec58d1ef", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713098994, "uuid": "2739dbf6-de09-405f-b92e-daa404418788", "comment": "Malware payload (Mirai)", "value": "0f8413c64c7718fb8bb20dd3c6153864302d502e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713098994, "uuid": "4d759024-fffd-4e77-a38c-e6290ac8e0a0", "comment": "Malware payload (Mirai)", "value": "00ad36064b36fb23737c421c155bab72e50cc85292653afa1d78d93ce085988065ad381b75a520474abb1dcb44f485eb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713098994, "uuid": "6f5e93d6-6c4f-4b06-a251-ccb526a9f408", "value": "T12B41FF2D2FF01A27EA76CD33048BA75426CCD41EB36B67459334E9407D4BA8267C38E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713098994, "uuid": "bcb596d5-bb44-4969-af64-b90a08528bfe", "value": "48:H5hEZ3QwgZmHrhSDCFemzpgsA5U0XTaSnTW/VYHjFj:TOfqYrhS+nzpK5PD3CyHxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713098994, "uuid": "5e3dd6af-1be0-428c-93b8-546081b678be", "value": 2128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713098994, "uuid": "1424f24d-5baa-4f72-9f5c-1aa3f9f8d94b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713098994, "uuid": "c3fe3fcb-ec2f-4ed7-b7da-6d758bc70978", "value": "mpsl-20240414-1249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6aee92a-fa01-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1713059629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059629, "uuid": "8ff0b630-8ac4-4a6d-864a-6776cc302de0", "comment": "Malware payload (AsyncRAT)", "value": "43ef09ef1a7fdf3beff5b92188cd4704", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059629, "uuid": "1de606ea-3ff2-4bb7-bc32-f2988cb268cd", "comment": "Malware payload (AsyncRAT)", "value": "330c803b1584eb55a6226150c2b4f085c5717026e799775b1b3cea931763baec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059629, "uuid": "524ad299-3a64-48c8-a4f2-f8878eebb56a", "comment": "Malware payload (AsyncRAT)", "value": "5de1f8722a2c5a0172845962f274ce6e4c696f8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059629, "uuid": "32eed7e4-15c1-4126-8e43-999adf36d385", "comment": "Malware payload (AsyncRAT)", "value": "0b2b6ee827d15dc1b12bf98bdc9dc123a6395f9b91103e701db48b3b24600adf253ac35c367b2bb6e519f8f48c384650", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713059629, "uuid": "eb9ff69b-1a53-4946-83fa-ada315a0bfe2", "value": "T1A1736C183BE60529E1FFAFB05DF47256C77AF623A513961F1488028A0B53AC5CE417FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713059629, "uuid": "cacb4c42-686d-4eb0-9b98-7fbba897f143", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713059629, "uuid": "501bdfe6-3384-40ae-894b-a067a6a9793b", "value": "1536:Z4D5+vp4jiDYS4ylEuvu8ZWuNbY18Nknujx6MxOp+tbgwu:hvQi6u28ZWuNb28BXOpyDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713059629, "uuid": "be488bc1-e721-4e35-9125-adebe3470d1a", "value": 78848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713059629, "uuid": "62c92b82-cf31-4c2f-bc33-cf68cd22c25f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713059629, "uuid": "0f6324b9-010c-419d-afc1-527b5ad8271a", "value": "43ef09ef1a7fdf3beff5b92188cd4704", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179c8d50-fa6e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713106124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106124, "uuid": "9076bbd3-6678-4a52-9a9d-f2e12d2994e8", "comment": "Malware payload (Mirai)", "value": "31e57e58873106000661b5952383e997", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106124, "uuid": "3850d7a8-4e6f-4708-bbb6-28196d0bc5f9", "comment": "Malware payload (Mirai)", "value": "33811e280e7c766dd782fef49aa0612e3f6f1ca9374f5e6fa6856d30e98ce332", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106124, "uuid": "dc4cfa52-61a6-4699-a622-6f835cd8ad5c", "comment": "Malware payload (Mirai)", "value": "acde220f07a5c6b617f8790b43266fd9387a7de3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106124, "uuid": "6baf2e31-50ef-42f6-87e5-b3e21b51d660", "comment": "Malware payload (Mirai)", "value": "3ab237fdeced3492c547e081242f0fe69c586dde71a119c3a253439cf2a852eaacbb5a3469d82fef8f019d97f54fc607", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106124, "uuid": "dbe806df-3f0c-4068-a4f8-a2aae3f5f170", "value": "T1DA04E91AAF610FBBD86FDD3705E8071135CC945722993B3A3678C928F54A94B4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106124, "uuid": "2293e4d0-64c5-4377-8d52-2792c16f0008", "value": "3072:ZEo8/X/RRp7jj11X7MajswXvt+B42mLPPH3jFYp9UyXDjeI:6/vZjRt7MajswXUB42mj/CUyXDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713106124, "uuid": "f3893eb6-da8d-4ae2-8d16-7de8b8eb6d47", "value": 189712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713106124, "uuid": "77085cde-d5c4-48b9-8c56-1eeff4dacb18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106124, "uuid": "38c952c9-af0a-442b-ac05-ea768ba082a5", "value": "vlxx.mpsl-20240414-1448", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db6c6927-fa72-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713108170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108170, "uuid": "a7f88a8a-e2b8-4ffd-b142-d325354e4e78", "comment": "Malware payload (Mirai)", "value": "c60b0b552c4d9936bf3398ec3d79ef55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108170, "uuid": "4d78c638-ec0f-4cd5-b7e4-48bd9bdf1f49", "comment": "Malware payload (Mirai)", "value": "3979cbe7d4401e1cdb8d71fe26b2cd236e23fd790fae81e34a6173669f8df541", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108170, "uuid": "d84ea83b-af34-49ec-9bbe-f2940beb8a77", "comment": "Malware payload (Mirai)", "value": "627caa1b7ae4a57a625612b0aa92e983f51cc27a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108170, "uuid": "7241a47b-d6f9-48d4-9606-5840b272d834", "comment": "Malware payload (Mirai)", "value": "614ee7b1fea0cc1759b149b0260a59575215baac433eae1f96c5e485cac7bb0b821107c9e8284f75bcd153e8ae32497d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108170, "uuid": "1d9a46d3-b9af-46b8-a37c-91b468083c9e", "value": "T1FEA3C71E6E219FBDF769833007B34A21A79833D637E1D685E19CD6001E6078E641FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108170, "uuid": "cfc90070-1479-4b8b-beb4-7ced994207b6", "value": "1536:F7EnxX/ZpiIvAuZrOVIpUEW5iIO24eFyZNI4oSiWPQ5:KnxX//iw6EWAIO2ok4zPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713108170, "uuid": "76a9feaa-90ba-424a-bb73-349888900a4c", "value": 98356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713108170, "uuid": "930b0360-572a-4887-88ee-dd07303c0280", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108170, "uuid": "239b76fa-1455-411b-a30d-419019230a5b", "value": "c60b0b552c4d9936bf3398ec3d79ef55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1652df66-f9f4-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1713053723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713053723, "uuid": "b76150ec-85e8-4309-a473-22ff6ec45ed3", "comment": "Malware payload (njrat)", "value": "e5926d1f4beb4854e4635882e09d7f6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713053723, "uuid": "7a35db75-89df-4e7f-9d95-717ceb5da619", "comment": "Malware payload (njrat)", "value": "3aa10851ee2e45aa3874b2b59d78ba00ba56201528118f64d0d2f7c95ae953ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713053723, "uuid": "e2a1c0b2-3ef6-43bb-9203-c9f1004ed4f1", "comment": "Malware payload (njrat)", "value": "0d389595177b8ec403b3a83fef1e77d8aec34b4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713053723, "uuid": "3f517d69-0238-4060-9561-7202681808b9", "comment": "Malware payload (njrat)", "value": "8a18aca5f2bd89d8ce7eccc893610ed11f66b2286151cae9df1fffe75bb02bad0dbb348056838b25b602cb2fb9a0f76c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713053723, "uuid": "eeb3cdf3-e5b0-4cad-8b03-a97b561009f9", "value": "T15FB3EB387D952133C67EC1F689E50A8AEB69223F3191E9ED4CA742C418B2F166DC1D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713053723, "uuid": "84b7501f-8423-42d1-8a6d-cd2ad78b5801", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713053723, "uuid": "5c05b420-7f49-462e-adff-3644577df7cd", "value": "1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegoz:w5eznsjsguGDFqGx8egoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713053723, "uuid": "5e82ce40-f5f1-43a9-ae65-5e55c5107981", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713053723, "uuid": "4ffc01dd-6c61-435a-994e-0eff231730ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713053723, "uuid": "d7f83b0d-9276-4e80-9452-9df15270aeec", "value": "E5926D1F4BEB4854E4635882E09D7F6E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f38731-fa80-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713114174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114174, "uuid": "7bcd8150-3008-4b76-b0ca-0af130793daa", "comment": "Malware payload (Mirai)", "value": "808a7f758a258d47e33b5eb6095312c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114174, "uuid": "af8a5c8c-ab27-4605-bd6d-09772c92a703", "comment": "Malware payload (Mirai)", "value": "3aebc9ed38186cda289cb6baa0a7760616bc8e5ada24ca9445e1b3f8621b87e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114174, "uuid": "7b47bb49-be4e-4498-8c31-19ade5867b17", "comment": "Malware payload (Mirai)", "value": "e6dad67762a44b4fdd21429f0f9d3e9e69a2f0f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114174, "uuid": "9577bf01-014b-403c-94cc-813f297f3b4c", "comment": "Malware payload (Mirai)", "value": "6802b4e548105043adf076d61e281775e97f22c2b3b6e5d08e3202fd7e092fb498755e800f638e89b45a283d8ad94ab5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114174, "uuid": "0a8ace38-9f50-4337-8f82-a4622ee25f17", "value": "T156834CC6F801DD7EF84BE6774C570E087571B2D50B930F2792A7FEA7AA72158290AC81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114174, "uuid": "5d86531b-9a92-4c0c-ad7d-123da381078e", "value": "1536:mDJmCgP761EP+7jy0nJ83z2QeuacWjcW0JcWcBBfBy7PMoSUesPf58Th/KQ:mDJmCgP7hm/y0I2QeuacWjcW0JcWcB5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713114174, "uuid": "1f4d49d2-73fb-4e89-b540-b39cb662a16d", "value": 81872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713114174, "uuid": "6c05c5b4-b447-4073-9624-83aa9ac258c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114174, "uuid": "13fbdb43-eb9e-49de-8a37-066a18aab313", "value": "808a7f758a258d47e33b5eb6095312c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a8a7ff-fa65-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713102608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713102608, "uuid": "0365584d-a103-4c5b-8f74-9a4d0fef84d7", "comment": "Malware payload", "value": "963499251d895ea5800eb5c975b8bfc4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713102608, "uuid": "17d388a3-48d9-4fca-bb7a-9e218b0a07c6", "comment": "Malware payload", "value": "3d20e8592fe963b56f7ca64692929b5aab91be3e5702df522da1d2efe2dfafef", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713102608, "uuid": "dd49b780-bc37-47a0-b7af-3696de929070", "comment": "Malware payload", "value": "d8a71d20d9ab83605439220ae48721e7f44d748e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713102608, "uuid": "87f6f33f-027b-47dc-8b20-bd5f4a574b2a", "comment": "Malware payload", "value": "c73a4999ed8a890b66b4d324b94969d5d8e74dd67f5e519c4c1bb8ff7de7e6bfc9aaa235f3f3d92589e9a4400cebcdf1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713102608, "uuid": "26d8f41e-4cb8-46e6-a8a6-a4d3e37279f2", "value": "T16333E8527DC26A1AC2E0237AF96E81CE332167E8D1DF7257CC211B0476D655F0DA3B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713102608, "uuid": "216ab1e4-4757-485f-800d-5fdc5f580e99", "value": "1536:hCqZI1iDUguHppKKOxgPg6osAvH3Y09WZoh+fgh8M:XZeAPD9WmhA3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713102608, "uuid": "b6d24352-51ec-45d1-a1aa-d255948792b4", "value": 52144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713102608, "uuid": "28c66a15-663f-42f2-be43-c450865d1917", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713102608, "uuid": "ff593763-ba66-4149-9cd6-e69e4a7574ca", "value": "vcimanagement.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb58a58-fa9c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713126211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126211, "uuid": "1399fdbc-98a2-471a-8f65-fced421873d2", "comment": "Malware payload", "value": "906466f83adf783ea61b7159cba83c28", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126211, "uuid": "a5f6c8c9-f22d-4d8a-908d-c0448f9d4af9", "comment": "Malware payload", "value": "3d66e6334b96b782b295b25ec8dbe4417a5b3c435e6cba8542be739b7be7a180", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126211, "uuid": "d4317706-ce84-405e-b345-239c4144acb2", "comment": "Malware payload", "value": "98b9fc77f4a85c28fde518de921c003c98568742", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126211, "uuid": "accd224d-a7db-4e8b-bd42-4e2e9cdf5a9c", "comment": "Malware payload", "value": "62cab9cf2bb79cbf4908ddff79d97452ab423be21c30c1ec1fca39d49ba926e3c68f318f67d0da96f52f1a03db3decfa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713126211, "uuid": "14e692e7-9d8d-468e-ac11-c3488316fe40", "value": "T1F6E30845BC509B22C6D712BBFB4E42CD372A17A8D3EE320399255F21379B95B0E77142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713126211, "uuid": "a8f6f853-2bcd-4158-a6c9-b378c6d17b0e", "value": "1536:PRwJZbJOfunL7552bguDkrrB6A98h3ADsmYTC5PBcmCOGONB6itM3WGrlQxwywr/:ZGbkfW/tnB69AJYu1Bcf6WGK/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713126211, "uuid": "66532441-a171-43d6-8335-779d9dd286e4", "value": 150144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713126211, "uuid": "c7aec0b7-288b-4b85-b1ba-60db877961a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713126211, "uuid": "41264efe-726e-4283-a6bb-16b029eab5c4", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85bf9c9a-fab5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713136803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136803, "uuid": "e9c832cb-9807-4569-8a97-1a77df45beeb", "comment": "Malware payload (Mirai)", "value": "e84aae8bdf412c61faa064f783dbf8c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136803, "uuid": "88f1a23a-c795-40f5-a075-e00aab9bc8e8", "comment": "Malware payload (Mirai)", "value": "3d6ae6aa5412bea7f0178145b537777e5593c17ae2eec83a667b53ee095450f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136803, "uuid": "ae8e2dcd-83da-4197-9a2a-120734beafb9", "comment": "Malware payload (Mirai)", "value": "8a54489c80f1ca8cf37a21faaa7794794fa6a7a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136803, "uuid": "d57eac10-7e33-4b17-90e3-53211263d581", "comment": "Malware payload (Mirai)", "value": "8357638fcbcddd852db8bff438ef1fa2c88c3dd4f3094c67fffb4a06b70dc6942afc0ab5cf5c0567cad038230b90dfe4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136803, "uuid": "87bd4142-c73a-415f-b6b4-ccfffab0ab91", "value": "T1C6234F48FB99A32EC6A2F2FEEF58418F77390B9477FA3D268235014923C87756536520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136803, "uuid": "582dbc15-197e-41cd-967f-c8d54bdf8a7e", "value": "768:kqXWD1gpJD7g67bVxEKl2zyrHq3jonjA+1o0+PdVd6mS9llCD59jFa2vtaM9o6k+:k6Wbbzb3Enj2vVSLlKLwlMBNRFk2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713136803, "uuid": "cc34a6fe-bcf3-4014-a493-54bbec42f86d", "value": 49311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713136803, "uuid": "8a5aa1ad-c20a-46fc-9ac6-15076f9591f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136803, "uuid": "32875866-a74a-4bf1-9c86-2c095b7f6377", "value": "e84aae8bdf412c61faa064f783dbf8c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8463b6aa-fa5d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713099005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713099005, "uuid": "888c9dd6-2a0b-468e-b4e9-48a2532b26d8", "comment": "Malware payload", "value": "48d3ddba68a021225a90eb074977980e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713099005, "uuid": "90d0eb70-4adb-4dfc-826a-dc043f983fc1", "comment": "Malware payload", "value": "3d6f84963eeae5f01068d8fa7d5370aeaab3fffa5b1d23f15ad6f329fdf44c7b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713099005, "uuid": "5df36d3c-1162-4696-9480-76164ceceddd", "comment": "Malware payload", "value": "5f3a30ec312dc78a37d1531c2e5be9def82be100", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713099005, "uuid": "88c8f089-7ae9-4ef0-98cb-bb313c3c2628", "comment": "Malware payload", "value": "748fdf3e3de699df508d9b9d17e817e126194318c1791dd7f63ab0fc37ab7e58ebc646c1eb58f77fc0bdc3a468bedb19", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713099005, "uuid": "5d2a2097-236e-4332-b56f-c54cc1667c2b", "value": "T16021EBA65BD21C27CCA00737DC9A4710A322EF84A4DDFA13E72212210D2F3591F2A685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713099005, "uuid": "afd27d3b-03f3-4bf7-9ba4-848d87e72dc3", "value": "24:o8FpVVP9qD0at6esf6OolFSw0/cvMnqFZUqIkOl+9grNb4Gy:o8HFqDPttshwFSwRnIkKlrNDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713099005, "uuid": "5b20b135-0dac-49f6-b038-534d887eb092", "value": 1224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713099005, "uuid": "572a5fba-255f-4161-ad80-541024c7a422", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713099005, "uuid": "4c3efe0f-193b-4f19-b703-f277a0ef86d1", "value": "arm-20240414-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0276ebfe-fa43-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713087620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087620, "uuid": "8b39e910-7ddd-427f-a375-f1e847b33822", "comment": "Malware payload (RiseProStealer)", "value": "b55fcd6754bba5d7a01a0d8cb89bf4bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087620, "uuid": "cdb7a54b-455e-4437-a9d4-c3141f192b23", "comment": "Malware payload (RiseProStealer)", "value": "3e80e5c23a0ba1290293bf9936ca3b51583937acb38db1d53ee4521cd3807f65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087620, "uuid": "735980e5-e869-47ed-8c62-d29ff01eab18", "comment": "Malware payload (RiseProStealer)", "value": "9a6b93848baca5e5bf3ae6c92581f97d7fb4b87b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087620, "uuid": "f3430c06-4b98-4867-a1d6-b3d7659026f9", "comment": "Malware payload (RiseProStealer)", "value": "8ee50869e2a2e4ef8b88a46247464e71297e7a4699a174940711c9c4a4065fc1778857a77b14f173ad94fcb2ddcd33bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087620, "uuid": "c13e04e3-e080-47d4-a460-7bb228f70232", "value": "T1E6B533831926FB1DCE01C77283B3C08055A0B87545A2B58FB5CB2E23B9BFB76335A955", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087620, "uuid": "7f392669-7356-4fe1-8f0d-23fa54860b19", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087620, "uuid": "2aef849d-7a0b-4d8e-9d28-9036f86874c5", "value": "49152:YSUl6vD5DxN6HHLJFwHAbzSzRMweMpadUXSXBcwpA6Cfgf5ffHU5Z:YSSwD5DxkgAGtMweKSRFpAMtfHYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713087620, "uuid": "43dc5f45-2e1d-4558-a2a4-a99e600423d0", "value": 2269696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713087620, "uuid": "d01ab045-753a-45b3-af38-ab6aba3d82ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087620, "uuid": "b71523c4-d1ac-4834-b196-d688e5cd6f6b", "value": "b55fcd6754bba5d7a01a0d8cb89bf4bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0aab12-fa7f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713113812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713113812, "uuid": "e3f4e3ea-2b68-44c8-9caf-c2dd87ef9ff4", "comment": "Malware payload (Mirai)", "value": "eccb522b9ad2d188a179ad0db1ec956f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713113812, "uuid": "500b8a42-02fb-4d70-b417-342a5a9a9461", "comment": "Malware payload (Mirai)", "value": "3f22a9a3dc08f9131cefa84edb5f24cfbc25400407f3cc4ca849c216df742145", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713113812, "uuid": "42ab3a77-6797-428d-8760-4f8fa3b31ca8", "comment": "Malware payload (Mirai)", "value": "bb55c149027304a62c438a86044ffe223b898536", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713113812, "uuid": "8f2402f6-dbff-46d2-9e9f-167e3a49ab2d", "comment": "Malware payload (Mirai)", "value": "da4a4e4bafd1cb40ea0a52e1e44d3c62bc84870b8691d5e98502874bbdac08249b233bc7eb55bc6d8bbd8e911f9a7024", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713113812, "uuid": "dda74468-30ad-4067-8ab3-34de65b96152", "value": "T14BE2E121E653DD319FF178B1E128C6867B9E63F1E0A93AE531A08D5CA6570091FEC387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713113812, "uuid": "c1b08850-c09e-4715-9d89-443007c5fd46", "value": "768:yNk6e3WapIBMl/9+uNpBJRBTBCwr9q3UELjq:7x3WSN9+YpB5TBCVLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713113812, "uuid": "6a7894c3-bdd4-4590-8b0e-2d427235b261", "value": 32236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713113812, "uuid": "c6f5f3ce-277b-4f17-a7cb-f7721e4aeb1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713113812, "uuid": "4f3c12f0-a757-4189-8d20-7fbc4e86374e", "value": "eccb522b9ad2d188a179ad0db1ec956f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6830b8a8-fa30-11ee-a120-42010a9c002e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1713079630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713079630, "uuid": "c0b822bc-0b66-4090-b638-528c3ec8c0fe", "comment": "Malware payload (QuasarRAT)", "value": "78f7efed48c531657b84cd66911c7eef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713079630, "uuid": "abb9451a-d65c-43e9-8891-08aa00a038b6", "comment": "Malware payload (QuasarRAT)", "value": "40ba4a68575cda8b4da56ef2efae3f3c217bf7b78d68c29086e86d324d3ebffa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713079630, "uuid": "fc97c8b5-d71c-4ab9-b6d8-50967848c526", "comment": "Malware payload (QuasarRAT)", "value": "eedcf0f081c78adfcefe3e9208bc83b252f1b4aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713079630, "uuid": "67bdc177-e437-4a4c-965f-01f298b4eae0", "comment": "Malware payload (QuasarRAT)", "value": "1785672b3ef3505fc141d3fe886d385585275e7a34aa19ec7dcf8445c4f1ab9c52d0e8dd410d5d10f7656bc8167c15bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713079630, "uuid": "52f2ca76-9bda-4834-b585-323a4e61f276", "value": "T14FD45A5586068482F6D31772482D5AB044DA3FBCA4793101FC92FB5598FBDBBC0A2B7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713079630, "uuid": "7fc9614c-c1f6-4c8a-b6c9-a8736e8a1037", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713079630, "uuid": "82f4559f-7d0f-4941-aed4-638eedc76f4d", "value": "12288:JvqsfIozrJqppjn1rmq12WaD+1Fri1xbcR:h9vrMjn1r5aCjg9cR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713079630, "uuid": "1ce97c14-01a6-4b40-8957-f7c91a34e42f", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713079630, "uuid": "ed8657d4-2235-4e3b-885a-f85e61240e47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713079630, "uuid": "7b1e99c1-3af9-4b0e-b91b-6f73572779a0", "value": "78f7efed48c531657b84cd66911c7eef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a88cc0-fa19-11ee-a120-42010a9c002e", "comment": "Malware payload (CobaltStrike)", "timestamp": 1713069927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713069927, "uuid": "ea113d46-fbc8-43d2-b2d2-2cc4707e564b", "comment": "Malware payload (CobaltStrike)", "value": "f09a47e1ceb604a3ace3ae34f99d597e", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713069927, "uuid": "0b129c98-4149-4a4f-8deb-173d50c4b838", "comment": "Malware payload (CobaltStrike)", "value": "445cbf2e44666dbdc54f0eacae8bc3911a34b766b5bc101ac289380da3d19a2e", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713069927, "uuid": "26c00aac-d3b4-4a7e-a0f4-0ec07ff7df27", "comment": "Malware payload (CobaltStrike)", "value": "9e103c93ed02923418666e2ac30ef9e64a25d6fb", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713069927, "uuid": "9f636b81-48f6-4ab2-86d7-52e643372533", "comment": "Malware payload (CobaltStrike)", "value": "97342c259b9f03426fc6e333407077c5289f762ff53cee6540f06c3a529184f830e8fb11f0ad48d7851bb2aeb0e3f09d", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713069927, "uuid": "5dcb4554-cd05-4113-abbb-07a981ad4000", "value": "T1E1521975EA0378F6FD1A897014EBB6FFAFB3E1138C105C86CF94E84158234B6981664D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713069927, "uuid": "b7acdda8-fad3-471e-b78a-87b7ef80cd30", "value": "dc25ee78e2ef4d36faa0badf1e7461c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713069927, "uuid": "b9267f65-112f-4299-85ff-2d00790fe08d", "value": "192:AsH+DgGK83SxHn2OQ/dmBI4KBfTgir+xzEMUGRbqUqV/Qjo7AGa:AA+kGKqbOCdWIVBff+xzEmNfCXAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713069927, "uuid": "0986bce8-84fa-44ff-9c5f-36f022171378", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713069927, "uuid": "118c7ab5-187d-48b2-ac50-d374ab43bbae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713069927, "uuid": "7f2129fe-483f-4fe3-83d6-464939db59d4", "value": "F09A47E1CEB604A3ACE3AE34F99D597E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5455e909-fa3b-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713084321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713084321, "uuid": "8028cc82-9108-453f-8468-79252b4c4174", "comment": "Malware payload (RiseProStealer)", "value": "3574861601824abc4d12218c22af1b41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713084321, "uuid": "55423003-cf17-4673-bc31-6624399c77a6", "comment": "Malware payload (RiseProStealer)", "value": "4787cdb99014b54c7ca19e78a19756c678d16b5e0de32877aa2247451215eec0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713084321, "uuid": "10de11b2-a19e-4eb0-ade7-ce9de7e7163b", "comment": "Malware payload (RiseProStealer)", "value": "969e45b34a72451a97139f29a0fb53e2a2e875e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713084321, "uuid": "4fbac51f-bba1-4e48-8643-3b28eeef4ffa", "comment": "Malware payload (RiseProStealer)", "value": "3440e9ec422412dfd5f63334cab85f4f63f56efa1edc6da9f49fa8401faea290acd39cbe447c12da71d0fe7e5b16b3fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713084321, "uuid": "44ad0ba6-6e13-48b8-9d32-64cceee7926c", "value": "T1C7B533691D3099B9CE81D33129C1D1135D6439E08AB9BE3FA4F62C277CAE74FAB17811", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713084321, "uuid": "840d36f8-8631-413a-88ee-5ec0f7665051", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713084321, "uuid": "55b38f46-6e01-4389-b87f-aa466f75664e", "value": "49152:dSUl6vD5DxN6HHLJFwfcx8U84xRbpxy9QbOYXAwtga5UAb970iREX6IBG:dSSwD5DxkyM8x4xhp9A1a5Pbx0iRPwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713084321, "uuid": "66a8f950-6578-4655-9ec2-4dc9bb90eaec", "value": 2271232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713084321, "uuid": "d14dc8f5-1825-4ace-9097-df4f60865119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713084321, "uuid": "19c2a5ea-282e-41d1-bc06-e074fe040ee2", "value": "3574861601824abc4d12218c22af1b41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84ee686-fa24-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713074718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713074718, "uuid": "67798a70-9fca-45a8-93ec-9bec5acf5cfe", "comment": "Malware payload (RiseProStealer)", "value": "89227af5a4e508046dba0f2379366f24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713074718, "uuid": "3f78d506-7257-41f0-80c0-2050be54c622", "comment": "Malware payload (RiseProStealer)", "value": "49724b3b4a63c60fa5c22f62b291d016947a095b57f4757b83936f3173a18081", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713074718, "uuid": "ebaff191-003c-433c-9efd-6dd975a30132", "comment": "Malware payload (RiseProStealer)", "value": "dcfbc380cc4b8749a0122f3f6e6f05a9ffaa5597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713074718, "uuid": "23c5e7ea-fcb2-45fe-961a-58b56cc1516c", "comment": "Malware payload (RiseProStealer)", "value": "09b189b2082f801bfb32c3f9818ca5d009bc9fc5e9be15ee8a872c51bd8b0509d120f9d5d3f716197c1f38624eba37ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713074718, "uuid": "34cac635-94e3-48b3-9083-7f4886b12d4d", "value": "T107A533984F02B265DBC2B37005E7E61127E432638972799F68DD7CE7B56B3A87208C07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713074718, "uuid": "fe97628a-2bbb-4a68-a746-1f4673df7596", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713074718, "uuid": "90c7722b-d02e-46fc-ab5b-aeeae1896825", "value": "49152:1SUl6vD5DxN6HHLJFwvvPMLOVNdtH5v3dHd0mQE4tN0y6a24:1SSwD5DxksPEO7FZ2PtNj6a24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713074718, "uuid": "cda43daf-bb0a-481c-82c4-29d003a3251e", "value": 2240000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713074718, "uuid": "ff7c83a9-d8c0-4ef1-9116-26fda20794d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713074718, "uuid": "ca993af5-e50d-4297-911a-f04a994283fd", "value": "89227af5a4e508046dba0f2379366f24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534119da-fa08-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713062415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713062415, "uuid": "2cc92ab5-7ddc-4acd-b7e8-4c3aae34ba69", "comment": "Malware payload (RiseProStealer)", "value": "2c84dcbf2cbec43a827f8dc664840adc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713062415, "uuid": "ac5b7232-940c-43df-92f9-6fc7c2a6b570", "comment": "Malware payload (RiseProStealer)", "value": "49d3af43d44b83c23c6cf8f07f8b0936ce9321a008b23fefe35e47e3a855830d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713062415, "uuid": "102097cd-8d71-49e1-85d7-92b0a0af8b03", "comment": "Malware payload (RiseProStealer)", "value": "ec89940fd0a276ef613f2df4dd37b1128918b895", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713062415, "uuid": "29b366c5-e29a-47d1-a975-1ace02e22ee3", "comment": "Malware payload (RiseProStealer)", "value": "36681f6303f01e083872b59d71b123764d2800042ca4a75c9c546c183a71ec530e2bc47e537791885ebabd4234479a17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713062415, "uuid": "c86b5435-6a77-4aac-b33d-ca10ea10fbfb", "value": "T1F9A533F60E04670BDE74EA724ADAE5122760F69402B47A8C340EAC93743F79C577F866", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713062415, "uuid": "f67951a9-f181-409e-ada8-9bf6402101fa", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713062415, "uuid": "e383a05b-865b-456f-986d-25447b17d06c", "value": "49152:/SUl6vD5DxN6HHLJFw8ftyDFYdVClfjq/k3DVzlu/c:/SSwD5DxkveYdIl7qsJw/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713062415, "uuid": "f90232a0-ce62-4c80-8889-657eb8fb0ef4", "value": 2232832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713062415, "uuid": "86be97fb-8449-400c-ae44-a4f951845921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713062415, "uuid": "81802b4e-0303-47c1-a54d-5647ee9cd559", "value": "2c84dcbf2cbec43a827f8dc664840adc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55907b34-fa0f-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1713065426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713065426, "uuid": "63f55572-eccf-4179-b3bb-d7419950f7f6", "comment": "Malware payload (njrat)", "value": "edcab9e1ecaadcadf520ff46563d59d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713065426, "uuid": "75b54518-2f9e-4438-a2a5-93554cd8fb32", "comment": "Malware payload (njrat)", "value": "49f277dc019b879a635698e0611344db6d45bc7c577dc4fed3d1fe98ddef94fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713065426, "uuid": "4ba4672c-b6d7-447a-948b-aeac194a510a", "comment": "Malware payload (njrat)", "value": "1bb54b8be32d02c2d32ac08a6b5f6d546804a6b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713065426, "uuid": "798a39de-fb10-4f8e-8586-b52e5e431cfe", "comment": "Malware payload (njrat)", "value": "cf0ef16ef5001bcaf6bf42b157256a96ebe17053c4aa14e3ff2bbf751ed25a85a4f9f2ee196d479254e55a64d4b8a3a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713065426, "uuid": "ce6814fd-1530-4f06-a5b4-467195b001c4", "value": "T146B3FB387D952133C67EC1F689E50A8AEB69223F3191E9ED4CA742C418B2F166DC1D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713065426, "uuid": "b3d0b2ce-19da-455e-b68a-7ba3fc3d72e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713065426, "uuid": "50a9165c-1b6c-478e-b925-86a718f9bcef", "value": "1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegoxmOBhZ:w5eznsjsguGDFqGx8egoxmO3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713065426, "uuid": "65314137-3dc1-450e-88d9-6933f8287246", "value": 110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713065426, "uuid": "6f17018c-b827-4c74-b5eb-cef10d6a8911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713065426, "uuid": "365f7b95-8176-44f5-988e-85f82e4e2667", "value": "EDCAB9E1ECAADCADF520FF46563D59D2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f1ccbb-faaf-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713134307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713134307, "uuid": "ad575081-ea06-419f-8611-107991cd8d83", "comment": "Malware payload (Mirai)", "value": "84b6ba1658d67baa9b1ebff841a7f378", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713134307, "uuid": "f088265a-eb09-4a2e-8740-d9426e6ad4ce", "comment": "Malware payload (Mirai)", "value": "4a0d00898b03f806f49ce84c88670833884cc9785ab51b0469670746c2eaea70", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713134307, "uuid": "2fca9c8e-6087-478a-8997-403b02cf53f9", "comment": "Malware payload (Mirai)", "value": "f3e854193c4694831d5353a7ae7c05226dd35abb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713134307, "uuid": "71442ef9-7ab1-4a3b-832e-0685c48fdf68", "comment": "Malware payload (Mirai)", "value": "c74a2ff6fe7b546485fac05d5ec94909a503e343a716ee6ddb7379b97aa5e796d750acbcdbd33ee3bc5bfe7aab591e90", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713134307, "uuid": "7e7daa08-3dda-41d9-b69e-30fa4bbed784", "value": "T13B344A2A7622CFA9E15E823547F38F3087A522D207919145D2BCDF146E113DEAC5FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713134307, "uuid": "9a00913a-f38d-4d26-9d07-82dff7e56739", "value": "3072:DiuME6EIoqH1V4WWgZfdUnzTm3tiZseDFthGB53+LkDKpExxOz:DiuMnEEH1VZWgZfd+O9iPDnsPQ0xOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713134307, "uuid": "6ec7f4ff-dcfb-4b5a-8ebe-7a267e2feb4b", "value": 248964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713134307, "uuid": "b1f810c5-666a-459c-b7d6-53701ad4d939", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713134307, "uuid": "3adae00d-d057-4c06-a432-4da1c94fc4fe", "value": "bot.mips-20240414-2238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5d9ff8-fa6e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713106211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106211, "uuid": "7230d14b-8a97-4ed7-91c6-04cd22b6a291", "comment": "Malware payload (Mirai)", "value": "49ef86a68b38c46ddcc58f59be7df4b0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106211, "uuid": "d589234b-aa08-43c5-8930-eeec7a05e608", "comment": "Malware payload (Mirai)", "value": "4ae2ce8cd41dafa27a33efb8325128e284c93a9b8d297c81ad328a81c7e9cfa9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106211, "uuid": "0fab3ddd-0f37-4ee0-a987-ed162ab4cc7d", "comment": "Malware payload (Mirai)", "value": "e254c6c94ef4fc20f6ac2c7e32c28754e97f7e70", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106211, "uuid": "35b6f5d5-d62d-412b-9260-f453ebf66e06", "comment": "Malware payload (Mirai)", "value": "fab51d8662d98c0d689ab78777d64f811322c6ac6d3e5f1fa415d193faa9395ed697579a1568540e63f822324a885225", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106211, "uuid": "33b5d700-a896-495c-aae4-b3b81fd2bfd8", "value": "T1E9D33B46FA418E53C4D517BABA9F42493333A764D3EB33069918AFB43F866AF0D63501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106211, "uuid": "b7357752-eb2b-4ba1-8322-dfe16e2fc2a2", "value": "3072:+VXCTRarXd57T+tRWxtt/9jGEzc4uc+hEnQin2jTM/9xSU:+RCYrX/+t0X99jGEzcfcpn2/M/9AU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713106211, "uuid": "e8ef0281-81e0-468e-83c3-d043b5a694ee", "value": 137994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713106211, "uuid": "97de382a-1bfc-4cb0-abe9-319054aa060c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106211, "uuid": "580abe4e-c5c3-402e-9c6d-a86feb18411c", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f1b0df-fa42-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713087250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087250, "uuid": "7be3e736-629b-4055-a30b-41d5565620b9", "comment": "Malware payload (Mirai)", "value": "b8adaeb57b2cce0c3fe225ba5d0aa0fa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087250, "uuid": "1de426ad-f2f5-42b4-9fda-02ce6b63bdc6", "comment": "Malware payload (Mirai)", "value": "4ba8b61bbc08cc88c2cc52adc9f3d993097c0e6976f2498101109643fc187fba", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087250, "uuid": "580829e7-0f05-47ce-bac8-16bee7ed35b3", "comment": "Malware payload (Mirai)", "value": "8906421d4ee933fd84b2696c9b0bcda0856d6f91", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087250, "uuid": "3cfa8216-e73b-4fc8-bb97-b48fe2068ce7", "comment": "Malware payload (Mirai)", "value": "02ca092a708a3543779bb19e5122a49adeb4db50dece4f4ecc75e65a3bcb4e917474eb988ed6758ed4f5b87063ce9e4c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087250, "uuid": "f8d330a1-19f8-4723-a59c-e24ab8a463b1", "value": "T1E1041A45FA404B13C0D627B9FADF42453323AB9497EB73069628AFF43F8679E4E22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087250, "uuid": "8560d09d-e939-4db1-bd40-29f967edc752", "value": "3072:WVjcdizlfERak4abYFyiskdGvXCUBphv/1Jso0M/RicM:Ojllf894abYFybk4NBPv/jx0M/RiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713087250, "uuid": "5372187a-32ca-4608-9239-b908e6704b76", "value": 179829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713087250, "uuid": "a673c6a2-bfa2-45cd-befc-71354b4e7733", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087250, "uuid": "d4eb29cf-8fbe-4a71-9e60-10633bae10dc", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ff96c8-fa81-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713114258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114258, "uuid": "b4c3f75b-394d-4a4f-af2d-65207e360dc1", "comment": "Malware payload", "value": "a8f9aa86971215ed95417b98403eac49", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114258, "uuid": "c5a1b755-d7dd-4551-b5b6-169ddebb4063", "comment": "Malware payload", "value": "4f2de912db0bed6a882b61766e45a5f07003c040505456d36135a9d61c4a7e42", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114258, "uuid": "076f3bed-dc5e-48e2-aebe-3357e1e03b82", "comment": "Malware payload", "value": "bfcf6069bdfec516e78540f6140e80abf05516f7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114258, "uuid": "64dc7861-53c9-4482-994b-6f83a30af12d", "comment": "Malware payload", "value": "76ceae876c70583ba09cfca3511564cbf27ab8bdf8e0707e88d900d1a9bb717b5fadb6547c38cb92d87c6e8bd04e2b0a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114258, "uuid": "51b38fba-8373-47e8-b1e5-d313a608ba2e", "value": "T1AF1833E3F7309D3DC537057281ABA161F9398F109712A61F7808B72D7A772E28A467E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114258, "uuid": "c9400e62-8b5e-4038-b18a-a0528255a152", "value": "1572864:TX0EWAIYcIkZ2TGiP3QWX/JMC5OwtdE/UteLa0jkXA8vBOHKOGUxKlYl0:T3WPRZsGQvvJR5vSUoL3kdBaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713114258, "uuid": "71944ec7-8593-44d5-b584-a27b12a024ff", "value": 89981574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713114258, "uuid": "79af16da-aaa8-4199-9bd4-3b8d3ab89df0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114258, "uuid": "2071c603-5109-4ad1-b44d-0ea0b93ce4c5", "value": "Telegram.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc50ebd-fa80-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713114130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114130, "uuid": "00de1952-1aed-4f19-8530-9f54d01a0674", "comment": "Malware payload (Mirai)", "value": "7f4f2a3ce7499b57ab4b7b6570ea03d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114130, "uuid": "e3a20ffe-b849-4cf0-b42d-77e091da573e", "comment": "Malware payload (Mirai)", "value": "513c744c9a938d9aaadc5d867e8415dffb993e050db48959a755355800668267", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114130, "uuid": "eef040c8-146e-4f7e-b2d6-74b04219c4d4", "comment": "Malware payload (Mirai)", "value": "39ad973ec1eec41ac63310af36780c3dfcfc652e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114130, "uuid": "9ad28207-eb56-49c9-aa81-1e1febec0c4b", "comment": "Malware payload (Mirai)", "value": "fd3ff75d1768c46621cd54f2f6a7126b77978c8a35935743844116d17ddc590ee670cba5afd59dc3575e89462183af41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114130, "uuid": "f91422cc-c05a-45e7-92bb-3564d0526fbc", "value": "T16EE2E190D80978D6CDBBBC776D61F78EBBE89F49E707B862E08167023682C549603CC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114130, "uuid": "35f62e87-8128-4155-9be6-6fa840aba676", "value": "768:xOmADSseBZvS/sIF58nRDwo0Rx6iTSdUUW0lfOskcEFcK4uVcqgw0zG:/ADSsela8nRDwowPqW0J5lEcK4u+qgw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713114130, "uuid": "50f61b8a-5371-4d88-a702-7fd6460d08ec", "value": 32068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713114130, "uuid": "7f6ca680-5f30-4db1-9b25-e986c132c257", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114130, "uuid": "b3be97b3-9516-424f-8b26-ea1e07a14e5c", "value": "7f4f2a3ce7499b57ab4b7b6570ea03d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ddb85b-fa0e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713064946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713064946, "uuid": "d0f4195e-dbf8-45c6-afcb-2e3f2fe57158", "comment": "Malware payload", "value": "8c406233d0112b02b0a56e0dcc96d96b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713064946, "uuid": "33cee19b-6ae4-422b-bf73-3e1e7a8722d8", "comment": "Malware payload", "value": "51a1c8c9d456b6283cbbf1f48e5c9fd9b07dcec622a3b0a664e2f8b3a8454257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713064946, "uuid": "275a44ad-21a8-4017-8d68-c560dc498a9b", "comment": "Malware payload", "value": "963133726676a3032360e6fb25826ab1d2127623", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713064946, "uuid": "bb0a71b5-fde6-4ba7-9a16-fd15cc512a3c", "comment": "Malware payload", "value": "27241e3678eaffd816df822224103558875911d023a61ddcb1422852d5ac307c9e033176fb34bf448b9a869d5b803853", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713064946, "uuid": "1570617b-a443-42dd-885e-2de95685d024", "value": "T15E35E021BA4AC473C23223325E82D3B177A5AD20BA71677737D22B3D9D761C19A3474B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713064946, "uuid": "37179414-ce08-4b9e-bb1a-68708f282d55", "value": "b7f2d2fa6957f1a773dabb76c22fa4a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713064946, "uuid": "c0796fa0-1671-45e5-85c5-2ea2b33efa37", "value": "24576:fYDGpx5RWaAYHTrxmUma1KwOAFD5YjeWTXI1lBY/zXsocAe:fYDGpx5cwHTVmUmxcfeQE/zXsocj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713064946, "uuid": "343012d2-13c9-482d-b0fc-0ed67d30df27", "value": 1153995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713064946, "uuid": "09f5b7ac-3e89-4530-bceb-c513b5077682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713064946, "uuid": "7a276562-cd88-42d6-abf7-3ae97fbed144", "value": "SecuriteInfo.com.Adware.Presenoker.28664.12920", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b78e23-fa6e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713106208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106208, "uuid": "c48f8923-6382-4c21-a2c3-71ed12e2693c", "comment": "Malware payload (Mirai)", "value": "40c47604846914ee0ea7f86c774029fd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106208, "uuid": "e2282f73-3c9f-4c68-9e7e-25526ccef788", "comment": "Malware payload (Mirai)", "value": "53a87d055b585a4d080d770577889bf127f3e4aa4096225320a05424fdd9765d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106208, "uuid": "86466964-e0f8-41cc-b42f-915343cadd50", "comment": "Malware payload (Mirai)", "value": "f4dc5447d3ebb6e075f23f939be39bb3a6c42afe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106208, "uuid": "508b3728-004b-4757-a3fa-0576ce2bf453", "comment": "Malware payload (Mirai)", "value": "9dd64ee20564540b0796e2b8e1454c54a89a87c940f1b8fb318c81c96904e7abc6ad1588f0c3748e74756f4619f97787", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106208, "uuid": "1b9aa2c4-5e90-4c0c-8a21-7569e552f5d8", "value": "T14483085AF9819B15D5D512BEFE0E128D33136B6CE3EE7202DD215B2127CAA2B0F7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106208, "uuid": "38b1bd2e-dabb-48f8-b356-33fec8990616", "value": "1536:ejnbrs6aGfURnYq3Kq2t094eKoV+ZWyZAjlJ9l+/ipOzqI04Y4nZ:CrshwURUt0aJoV+ZWyZA6sOzqIRY4nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713106208, "uuid": "b099db53-9d36-441e-a6b3-4ecaa31bdd29", "value": 83844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713106208, "uuid": "28a60e8a-42aa-45ad-989b-bdd97fc2c648", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106208, "uuid": "ff02a15a-adf1-4629-900f-15757b20d6ee", "value": "la.bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49753437-fa7b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713111791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713111791, "uuid": "71973873-978c-4820-9f9a-06ec5520c906", "comment": "Malware payload", "value": "0f5fba75632d8145f73336ab0693a97b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713111791, "uuid": "16032be8-ac06-45f6-bb54-cf9f3c9d8c23", "comment": "Malware payload", "value": "544b8d05f6eac9d58357bfbb602790b4e05419ad63d9c4c81e1e83aba0cc21b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713111791, "uuid": "de1ec78d-115f-4aaa-999a-e7b6857109a9", "comment": "Malware payload", "value": "abfb170f1f0111f0c7840e1531a34636b4dd255b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713111791, "uuid": "57fba658-2028-4123-8f9d-595a379e67fc", "comment": "Malware payload", "value": "72be112f79be7603202ebe9c44fa42db7a63d5841fc40f2470531bd0f6ea2b72d96493dd079065080e8e1f83c9875a4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713111791, "uuid": "db26374c-8769-419d-bceb-a5bbaa216b7f", "value": "T1F37502969EE5894CC5910FB806F29D7862BB9F742D1EF206CC4275EB6F36BC82C80517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713111791, "uuid": "31ec7178-0603-4c8f-bd8f-a5ff485d4a6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713111791, "uuid": "04e99d44-654a-4524-b12f-e25eb02cbfa6", "value": "24576:Lx1Jmnc2v/iaI0FFP0hdMtPS+c2v/iaIAbWBOJGPUhoMBPSKZdDVsMhImVn5LjO4:D2v/fFFP+N2v/MBOGPelDVsMhImV5HxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713111791, "uuid": "f5fd6149-40b6-4cf1-bd3d-ed928cf75253", "value": 1564672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713111791, "uuid": "a4cd56d1-1c15-43ea-a2d7-92f40ee28a51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713111791, "uuid": "41185710-43e1-41e3-b0c8-97a779a576ea", "value": "SecuriteInfo.com.Win32.DropperX-gen.31374.14437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6f4325-fa58-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713096950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096950, "uuid": "2f26028a-0d2b-4f9b-9ae4-9c4c740f4ab5", "comment": "Malware payload (Mirai)", "value": "0add09ae84458ca55de1b6ccb09905fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096950, "uuid": "4c83435c-38f7-4cd6-af4a-267002ba58cc", "comment": "Malware payload (Mirai)", "value": "5590bd5abef415d7b9d6c8c34140cadfc6f7f6aed5c37c6af2a026b1e88e2f4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096950, "uuid": "99874b75-1f79-45a9-af67-75afa4f35a8f", "comment": "Malware payload (Mirai)", "value": "9ba785d40c7798989e52ec93a817c2c497e6ca9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096950, "uuid": "d37b25b2-c635-4903-93ce-42b76c19cf66", "comment": "Malware payload (Mirai)", "value": "fd038902c138737a190f190e892506a49a19cc1b7a9625f36c7e4a0f415998890d7070e55e8691a3859e43bca6f6b5e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713096950, "uuid": "fdbe19c1-02b8-4e7b-b06d-107eeab6424c", "value": "T132C36E227A395B27C1E5A53901F38336B2F66B492970920EBE251E8C7F197F030573B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713096950, "uuid": "1a8fe7c0-5bd7-4e9a-b113-82ec631b6210", "value": "1536:DbHreDewj2SZTdlnZDpm4ph/TmdiTvLty+FtJRNOh2nMXDDULAkPm9CBnh/YS:DeDeqmq3LtTFtDocnVLAUnCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713096950, "uuid": "adf805a1-6302-4a61-8365-955c2eea44e0", "value": 129444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713096950, "uuid": "878c52e9-674c-489d-983a-4f6b4c74fd20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713096950, "uuid": "77a11cbc-02d5-4be0-aa88-c2359a84afa4", "value": "0add09ae84458ca55de1b6ccb09905fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda7b8f2-fa80-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713114160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114160, "uuid": "a6d0860a-a32f-447b-af02-5015ae28cb76", "comment": "Malware payload (Mirai)", "value": "6a92fca64edba49a3902ee6e6c36b75f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114160, "uuid": "ff15e11e-5b5f-4be1-85c8-dec325df9cf7", "comment": "Malware payload (Mirai)", "value": "592131b0ea9c422cd66410297d5a3dc337445988a59aadf967aff63d8b666c2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114160, "uuid": "c5f47999-9719-4fe0-889e-deec0c05df4b", "comment": "Malware payload (Mirai)", "value": "865a52b30f7b62fa8a80c28875520e75b9178782", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114160, "uuid": "f00e6654-0813-4e37-87ef-e3b1504b2e67", "comment": "Malware payload (Mirai)", "value": "7b7573077af69b6263924365d44b6d5554f10cae05ea7e35bf2e2952b9160a11a868dfde4eaeeb231096f81815e16dca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114160, "uuid": "89bbd08e-a446-4f43-b6f2-fe3fc3b67f1e", "value": "T1AAE2F131BC8D6CB1D5F04072B52E8B446B9321EAD7BB77B23414422995C439FCAB85DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114160, "uuid": "0d4b0bc3-14a5-411c-9344-1cfc2c6d055a", "value": "768:N6RDrSNPyx5+9mLvkdi6svaY99w6Zk/elGgisqfegAums3UozAe:NQvSNPa5+lwvaY9vZ8elRmHASzAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713114160, "uuid": "9ba98e3a-83c8-4a33-87e4-999b969626a9", "value": 31828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713114160, "uuid": "56bdb0b1-8cb2-4aae-8bc1-157edfb5b249", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114160, "uuid": "e47a3607-d89b-4657-a073-69e2f08dac7e", "value": "6a92fca64edba49a3902ee6e6c36b75f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34c1050-fa58-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713096909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096909, "uuid": "9844eca3-32f8-45d1-a01a-2ebfc175befe", "comment": "Malware payload (Mirai)", "value": "97d4402a841590d9a5c0df605f7a58be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096909, "uuid": "6558a8f1-6bb5-4a7a-b4c0-0fa0d4cb0c71", "comment": "Malware payload (Mirai)", "value": "5a1d8f52272fb8187ab686f84f7a83f0a1f9459abda18c4a6a74e0d30dedb751", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096909, "uuid": "210a4d3c-80ce-4dcc-b176-739406811bd2", "comment": "Malware payload (Mirai)", "value": "daf70048c559de5dd3f3d5e266b35c59582cf9a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096909, "uuid": "b3d3eb66-9613-4b85-b785-b836ef5a2c3a", "comment": "Malware payload (Mirai)", "value": "d0ac9890a7ce1f6feeede91829775828d4ee096895aa95b3660362ab0021a542d26cd3ccf914d53547068145c14fc4b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713096909, "uuid": "a8a91612-4788-4762-8575-ae8dc7eca301", "value": "T185632945BCD28E1AC5D427BABA6E529D332063A8D1DF7213CC144F2437CA61F1EB7661", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713096909, "uuid": "98fd18a1-52e1-4567-822d-c6aba4f01dd7", "value": "1536:AxX7iMwWuGGzQij68/RYpv85F5zIm87zny44TwwOxWnOwnP:y+MSHQI6CRz7mmCwNOxCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713096909, "uuid": "bf71857a-b51c-46c4-95be-48630690f236", "value": 68828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713096909, "uuid": "370b59bc-b907-49b0-89f9-c902e64694e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713096909, "uuid": "25655bcd-a641-49a3-bccc-daf647428ded", "value": "97d4402a841590d9a5c0df605f7a58be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab7a535-fa25-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713075017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713075017, "uuid": "080acd5d-5d02-41cb-9336-bc9bcbf00144", "comment": "Malware payload (RiseProStealer)", "value": "87d4d6cc1273a1e3197fe6546153696f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713075017, "uuid": "e4b3f3b7-4fcb-447c-949e-47754837cc34", "comment": "Malware payload (RiseProStealer)", "value": "5af0624ecc27ee4bfcb19a2772a0539cb8bf6cfb5fe408713389b423cfb0c0b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713075017, "uuid": "db8559a7-824a-414c-9353-d63fa7f42a08", "comment": "Malware payload (RiseProStealer)", "value": "213cc6963aa8ba274bed890b3727ed7b1dccf25d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713075017, "uuid": "2009d8bf-ff76-4051-b658-bcc489753c2c", "comment": "Malware payload (RiseProStealer)", "value": "6313fb07ee432cb4d190483e5db50d45298294794fa318d662999b93380577d43dbf5d0de08e671c7988f71541c66c7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713075017, "uuid": "6dfe15dd-6dd0-4a40-99a3-0fb89cb99e99", "value": "T1F3A533CD0C68F731CDAAA33005D7C2211EB8BA2245F5DC5D798F3CA7792B1689B0E566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713075017, "uuid": "16498cf0-3131-43c7-8c37-932eb83026b8", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713075017, "uuid": "f285fe04-ae70-4efa-8951-3db76f56eb87", "value": "49152:tSUl6vD5DxN6HHLJ9tjn772hg95rB0HzM7qTwTHj/Gof4C:tSSwD5DxkZug95azMqTw//G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713075017, "uuid": "917e5ac8-dda5-47b4-a014-355bde6bd323", "value": 2258432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713075017, "uuid": "bda1154e-e93e-4f88-a742-011fbeae63d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713075017, "uuid": "b9f4cd8c-f232-42c5-8c83-e5d772499bad", "value": "87d4d6cc1273a1e3197fe6546153696f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53347050-fa3b-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713084320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713084320, "uuid": "d791ee36-3f86-4b7e-9361-b4bc762e3ddf", "comment": "Malware payload (RiseProStealer)", "value": "ae4a0b8242ec37581fa326da6db5fff0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713084320, "uuid": "657e2d8f-4c92-4c11-a8e1-dc6036597342", "comment": "Malware payload (RiseProStealer)", "value": "5ef309cc3e94220f5502a470648a02bdad53938098a02f3d333ee45267a0db92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713084320, "uuid": "e3b0362a-7bf4-4d23-8389-70afc393576e", "comment": "Malware payload (RiseProStealer)", "value": "97a1c0b57bd8388b225011a5184f75a987ca166d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713084320, "uuid": "37a44c11-5a3a-4142-88ee-eb7483dea0ac", "comment": "Malware payload (RiseProStealer)", "value": "8aeee92fb848cb44d4317fd938781e1cca678e3e24811374e1dfb65fbc2fc485e8bc7810e3b8e093a1e443a3c9dffab7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713084320, "uuid": "bbcb7fe1-367d-4f8c-8681-1462bec0a9b5", "value": "T136B533081A5467A1C99377B304EBD4315FB0266A087DFA8E768E3CF3B67B0196F1E095", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713084320, "uuid": "989d6ff1-2c61-406d-9eec-c7b3058ef262", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713084320, "uuid": "909901a2-f290-4044-8fd9-4d0dec07fb6e", "value": "49152:YSUl6vD5DxN6HHLJ9tomDSnExghWNvEGDc8FtPGMyEh/rrwor9bJxHYn:YSSwD5DxkiHEqeX7tu7EpoeJxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713084320, "uuid": "2f4738c1-d398-4761-b7ca-4a6cb0bf830f", "value": 2297344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713084320, "uuid": "b4c13b3a-771f-412d-8597-35b1f2b1b605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713084320, "uuid": "2319a854-9f51-4ebb-ba86-e11d3e10d1e8", "value": "ae4a0b8242ec37581fa326da6db5fff0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ed9fce-fa2a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713076996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076996, "uuid": "ed25a580-9a40-44cc-8df1-c84aea8af3bd", "comment": "Malware payload (Mirai)", "value": "2c5d198a267e637387f80db707e19bc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076996, "uuid": "93e7ad12-37a0-4680-9d79-a961e15c183e", "comment": "Malware payload (Mirai)", "value": "5f38f86786196e0af51559cdbd33267e237c9814c61b9c8e00dad35a5f5634c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076996, "uuid": "8220ee5e-8ca5-4c68-80c1-6e59233f69a7", "comment": "Malware payload (Mirai)", "value": "86a0d845ce5a9b5792ffde8469b974d5450022ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076996, "uuid": "34714436-405d-497e-bb33-72f0d7316909", "comment": "Malware payload (Mirai)", "value": "a32497109ee7b39cb04ce24b843122127860b29177764473835da804655d53e89f8f25dd60f1db416ef3f82e9d74e8a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076996, "uuid": "f762049f-54b3-4234-82ee-1b5d8c79caca", "value": "T1F9042934D6504B17C1D223BAA69B424E3F234F97A3D733095638BBB43FE279A0D62915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076996, "uuid": "900b20c5-4928-49c0-a317-a9d27d4f7f0c", "value": "3072:6PC+RjGkWa6s/qSPeAjQM6PBt9vbPtMAV7sAfymUwwFB7DXNu:61fWa6s/qSGAYPBbvbPtMAV7sAfymUwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713076996, "uuid": "8b49d171-3eb9-488d-b977-e1c8cf336488", "value": 181882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713076996, "uuid": "f7820956-b338-41d2-9b55-cacef700debb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076996, "uuid": "7dd19dc9-b0f0-488a-8a19-41c5c5c367a1", "value": "2c5d198a267e637387f80db707e19bc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa2c633-fa72-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713108142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108142, "uuid": "382a5d40-fa90-45d9-9e3b-7d6392b11e11", "comment": "Malware payload (Mirai)", "value": "057b10f629f37201d64782bca716436b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108142, "uuid": "78984c2d-0a3b-4bdb-abf7-67a1cfaf4544", "comment": "Malware payload (Mirai)", "value": "5f9f0955c0ca094e9a04222665a56c1fd91b22832da3f712d58336fc11ab53fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108142, "uuid": "a5839903-8326-411e-ac1e-722ac126c933", "comment": "Malware payload (Mirai)", "value": "cd97ce93a2e5aa474aef4305517783343ed25e6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108142, "uuid": "268ea02c-7c60-4004-9d90-2afa3172423f", "comment": "Malware payload (Mirai)", "value": "5ace20429825095367a287fbfc6f29b2c7b62f1ba2e14d3b08a04446155b1106b063f136447d4b431faadb9bf3ed5b8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108142, "uuid": "794b1cbe-079b-4c47-af8d-53e6045ca9f5", "value": "T1ABA3D706FF550FFBDCAFCD374AE9070525CCA90A12A93B367574D828B54A24B0AE3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108142, "uuid": "91834285-6c83-450b-b45c-823b7bee4438", "value": "1536:0CTVNyBTWIuKXty/7Ly43jSZdYq21RFGFgOUAqwKZqlzMHLZTJ3627VukOSiY:00VNyBj+P1XGFNYwKHjNukd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713108142, "uuid": "e597d18b-0cbb-4c8d-b019-01ddec453300", "value": 101476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713108142, "uuid": "e3a841fe-1dfb-4c98-9783-ba9acf0357b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108142, "uuid": "140ebcb7-6491-468c-a6a4-6461e705c7aa", "value": "057b10f629f37201d64782bca716436b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0872afa6-fa6e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713106099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106099, "uuid": "4e5de9c9-fd2b-43ac-88aa-bbdbb31fb630", "comment": "Malware payload (Mirai)", "value": "a883dcc98f339b7e2f2c61155c5eb088", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106099, "uuid": "90ad1366-dd2f-4fa0-a225-d2e7dc128100", "comment": "Malware payload (Mirai)", "value": "6236784bf892fe9bd8789aea40b4c5df027a83b229c33bc242d125660d18df6a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106099, "uuid": "ff7d5980-96b7-4504-949e-ae0b84ba5d3c", "comment": "Malware payload (Mirai)", "value": "c8f6af670b04c6477a94a64dd84e2c754e5804fe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106099, "uuid": "00b829cd-6ae8-40cb-8541-aae47388eaf4", "comment": "Malware payload (Mirai)", "value": "41676c8dc7524b7bf0984cddea506291215a54a164a8ec9e8bb08b4a491d916ef19d0af4949f2adbb04c1e0f317a3166", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106099, "uuid": "6f9098a8-7cd7-4bcc-93bb-9366574fd5ce", "value": "T14E144B07B5C580FDC4DAC1B44FDAB53ADD33B4AD5225B12B67D0AA225E9AE310F1EE40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106099, "uuid": "13ae7096-6ef5-4b21-afa5-f11ff214392f", "value": "3072:5T5iDtg8xB7SZtbdbuBkHo/J2JEG5LZwp8rUVTdm:5T5i68xB7SZtbTVVCTdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713106099, "uuid": "36fe27fd-2849-4474-aaa6-ed0adbf3a1e9", "value": 190544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713106099, "uuid": "9030aebe-43c5-43c8-aa03-280084333f09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106099, "uuid": "00905f22-8e4b-4a47-85a4-9631ce48dc9b", "value": "vlxx.x86_64-20240414-1448", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c23049-fa58-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713096940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096940, "uuid": "6387124d-d6cb-4127-8865-1d3fde89b245", "comment": "Malware payload (Mirai)", "value": "c54b0ca90e54f5967b0d395851e7faf5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096940, "uuid": "e4666c5b-8de8-483b-9176-1fa031c8b6af", "comment": "Malware payload (Mirai)", "value": "631df746d09c11dd3435c10af4094200602e9bb5a078bd439d9b52128a4afdff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096940, "uuid": "4f42550c-b947-40cd-84eb-9032040fa8c1", "comment": "Malware payload (Mirai)", "value": "66dd7264f675a671918f7be514afd3f5c9ca42a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096940, "uuid": "c66b11ab-e3a8-4321-8f2e-8621cc4278d9", "comment": "Malware payload (Mirai)", "value": "db03636cf27aac813be803c133750f05cb5047d210791108ed501d7c21e0122b9fffb23b623d625b0417de8d5f036a51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713096940, "uuid": "f1ea83d6-6939-4229-a885-2895acb32041", "value": "T1D0B35A13A5A05EE3C1415FB916FBDA380713F8114B232E72961D9BF80B07EDCB899766", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713096940, "uuid": "d39532ce-5f68-40fa-a7c6-db06b1c2a180", "value": "1536:7qr2so1s8dfC2bQnABssKTcdXF2oDRKk7bC4PsrlpT4Xm:KKs8dfVb9rK2FdF0rAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713096940, "uuid": "b893d238-9405-42ba-96a2-df82d52e0c75", "value": 109985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713096940, "uuid": "6dd19a14-0707-4dfd-abd5-593cba1753ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713096940, "uuid": "bd0663aa-6ee9-4522-8ceb-c845e64b3a20", "value": "c54b0ca90e54f5967b0d395851e7faf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0efd6d-fa2a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713076929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076929, "uuid": "f5084820-e61e-498c-9f60-34aa605fb93c", "comment": "Malware payload", "value": "9e64b65535e29ec152642d8bdcb22974", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076929, "uuid": "173f2389-638d-4c6b-bebb-43f1d4c0014c", "comment": "Malware payload", "value": "6586cb8766c14a87330bf6c79a7cbd7cbff3ca9da63574a9c348645117d08f14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076929, "uuid": "a1b74098-1362-46ea-b9ec-02e00d10415d", "comment": "Malware payload", "value": "5431aa7526ba193c0a92afffe2537bc54f51a0ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076929, "uuid": "b3c2fe53-31d2-4bab-a79b-9892fba9ba18", "comment": "Malware payload", "value": "d7debbc31a61bef5a03037a0ceeeaa87dc67cb50f0beb910cbd0bc022ccba6b8dbf791e846c534f26ae01d8723b3b63e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076929, "uuid": "5c6a50a7-cc97-40e1-b280-7802d9ae41e6", "value": "T11A152304255088B3DEB3B1F3BDA5C027837AC95D61B0BBCB07D13A9DBD16849D96E6C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076929, "uuid": "b018fc5a-7e02-436b-b869-19102bc31f8e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076929, "uuid": "a3d45ffd-4fbe-450f-8f2b-c570d83184bb", "value": "24576:cbSLx7bBqTC9oA414OYDsSyMZblh50gjuQk47blB7uFujRVeYr4c:GS79qK4cDs6q7QX7bl1u6LzMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713076929, "uuid": "3e33364d-31f1-4e8f-a1b5-a7753b05d742", "value": 961456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713076929, "uuid": "0234f9cf-7d30-433b-b9cc-378e9d80c903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076929, "uuid": "4d53d5f5-6ad2-4c58-ab17-5c50d636a9a6", "value": "9e64b65535e29ec152642d8bdcb22974", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65393c4-fa6c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713105504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105504, "uuid": "ea554864-b065-4733-a3f4-86151c3f340d", "comment": "Malware payload (Mirai)", "value": "65f514dc91004b97cf2d2932e21c5e91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105504, "uuid": "5e442ba6-1a52-4195-90f1-64ae31f8bb4d", "comment": "Malware payload (Mirai)", "value": "6683a33195a21fdead8ab04cb840f50ced9df3f318c87f117bba61adeef748d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105504, "uuid": "e5a4fe88-92e7-4cb7-9c92-2e488c2f0e6d", "comment": "Malware payload (Mirai)", "value": "746c0fd0cdd99a4e25602c0234ec52a29752f874", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105504, "uuid": "e952c3f1-ab08-437f-99b6-c738fd1fda77", "comment": "Malware payload (Mirai)", "value": "ac9e1fd5595335c8d4e7ca65faf964bd0e9876feb8680db26b21cf2ce6af9971e2718e012b2b1954fba5ffd4bc99131d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713105504, "uuid": "1c9545cb-9100-4495-ab15-bbe8b7f53f80", "value": "T1ED83E895B8C18E11C5D413BBF92E118D331267ACE2DFB2129D206F147BCA92F0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713105504, "uuid": "80f5a06a-ccdb-4d14-9e1e-60d5c9843063", "value": "1536:uRnabgUZLKq/zB8dAm5UhNTzeRGq1SM2b/cc7JTEi6N1nGKYw5e5e995nZ4cuIfN:VgYLp/t815YNPeUqoMS/ckJQpN9NL0aN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713105504, "uuid": "419add8b-79cc-4f3e-906e-c3b03a6b0ebf", "value": 83244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713105504, "uuid": "fe9ade9b-6c67-467c-8562-19aa0fbda784", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713105504, "uuid": "f86eb908-63a0-4988-9ef6-077498508a7f", "value": "65f514dc91004b97cf2d2932e21c5e91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4165d593-fa73-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.InstallCore)", "timestamp": 1713108342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108342, "uuid": "b2797025-5380-43d6-af31-9c1e07fdabb3", "comment": "Malware payload (Adware.InstallCore)", "value": "d7823c4d80e672c895d1d3ac8c17a4a8", "object_relation": "md5", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108342, "uuid": "76e586a6-fded-4f9a-a855-91857d9fe446", "comment": "Malware payload (Adware.InstallCore)", "value": "669f5c4216a77edde87c5d6de960d3808929597aa3ce6102a068ed351b3eb7e1", "object_relation": "sha256", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108342, "uuid": "5d7265eb-c73c-458b-9847-bb6d0d6258b1", "comment": "Malware payload (Adware.InstallCore)", "value": "9172c62cc94c602d0643b0d20fa1b614a3d87b84", "object_relation": "sha1", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108342, "uuid": "7cab29e3-a228-4bd4-bbde-919e494e14d6", "comment": "Malware payload (Adware.InstallCore)", "value": "c41e69927889386b957fb3e8962b8baba22194f81a0fe84ce57597a588f060867a9bd358ca2459ba8b686b9665578129", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108342, "uuid": "0efad7b2-4aed-4f84-8285-2b48f6dea125", "value": "T1AAF4232167A59671E4A2CCF48D1680268433FB2778BD54AE335C8DEEAF63701CD193E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108342, "uuid": "d3154965-5fdb-4c12-bf75-6440c166bc04", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108342, "uuid": "d516b92d-9fa2-4ccc-b288-f95fd8cb85c3", "value": "12288:AyIF5xruR6yTGEyk2gmAFY72ZIDe2zcA3GlgQ997d2hMfYC2ry:AyIDxruR6eGEynZ2ZD2tGlgQfdUMfYCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713108342, "uuid": "c4a67662-58de-4b7b-a08d-7f828a571582", "value": 747648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713108342, "uuid": "073f469c-9ba4-467d-9697-a60fc4078f84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108342, "uuid": "e13d2756-3b8d-40bf-a3ba-04e961bab498", "value": "SecuriteInfo.com.Trojan.Win32.Krypt.16834.10025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1387f53f-fa39-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713083354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713083354, "uuid": "cac4ba90-6b5f-461b-b411-781353e57283", "comment": "Malware payload", "value": "2d6ff89c09aa9c62270895c582de4f68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713083354, "uuid": "5a09ce0a-504b-4ad0-a681-356cc18161fe", "comment": "Malware payload", "value": "68ac5530196b3a92fe6574954e62dac0b98cbac6e746f9c170f00b88fa2c5421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713083354, "uuid": "5d30ee6e-63ad-402f-9a52-d668ff179131", "comment": "Malware payload", "value": "0d47c977a2f405ff42b2616447120e0e9754d6b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713083354, "uuid": "6d67a644-842a-44b9-bd5d-f4378f22c73a", "comment": "Malware payload", "value": "4d4f22d769aed9307a58c3bf423aae4ef9e12a4745c5d9dcc738c1a26c565f61680b3419d39afa9776acfa73edc6ddd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713083354, "uuid": "8a5a82a8-a233-4744-b767-53432b97ece9", "value": "T198C52302FAC595B2C533297355206F21EA39BC700FB68DDB8764985DCE721C0A739BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713083354, "uuid": "321e6c22-00d4-4588-849c-322ca5e510cf", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713083354, "uuid": "9167be98-2266-4b65-9137-287cd838c06b", "value": "49152:8ILeD0/jYaEGw8/nJs3qq3eLouWGvlHtfc+tpBSSmhSP48tywAX6:8nkwsiaVLiGvXjPD748t59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713083354, "uuid": "29284c2e-575c-4e23-8e73-a481c2fe1cc8", "value": 2673640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713083354, "uuid": "1c646982-e952-4ca4-a981-f769a959841d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713083354, "uuid": "ea090618-4354-4de0-93cf-470947ee43b5", "value": "SecuriteInfo.com.Trojan.MulDrop26.46365.21187.10518", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06095dab-fa6e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713106094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106094, "uuid": "a4548cb9-27a6-4029-a4b0-0190883a1191", "comment": "Malware payload (Mirai)", "value": "38d4ad7f158118878321d67465067ef5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106094, "uuid": "17c46d04-92c8-4ba9-9240-be08921b0e54", "comment": "Malware payload (Mirai)", "value": "69b440f66dec3de8ebbb1aae8ff1253e89a496a080809c68e4ad8af0fe88923f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106094, "uuid": "8467eadb-b68e-4c35-9977-a1b9ec4e101e", "comment": "Malware payload (Mirai)", "value": "fd8e487c55353a946f771e62f3702b925d837626", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106094, "uuid": "0dd11cfd-d354-4024-bf5c-02a10229bbe1", "comment": "Malware payload (Mirai)", "value": "38f0ccc3611220fac7fed0d5c4a44f4511f3fd24fae2ea2800aba76504a072b599bf10682938742af67e3cf479d46fe0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106094, "uuid": "67a0ed58-0984-4b80-a458-51ac2661bb74", "value": "T14AD32944F9814F17C6C212BBFB5D428D772A17E8D2EA71039D206FA1378B96B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106094, "uuid": "c6dacc87-495a-4c66-83e1-5dda9b7b7355", "value": "3072:kkLyj0HZd8QDi+7GjvmRm1FdsJFLsuYb0jjF5fBjx:Uj0HEQDmjvmR8sJpsul9Bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713106094, "uuid": "042a0e3c-11c4-4b43-849c-cb441c7a17b6", "value": 137448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713106094, "uuid": "368be0bb-5f03-4807-aea5-e37213e48dbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106094, "uuid": "0b923fff-d2ce-4935-8579-a93ec5ac767b", "value": "vlxx.arm-20240414-1448", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2afbe588-fa42-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713087259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087259, "uuid": "5459ad72-7ed1-43c6-8072-a0997c0967e8", "comment": "Malware payload (Mirai)", "value": "f4f5790868949a5a00ecaf216cb6d5c4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087259, "uuid": "fc3720fb-94cf-4589-98e4-dbe761ad5cd8", "comment": "Malware payload (Mirai)", "value": "6c254c561bc43529c80282fe1690bd49d53330da643bf4c7238e7b40d678bdac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087259, "uuid": "36292d3e-50dc-4ffc-8c0f-eff7cae0e43b", "comment": "Malware payload (Mirai)", "value": "7a0938bf31a25a79cd060b70678a7d82eeb5b61f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087259, "uuid": "b74c74e9-a8a7-431b-9208-a12c19dda240", "comment": "Malware payload (Mirai)", "value": "b94e49dec9cfdf24ad59872fd739ea62ad8c0bd16e796ef3dab2adec42233fc7f91a0f4d3dfcdd501bc29692be8fc366", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087259, "uuid": "602846cf-f689-47d6-9d77-32bbf09caa5f", "value": "T10C04971E6A228F7DF6A8873047F74E24976D23D617E1D680E1ACC5105F6039E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087259, "uuid": "e6ac68bd-3245-460f-bde6-ca655b3ca115", "value": "3072:uTOy+1dRVBk6/yYZPtnvsrM36NidLPcpJ69:uTOJFaY5Zbczg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713087259, "uuid": "4f4fffa0-1435-4931-a448-e529d1b13abe", "value": 189684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713087259, "uuid": "024d5fa5-c797-488f-a009-8574e440d396", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087259, "uuid": "d9f19c3b-3017-42ef-8cf2-5a8d06b9952f", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a8b07b-faaf-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713134310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713134310, "uuid": "28d8a391-1225-4b80-89a2-8f8d3ad1e115", "comment": "Malware payload (Mirai)", "value": "40bf28d2f7ed2d9bd4826019cd1c3f77", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713134310, "uuid": "84d740f4-00d6-4f24-a95f-404b5560cb4c", "comment": "Malware payload (Mirai)", "value": "6c2875cfff00126cc06412abf1c5d95bc392a1bef03e0fd5fa412a7566e32e22", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713134310, "uuid": "a9546424-7098-469e-ae60-d6239eec7871", "comment": "Malware payload (Mirai)", "value": "03c3ea83b2919cabc4ac519818e735dfcb8206d6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713134310, "uuid": "bfef7e2a-f1b8-4803-bf69-b044af333373", "comment": "Malware payload (Mirai)", "value": "3e3fc2a39fdbeefecbda41a0604a11069998f0b836a4b5ff5713e5d71464bfb12b236033a150deb5a7c33a6a0a444f78", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713134310, "uuid": "3d2ba92f-a7a3-4a43-ad31-c701b52f34e6", "value": "T1FE146C87E763D9BBC44A0779069F97354637E8A1031F4B02E35CAEF42E53682F585B0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713134310, "uuid": "4e81c9bc-6def-4aa3-851a-afbd9ed4005c", "value": "3072:ADGCDJMlDolOleFJ0YvhGZnYtbagCvPvwHVByqqTWXKO:nCGolOlAJ0YMZnYtbagCvPYHvWzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713134310, "uuid": "925e792c-3273-4049-933a-5066397817f1", "value": 191960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713134310, "uuid": "cc77b92a-b80e-42d7-91f1-5c650c401fb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713134310, "uuid": "59a66a45-c698-4493-b147-b7f584b86a27", "value": "bot.x86-20240414-2238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53e3460-fa72-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713108187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108187, "uuid": "d7a9fa1a-3dd2-4a39-9e72-64d323315d7e", "comment": "Malware payload (Mirai)", "value": "a3faf530b5206a3dc8175c8e1dc48685", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108187, "uuid": "e003a7d0-4608-4579-94f9-f8dee32a6a2e", "comment": "Malware payload (Mirai)", "value": "6c549fa9adf44e00b6e551dd6192d722f31ae0725a4b4fe1bfb82e5b0d016809", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108187, "uuid": "d2bf6896-7d9d-46c5-bc7e-7b950311c129", "comment": "Malware payload (Mirai)", "value": "dbe359a3333abc9c3e79d48d9830b761716fc81f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108187, "uuid": "3802b3a6-b414-41da-9715-919c4f86a35f", "comment": "Malware payload (Mirai)", "value": "6d875c7071053290440b4894d0262f2bd94250fee77f9ddeaff45298cfff47a380617f2bde27fbe189d43bff7ff5d961", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108187, "uuid": "d80593e3-7467-4675-81a1-e2fcabf51442", "value": "T1F5733A91FD829613C6D012BBFB5E418D372A13A8D3EE72079E256F20378785B0E77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108187, "uuid": "cd1830d4-4310-4db8-8c4c-d3fcc46af192", "value": "1536:8GcEk0+/kGoDDBKhjErbwlONGR5znoyhI6SiG:8GcSRMjEPsRnxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713108187, "uuid": "f6bc81a1-04f2-4944-ab0f-4c674476a138", "value": 75268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713108187, "uuid": "d025b0fb-a30d-4384-b30d-0c60f7f1c24b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108187, "uuid": "36a76771-bc67-46d7-a311-9da33dabb7d8", "value": "a3faf530b5206a3dc8175c8e1dc48685", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1473ec-fa2a-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713076924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076924, "uuid": "5af2c28f-41a6-4da1-90cc-58b70a55b0d1", "comment": "Malware payload (RemcosRAT)", "value": "7b09badef23e3d04c5d107da04b81137", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076924, "uuid": "4c26c8b7-f761-4fba-8e7e-06561da63f6e", "comment": "Malware payload (RemcosRAT)", "value": "6ff6433519fec801ae178d5562fb7b2475b3df3566b30ff73683f97d0282e291", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076924, "uuid": "911f9bfd-1371-4dd1-b4f2-9afbd441359f", "comment": "Malware payload (RemcosRAT)", "value": "f80d2646d8fd8da36aadd66ef4462e24edb1452d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076924, "uuid": "56baf491-90cf-4004-85df-0fb9672fd7b6", "comment": "Malware payload (RemcosRAT)", "value": "f04ab10a69811b32d18941e40951ec57745eb784cc0309681b933ee0390f80c49545d50b86ecd3221c96b1f63e4529cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076924, "uuid": "4993dc3e-17b3-46f2-bc45-10a013f0accd", "value": "T10BB49E01BAD1C072D57524300D36F776EAB8BD2028364A7BB3D61D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076924, "uuid": "75525c52-88f3-41ee-8927-e8f7f486b569", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076924, "uuid": "8af61eed-7359-42f1-a2af-3ee2cd5b1f83", "value": "6144:aXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNl5Gv:aX7tPMK8ctGe4Dzl4h2QnuPs/ZDAcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713076924, "uuid": "04b44127-81d8-4ebf-bca1-a01d45b5105f", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713076924, "uuid": "cd06fa75-fafc-490a-85b0-eb9d376adf09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076924, "uuid": "1821cda4-daee-4d41-b9e9-0cc66ddf2e05", "value": "7b09badef23e3d04c5d107da04b81137", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0bc925-fa7d-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1713112815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713112815, "uuid": "01d83455-2297-463a-b32e-fa259ae2c3c9", "comment": "Malware payload (RedLineStealer)", "value": "66b2fe6065c9cb69baa4e263a0d19c4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713112815, "uuid": "59dd54cf-d9b8-4489-b875-709106a44e72", "comment": "Malware payload (RedLineStealer)", "value": "7047f033fcf8a32d52e47569e8c9768905eb4a588bbfb4582ae31c6ade0f7dda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713112815, "uuid": "7d1e2623-9683-4a16-9f40-67465017ab69", "comment": "Malware payload (RedLineStealer)", "value": "cb1d74c1de469a815a777f26d8150f636c689f52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713112815, "uuid": "85a09bd6-5b14-47c7-8555-ab12eca0f12c", "comment": "Malware payload (RedLineStealer)", "value": "b8310608677f4006688aa43f002e6c78792a8a2878a24cce202ce6c0e041b0934fbcd1c56a2ce9c163f72ad61636c95a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713112815, "uuid": "3e413a00-aedd-4a3b-882a-2f44c3b79fac", "value": "T173A35D3067AC9F19EAFD1B74B4B2012043F0E48A9091FB4A4DC154E61FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713112815, "uuid": "1b2fceb0-8fdb-4fab-99b7-062dec677bb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713112815, "uuid": "b5b6c988-19be-4ea2-b6f4-4c4c92efe32c", "value": "1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed273tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713112815, "uuid": "a105045c-d8a0-4459-a1ad-66bf6c701216", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713112815, "uuid": "591b3ebc-c9ab-406c-81f6-e1e2d7aae08e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713112815, "uuid": "49a8e34c-19ed-4705-8044-599bad79a17d", "value": "66B2FE6065C9CB69BAA4E263A0D19C4B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4ce8dc-fa6e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713106214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106214, "uuid": "340d338a-247a-4df7-88da-c4354bdb6f59", "comment": "Malware payload (Mirai)", "value": "311d3001c1b3cc5526ea51e9aca95c44", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106214, "uuid": "c94483bb-146c-4eb9-9e91-029c0226c4a6", "comment": "Malware payload (Mirai)", "value": "72096bf811303bcea7565b7ddaaa861734857046efc56613b908f31d48c52ab4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106214, "uuid": "4a6b319f-23ec-4e00-87bf-c2b2955a4419", "comment": "Malware payload (Mirai)", "value": "5be1f08f17c17b4911de1764d3aa8716312bb1c8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106214, "uuid": "421bd2c7-6ffb-45fe-b3ee-35e56abe471b", "comment": "Malware payload (Mirai)", "value": "8a5e40c7e57b8e240024eeadc2159ec1177bbcec25de4b61120301692a1c8aa2f4012d1756182887486a3032eb2d1f09", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106214, "uuid": "56688632-f3a0-4543-a863-e2f95905a1c9", "value": "T18A53F886B891CA57C6D462BBFA5E42CD332523E8D1EF7207DD116F153B8A82F0D6B241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106214, "uuid": "44be04ca-f3c6-4ccd-9415-71d0b4b28eda", "value": "1536:76orQzBizA/SLq7sLWsFdRjtyWZnninGH8sR:76ok8LWUdJ35inQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713106214, "uuid": "edcbbad4-8625-4cd2-9584-e4737c39f9c0", "value": 63680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713106214, "uuid": "7e64a8cb-749d-438c-a1a7-b050a3d2124d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106214, "uuid": "3d589339-18e3-41bb-856b-752eba53f7a3", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1f2352-fa71-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1713107715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713107715, "uuid": "cb1461f9-3320-4377-8b85-66850caf1781", "comment": "Malware payload (DCRat)", "value": "55d83c0ff46e21f4a2f4f95f7d8f6c84", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713107715, "uuid": "b397aba3-1cdf-4ddc-a7ff-5ebbcdb7781b", "comment": "Malware payload (DCRat)", "value": "75518cae4d7cce44765d6e4be6406f1431f02700ccf5e0680fded1ca3ba1c51f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713107715, "uuid": "356a1f9c-ab67-43d9-9e0f-d5317b47d1e0", "comment": "Malware payload (DCRat)", "value": "3918bdc012c2ea901ff74d4015427ed8dfe2928e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713107715, "uuid": "067471f1-e6c6-421e-a2d4-a453c3176866", "comment": "Malware payload (DCRat)", "value": "05cf9f77108aeb7a7c559e026844f0f1071d2ca24f3c0eab99eb49df03ba0c2d7b22889f2fab5dbd76cae1101f15c787", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713107715, "uuid": "90cdd684-09d6-4995-b8e5-dc2830ed0065", "value": "T160758C1AA6624E73E7E63F7584EB443D82B0C7667913EF0B351F6191BA062218E135F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713107715, "uuid": "7548f9fb-f08e-4ead-bf30-cf152378fed8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713107715, "uuid": "86520a7c-e0fa-411e-8449-801b76ccaeff", "value": "24576:angZnPX/+XrQAHuv9RjrVhmbqeO7fcUv0Jihfkl6XG9phR:aDXrtuv9HhpeogY62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713107715, "uuid": "1e1cce49-34ed-4d74-95a4-3112d15a9b46", "value": 1656832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713107715, "uuid": "2c9d88aa-3814-4282-b934-d5a0928c526e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713107715, "uuid": "9c21dfbb-3201-4af0-a439-d9b5585650f1", "value": "55D83C0FF46E21F4A2F4F95F7D8F6C84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750f9fc8-fab5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713136775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136775, "uuid": "e0b1288b-d73c-4d3b-85e6-251a253771ec", "comment": "Malware payload (Mirai)", "value": "b00f906e2faa78573a191893bf39b2b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136775, "uuid": "a4a64928-7838-46bd-a961-cd2643260d27", "comment": "Malware payload (Mirai)", "value": "79f9022c593599c8b760848489b4f3144347830b6d5abd6b81fbb58a62dc371c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136775, "uuid": "92cc1ce3-e870-420a-8abe-4514e07b4150", "comment": "Malware payload (Mirai)", "value": "ab766410e07542d386da0335236e272eef96ae6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136775, "uuid": "83805d29-d00c-40d0-b76c-d02f7056cfad", "comment": "Malware payload (Mirai)", "value": "daf3c13482005b71223c317865d02dd10e4ca1353953f64352965905023e317a6124ca5d2475accc7e20146a784b200e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136775, "uuid": "895daa4f-d2c4-420e-9b3d-fced8bafd152", "value": "T1BB631B95B980AB25C6C1167BFE0F114A33138B6CE3DE73139D285B7077CB96B0E2A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136775, "uuid": "59cd1817-3f34-4dab-8e8d-2992351b3442", "value": "1536:8Incy79JVixa/MdQdMsiTJbLdOYoe5PY/D:J9JkxaUJbLdOYoe9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713136775, "uuid": "f794fbc2-33be-4f63-9613-6a14d20800fb", "value": 71156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713136775, "uuid": "8d2f0ed6-99f2-4c9a-aa3b-e111aea919d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136775, "uuid": "750e66c0-7c1a-420e-b503-6ccf70dadfa9", "value": "b00f906e2faa78573a191893bf39b2b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dededeb2-fa80-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713114189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114189, "uuid": "7b420636-5907-4824-b180-2a9dbe239f00", "comment": "Malware payload (Mirai)", "value": "e9fd7c306b2e3e3a38d03768802d58e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114189, "uuid": "fd637809-c819-4268-940d-90f0be85c4b1", "comment": "Malware payload (Mirai)", "value": "7a13a55c15ab8a1580e2cf31090466eb4eb69103d95c42b76af52894c871ab87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114189, "uuid": "b1d67321-1cb2-4ed6-91f3-ac55e5ddf49e", "comment": "Malware payload (Mirai)", "value": "fdac2696df35bbf5edbac59585f5d5fafc08a30c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114189, "uuid": "0ad8c26f-fff8-4293-8999-c59b10c57f6d", "comment": "Malware payload (Mirai)", "value": "23df52b0c30ac30f20528b1467e9ef898778ecf689571a4076ff3d25e251e59092e03a8abbbaeb0826cd8c05c28bc6b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114189, "uuid": "be17d81f-590a-41a5-a57f-4efe3d096c51", "value": "T179834D85E263C9B3C5C71BB401E7DB360931F8E6175D9F06E36CAFF46E02685B089649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114189, "uuid": "4f1c80ff-adbf-4c17-8b65-61b1a0125bde", "value": "1536:z35HxOXWxqo71AxFZXvX8k4KSJCYnKzFT:zJHxOXWaFVMFTCYnKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713114189, "uuid": "e38b7c4f-1cca-4760-a6e1-6ffdb0eb3900", "value": 84170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713114189, "uuid": "338d146b-c3dc-4fc1-831c-aecef19731d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114189, "uuid": "48d46c8e-33f0-4fd0-bf64-3b4950c020fd", "value": "e9fd7c306b2e3e3a38d03768802d58e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8b8d7e-fa42-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713087239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087239, "uuid": "4774afb1-cdf5-4ea3-a46a-acb5ee8eb28f", "comment": "Malware payload (Mirai)", "value": "ae439285226cddf599347ef2bf84e846", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087239, "uuid": "9e1ba07e-83e4-4a41-a3a2-d6c6c0dad291", "comment": "Malware payload (Mirai)", "value": "7b9aec27551f2d7b7ec65802b8330a12b114ac441659200648a65bea6c987a13", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087239, "uuid": "7503e3a1-f108-4755-aeda-00b46a059e3c", "comment": "Malware payload (Mirai)", "value": "ea2bb5c6f42bcba685effe50aa9cac727c74ce07", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087239, "uuid": "7db80c4e-9885-4e5c-bf14-8383b409dc6f", "comment": "Malware payload (Mirai)", "value": "e120e92d9ab0b4c465a25bf0bbe4805c07a4c9a073fbcc604833726f7026e00afc93f1f5c5f5fbff6e55018245bb4d0c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087239, "uuid": "56c03a1e-9c88-4254-a9f2-661790ec0a36", "value": "T1AD147C86E762D9BBC44B077906EBA7354637E4A2031F4B02E31CAEF46D53291F585F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087239, "uuid": "96850b0c-20f7-41ca-8b46-ebfb23ddd069", "value": "3072:UpGYXPlyQylu1zXMA2R4TnEjbaEcCvPvyHVByqqJEy:VYNylu1zXMANnEjbaBCvP6Hv8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713087239, "uuid": "026b000d-5f81-4fd1-a3c6-1cc134cd213f", "value": 191979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713087239, "uuid": "61f04960-72c0-42c8-9def-585579d243e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087239, "uuid": "b0279835-264f-4966-aa4a-d0c63da57a10", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0704294-fa9c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713126218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126218, "uuid": "8ad96c80-c6c3-4c46-885c-00b1ffa630a6", "comment": "Malware payload", "value": "063ec8d45b4eaedce1af70ca160db447", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126218, "uuid": "1a16b974-d869-4222-a840-f53761768de0", "comment": "Malware payload", "value": "7dd245dd604fe8283fc92e44922ffda2e2982ce509ea92450ca9056b82914b53", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126218, "uuid": "9f52eabf-8e87-4ed1-b096-339c656f0902", "comment": "Malware payload", "value": "5ae61faa2352767f20515d43ac551a8df50abeed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126218, "uuid": "251db660-48f0-4c3e-8069-910883175dd4", "comment": "Malware payload", "value": "6543070425ddbdbef96efe713592c4dfe3aefc242596b5c8a2a185c3537888d4a87b4d8c3231fd78e0e840f9baf57a9c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713126218, "uuid": "1789af08-c497-4aa3-b4f1-d97bb70b2ce9", "value": "T15FF30946F8819F15D5D255BEFF0E128E33231B78E3DE72029D246B207B8A86B0E7A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713126218, "uuid": "c3a7d3ac-eb01-465a-bbc7-52ab0ab563d9", "value": "3072:/F1LOeFRWHUhBdfTf3BHdGTaY1/xo0r6UOG4xDq72Ve:/F1LKHWjTfxHaaY1RrrAxDqwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713126218, "uuid": "bebe52ca-e6aa-4ad2-9a06-ffbcb38e8af0", "value": 160924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713126218, "uuid": "b29d847c-69c2-4c29-a44b-17c201674b84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713126218, "uuid": "e1fb26f5-60eb-487e-bc9b-1b5e49bbe63e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127cc734-f9f4-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713053717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713053717, "uuid": "a8af5d78-7514-48b1-86dc-eb438d54ca6c", "comment": "Malware payload (RiseProStealer)", "value": "fbfba294945d60c8dd9aa356d6f4dc33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713053717, "uuid": "2dae026d-07ad-4d64-b00e-f8747be20acc", "comment": "Malware payload (RiseProStealer)", "value": "7ec59a4d8e6a325f3fdf505b034d7ccf0fe6633a959052d940bbd9c79c65b0f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713053717, "uuid": "aeb90e19-939c-4ffb-8dd1-119d33690d2b", "comment": "Malware payload (RiseProStealer)", "value": "dbd604e3cb5ac1ff1fb83bb858de842efa24cb32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713053717, "uuid": "00c79a03-a7c5-4f91-a283-f9cc6e89e959", "comment": "Malware payload (RiseProStealer)", "value": "3aa93f7235849d98b4f93fd5324431223d83f5da7595922a0d5506f8cbebc714d441fd2a60dcbc341381a80df6304c34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713053717, "uuid": "f650e73b-314e-49e0-bead-6f60dcb78e8c", "value": "T143A533B82D61736DE5A88F3042DFC00EB7D07542897AA56CB54A3EB3368F12B570E785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713053717, "uuid": "3c4b7da1-4fd2-4726-9039-e898ad407b51", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713053717, "uuid": "38a97e23-a3dd-4dbb-a10c-40e1b9e547d4", "value": "49152:SSUl6vD5DxN6HHLJ9tWiJvtlUwIFZgFJsiSWiKN3FBp/Z:SSSwD5DxkUsvMwQKFJsKNjpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713053717, "uuid": "ce95d3a4-56c4-4aff-9d92-dd58fc62184c", "value": 2237952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713053717, "uuid": "c6d0b39d-28cf-499a-8b18-05004cbf1b7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713053717, "uuid": "8ca8f72e-2a1b-4308-8e43-d79f02dba5da", "value": "fbfba294945d60c8dd9aa356d6f4dc33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d423a4-fa80-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713114179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114179, "uuid": "391fcced-a182-451a-abb8-c5b63a4eec14", "comment": "Malware payload (Mirai)", "value": "dadff9734cc6fa17a8a48cdf09541413", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114179, "uuid": "6def0e53-2c84-445d-9f27-3e66675af603", "comment": "Malware payload (Mirai)", "value": "7ff61fbeaf732ba6c9cb59fe62afc366ff7b6973cb346b81e7d01317e9c5c498", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114179, "uuid": "749324dd-4ba1-4687-a92c-42f1e57602d0", "comment": "Malware payload (Mirai)", "value": "ab48d16e36b55900f0bef5c95b4e5abf424ebbd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114179, "uuid": "c67c44b7-e264-44c9-a697-0ae7bfed1d15", "comment": "Malware payload (Mirai)", "value": "c3d58f3d5447c281217f849ef352b80b1b2fd2258ad95949f838253d59c2fff14c4bc3986f343c123398089b8b1713d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114179, "uuid": "75c2ff29-4456-4b67-8135-b6ac21e7d0b4", "value": "T13FF2E1F0F13A28E5C6A01C3FDEA9C1865F1E0E79E51971BA632579BC17D14825BB6082", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114179, "uuid": "47f5c779-fc81-4764-b18d-9b4957351d39", "value": "768:/WaZaZqJH0UNLIfJIVRCFjWxV77j+bEvBLeHgXTKOv9q3UELX:/Wa8ZqK2kfJInCFjG16QeHgXTKLLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713114179, "uuid": "865aaf30-2fad-42f9-881c-4b1b41d31bb0", "value": 36884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713114179, "uuid": "b71cefdc-a841-4a33-95fb-ac5350b11ed1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114179, "uuid": "aab1c1a7-4b61-412d-9a90-94b6259ea5a2", "value": "dadff9734cc6fa17a8a48cdf09541413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e572cbb5-fa65-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713102604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713102604, "uuid": "710addfd-f786-4edf-b195-ad5bc9d97966", "comment": "Malware payload (Mirai)", "value": "368bd734d0a594ca77aaa0aa0a4c8bf6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713102604, "uuid": "1713dfc6-b4ac-4909-afac-e6ae500f6843", "comment": "Malware payload (Mirai)", "value": "809b71c2361a78626d96f1bdc7715d7862b5695649c40587efdd7941103bca93", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713102604, "uuid": "1d242603-9b79-4116-8d4d-1d3d9a94b866", "comment": "Malware payload (Mirai)", "value": "5a7730fa1c456dffe353919d70ba3059c38c3749", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713102604, "uuid": "04ce4cfc-97f4-4f27-b2b4-c3ab42ac393a", "comment": "Malware payload (Mirai)", "value": "d670ebee33eda1ddba0a146e9465dd2d4feac4dbd0af962a00a54f792d4b37b18e54b86578351c122ace36996d673fde", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713102604, "uuid": "69e8d503-8245-4ba5-a5c5-c6cc221e4644", "value": "T1825339C1A983DCF2DD1146B83177FF328636F436212AE9E7D7D9A923AC81E41910729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713102604, "uuid": "adfd9887-4f67-4379-9f7e-3ba2bc6197b4", "value": "1536:VMzVhePhrkmetvEuckIzN/hkfgiu5BzZsYmrpY8+3UoBiAGpTLE:VMzVhePlkmetvBcxJhyu5BdyrpE1oAGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713102604, "uuid": "bfb190f2-3aa8-4edb-a7d6-4249e0852bac", "value": 62224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713102604, "uuid": "c69feae2-4efc-452d-a313-5e9055843b4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713102604, "uuid": "32fcfdfe-5601-4f98-b80b-88344b84217d", "value": "vcimanagement.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a895f639-fa30-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713079738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713079738, "uuid": "1789d970-5895-4783-8903-4e38eb044b14", "comment": "Malware payload", "value": "27b212f4b39ab8df37740e1210cff567", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713079738, "uuid": "5474c6fe-1f64-4775-aa6e-3af8c781c530", "comment": "Malware payload", "value": "815860603908ef0ee15c454c848cd883fecd047ee747369ebb8f1f42431fbf47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713079738, "uuid": "9a874490-0e5d-4518-b93e-2e580a1053c6", "comment": "Malware payload", "value": "44dd266103699aa2e4f8237af1d0d90ab7c6e480", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713079738, "uuid": "c781183e-8462-41df-bf43-0dbb49802cbc", "comment": "Malware payload", "value": "85cb9b96640d24a104ceb2c080e0f98105254a239cc28376f027a4affeda19255fcca681c2986a488ffe67582cccae4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713079738, "uuid": "e356579d-20af-4379-9019-05629a295df8", "value": "T1A5321A4BFB8588FAE369023CC877094EE075B215931253CB2B7C415A2F667D165352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713079738, "uuid": "c832e46f-a3e9-4116-8faf-99e5886736bb", "value": "2788c1b2b13fe2b0d0cef6a8230fea39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713079738, "uuid": "f3286d90-6c20-40c7-a4c3-899f970430ea", "value": "96:12EQi13GU1ghTFm7eJaL+cd1usPemUt6/92ZpfXfTylxPxm73Q5tfMcXW5+qxX:VQuj2mf+6UtjTXLybc3Q5tfMcG5+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713079738, "uuid": "a9fb07be-e169-4e3d-9c4c-53020719f99b", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713079738, "uuid": "821b6bfb-9917-4f08-a5f7-463783eb0805", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713079738, "uuid": "bbebce8d-ec7c-4779-8599-8018010336e1", "value": "SecuriteInfo.com.FileRepMalware.32201.1547", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be68c3d-fa44-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713088280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713088280, "uuid": "0944268d-2bda-4524-bbdb-c0fee1a5ab0d", "comment": "Malware payload (Mirai)", "value": "164cc773e135485888b71e1be90198ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713088280, "uuid": "b279cec1-8c52-446c-a670-47c0e78a9332", "comment": "Malware payload (Mirai)", "value": "81dd6e07af69176601f77945bc76ca3bbc23df271c261f44c5852bf28b147836", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713088280, "uuid": "ae8dab21-7fe4-461c-b54a-9e32d7296795", "comment": "Malware payload (Mirai)", "value": "039160de13c593c4b883b7851ef30ee7716bd10e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713088280, "uuid": "a7d82ef9-69d6-4ab2-b00c-055e6976d4fe", "comment": "Malware payload (Mirai)", "value": "9d150419a1a163db828a074c908e38e9a7851110af632a8de8a276905b70078a902f2783f00ec4dad02957806e7051a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713088280, "uuid": "36b92f00-2795-425e-82de-319104caf60a", "value": "T1B9C36DB2DC192FA8D164D9B4B4B88FB81B53A58541572FBA69BBC3740087D8DF500BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713088280, "uuid": "2c8d9dd6-0f78-46be-aa8c-015da4da3244", "value": "3072:Am9Mxs30J0sYULqfKzYPvSAEkHk7V9FzHpqJ:JKQ0IULqqkH4PzHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713088280, "uuid": "a583c7d0-9836-48fa-b6c3-18c42a2a7b5a", "value": 121828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713088280, "uuid": "7071149f-1b09-4197-9aec-2ca6d3838039", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713088280, "uuid": "846c9858-756a-4a67-a8b0-f19e3915f25e", "value": "164cc773e135485888b71e1be90198ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d84279c-fa2a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713076982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076982, "uuid": "4df87e8d-e7b0-4d5a-863a-7720c2e230c3", "comment": "Malware payload (Mirai)", "value": "033efbfe051cb94e4709a8f06d4b9d49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076982, "uuid": "72c9b851-8d8d-492a-b422-788f743ffccb", "comment": "Malware payload (Mirai)", "value": "83c8015f6922680f80fcc8ec0c4eb12f570af7129b75d7873b0750a4a785b1e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076982, "uuid": "cd4a51c9-6b2f-489e-8501-062a3816ef0f", "comment": "Malware payload (Mirai)", "value": "819e63aba9718ff5288af70f446a817696d51ab2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076982, "uuid": "6cf2a7ec-6b98-4d46-a24d-a7b4d963de84", "comment": "Malware payload (Mirai)", "value": "eba5c50e5fb22261fb46c3431c10fc9395a697b3cd8c56b71dd2e47b9052e145b8b37388645d15d78c42b9f5b6319e14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076982, "uuid": "96040980-ff67-4919-96ec-967e8461f5fe", "value": "T17DE3C63727270A23C0D6507001E79333AEB5CFC735B85297AA907E586F3AA943497BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076982, "uuid": "3e06ffad-ecda-4f7c-9c5c-bbd73be941c2", "value": "3072:YS0V9NJl9FGNjTp+YQqRgq9Db1m4wAxxiNu:aV97lGlBQjw1m4wAxxiNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713076982, "uuid": "03c393aa-fa85-440e-bf8f-64a412559bf4", "value": 154504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713076982, "uuid": "bf104a2b-e313-419a-b579-c9950408eb77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076982, "uuid": "85b518ff-ee0b-4b57-b344-45bc8a8c7d0e", "value": "033efbfe051cb94e4709a8f06d4b9d49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0623bc88-fa80-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713113826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713113826, "uuid": "e2d3e541-06cd-4193-8b2f-52725a9cb384", "comment": "Malware payload (Mirai)", "value": "9ad3068cdf89e723d9a71ee3eb7face4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713113826, "uuid": "1528e532-c682-4da9-88a8-e701518c3a43", "comment": "Malware payload (Mirai)", "value": "860665faee0749619060c1fe3b819c4ca0f41354c4fae71c2c3dab2ff1f6d8d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713113826, "uuid": "a87d6774-8aae-41ca-8553-39599dab4fde", "comment": "Malware payload (Mirai)", "value": "f94040f14a907c4d684d99a970e61be0426a18d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713113826, "uuid": "c6d570f7-ce9a-4e2a-8a40-6a26b380e9f4", "comment": "Malware payload (Mirai)", "value": "172ecd7d76bada5d16e5602d87d44404a0c5c83374445d57241e4c5c10e5fa0f98d6d74c88411d9d2413dba7fce70afb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713113826, "uuid": "d6766cc1-2ed5-48f6-88f9-8039be92b159", "value": "T122835B3176762F17C0E4A07960FB4B56B2F92BC921A8C61F3E720E9EBF5552035139B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713113826, "uuid": "ba92b835-37ed-4992-8cf2-274251b9f040", "value": "1536:WTJ2ZysZb2kZo0wBFZTNpjNXypcrkdkQ0ldA2876tBS+Q6QW:W8wr5N+dMl46KdHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713113826, "uuid": "0a22e656-d3fa-4444-96d8-eb55bd1a2fdd", "value": 83364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713113826, "uuid": "9b8fd7b1-d945-4873-a52e-10eb3dd1eaee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713113826, "uuid": "4f5012a2-c5e9-4322-8ccb-557d009873b6", "value": "9ad3068cdf89e723d9a71ee3eb7face4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf2b64b-fa01-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1713059423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059423, "uuid": "d439e22b-0291-48df-9fc7-26ec6be77d31", "comment": "Malware payload (DCRat)", "value": "e9575bd1e6e0e4e3d56972519bd90042", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059423, "uuid": "62f100d3-693b-4a72-b6f5-a4553a62a240", "comment": "Malware payload (DCRat)", "value": "8783013bdbb0b9d9093b06792388a23adf9e6a2a1749b767fbe5110dc0eb0bc3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059423, "uuid": "ff19625b-b7c6-46be-b692-3ab86f7482bb", "comment": "Malware payload (DCRat)", "value": "d97c8067efcd5089e64577b089cd9a00468600c2", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059423, "uuid": "4de0e549-bce2-42c2-a717-3626601796a7", "comment": "Malware payload (DCRat)", "value": "4a8f9ea7fe0aae0ebd87ccd59662bf4e7ec5d5c886cff3ab1d01ae4c5cb15b792b4e1ab43294e176b7ac8316b9a53e68", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713059423, "uuid": "2645fa2d-fe17-4823-a423-3dc80892c379", "value": "T1C305F6117E68CE12F0091273C2EF454847B4AD516AA6E32BBDBA377E15123977C0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713059423, "uuid": "cd95bcbc-4c7c-4658-a4da-db82b0af3374", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713059423, "uuid": "e87242d9-535f-4fdb-9767-c84d796354b1", "value": "12288:80y+wPdjyQBiZ+BuvGq+yIYB2RWFVJRzu2J8+281dYEq:8lIQEZ+y+yIYB26cd+PdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713059423, "uuid": "6ce3845b-6647-4323-9857-e8015c72c421", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713059423, "uuid": "4630c0a3-c7ac-462a-a9ca-7c8dc3565d14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713059423, "uuid": "8760badc-6477-4631-96b3-946178e12e08", "value": "8783013BDBB0B9D9093B06792388A23ADF9E6A2A1749B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372ae985-fa0e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713064945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713064945, "uuid": "ae4f881c-e088-4487-b2d8-d38761f587c6", "comment": "Malware payload", "value": "124a0bb858fbb3c0f9caf8a33be264de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713064945, "uuid": "fcffecb8-103c-465d-b1e3-fc87be1ede0b", "comment": "Malware payload", "value": "8856e046939f61c7293626378f4660aa3395e3b5c0125bb666e7d25d6b992339", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713064945, "uuid": "10ee336e-a053-4bee-9bb0-662dd3b94051", "comment": "Malware payload", "value": "80c48c2f04633fe9eee3908ed02bce91edbb07a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713064945, "uuid": "3c5a6978-32fd-422e-a904-a42743a89e5a", "comment": "Malware payload", "value": "f5551fe0f42ee7849ceef56e2e85d8349e54b8ebdf3dcef595fcd9b3ac5f43876adc5796e496d3c2fcaab5f2f4ddfdea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713064945, "uuid": "133b91d2-295f-4488-b98b-f13e3a9393c9", "value": "T1BBF49E1275D1C072C2732130AAB9EB7156ADFC324A354687B3883A696F742F26E34777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713064945, "uuid": "dcba8717-fffa-4c79-a729-a5db23e39c9c", "value": "213e0a4928f644955b6c40c3acf835d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713064945, "uuid": "b66bd62a-7702-46ae-a033-8a007e189760", "value": "12288:QNp51L0Z775xs2qnf8PtVXJSLKlK4pKJe5d0nocsxa3k48118t/HY4EErtkTd2h9:WJL0Z/mnet60yocssl8gY4hkTd2hCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713064945, "uuid": "32b08d36-c266-48bf-8a23-57774dbd851f", "value": 790064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713064945, "uuid": "ab924a88-6b6e-4993-a0f2-5ad12842889c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713064945, "uuid": "bcb57663-f474-46ec-9d54-8af9dca2eb74", "value": "SecuriteInfo.com.Trojan.Siggen20.44774.21220.14380", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a151c3b-fa6e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713106101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106101, "uuid": "40663741-4ec2-4436-8601-430647f3c5ff", "comment": "Malware payload (Mirai)", "value": "2586e46ae4dc0bd3f887ecf8d4bb3785", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106101, "uuid": "e01be7c6-3226-46eb-b23c-dded6d54c1ca", "comment": "Malware payload (Mirai)", "value": "893f3cb31437d84db8a7c67f4efcfcf66e531d850923f87d712db3b81d4261eb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106101, "uuid": "f2753d7a-7f62-45b3-8f4f-2297a5619714", "comment": "Malware payload (Mirai)", "value": "c17cd599a5b38338f4c2b03b0d1abcc90f443fd7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106101, "uuid": "9faf4d08-cb16-4696-a95d-a8da3496ffca", "comment": "Malware payload (Mirai)", "value": "9a0357105630fe449086dc637fc6ee8a1cb43290215b2baedc7b1ba6e51cec7453a77c088525b313a436be66f78f8372", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106101, "uuid": "40e02be7-f8b9-4e85-85b8-17201da4d8eb", "value": "T15D146C86E762D9B7C44A077506DB97354636E8A2032F4F02E35CAEF42E532C2F585F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106101, "uuid": "d14b6f5c-136e-4830-902c-926de9a834ba", "value": "3072:FFs/9Jkydg4jXLlNcFwY+jLDVejhITiKKATIC5FYHVByqqazK:FQ9Jk21XLlOFwY+jYhITiKK6IC5qHvte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713106101, "uuid": "0a7768d6-2b72-4ea0-84bc-bdc853b08010", "value": 192060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713106101, "uuid": "52226816-ea72-45b6-b9f5-f39f0565b4cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106101, "uuid": "39ecacac-717d-44b4-80eb-77b97357ee2d", "value": "vlxx.x86-20240414-1448", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2825e0e3-fa37-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1713082529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713082529, "uuid": "b87d8ebb-3b07-4057-8ea5-4733522f650d", "comment": "Malware payload (AsyncRAT)", "value": "f9318dd9f88030a81ee446ce3f3babe2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713082529, "uuid": "d57cd4f7-4135-4b50-ae92-87a81cc49133", "comment": "Malware payload (AsyncRAT)", "value": "897e032f230012f8f3af0818414e49024454b189be15537abcaef2c1621f7dad", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713082529, "uuid": "d757d535-bbdb-45ae-b596-9ae726b458e4", "comment": "Malware payload (AsyncRAT)", "value": "c6180eefa80e713f36881ea1e1392ce0288c9b91", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713082529, "uuid": "58bbdcb6-5b16-41d1-b8b7-41094377b873", "comment": "Malware payload (AsyncRAT)", "value": "a21f132937e3eacfe8badd619a6f725834379673d7f3fd2cca8bddcfba549af896b1809dece2133d95248a0c2bded5b8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713082529, "uuid": "2e38541e-d64b-4fee-b80c-729fa6f024eb", "value": "T121531B007BE98129F2FD9F7069F661944AF9F5676906D54E1CC401CA0B22FC2DE42BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713082529, "uuid": "a9ce36ee-f01d-4322-a2ec-536ba2e000af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713082529, "uuid": "55edbc33-638e-4c67-9f9d-74b9c5c53726", "value": "1536:G+OAXoaIib9WUMFlAdmb9oUbI7OvVeWqq3WXx:G+OAXoaIib9QLAdmbSUbI7lWF36x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713082529, "uuid": "9a715d39-868e-442c-8e02-823841f533ba", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713082529, "uuid": "7ff9d548-e2a4-44c7-8fdd-5f7cb0337bf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713082529, "uuid": "da230f49-0c1d-4911-83b0-155c7620ad4b", "value": "897E032F230012F8F3AF0818414E49024454B189BE155.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8b407c-fa23-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713074239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713074239, "uuid": "aeec013f-4a44-4e06-a4a3-e31efe2edc5f", "comment": "Malware payload", "value": "ce8b9d3c055498819ca9407d23c45674", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713074239, "uuid": "31b67feb-fa4a-40d6-9312-bf560844c400", "comment": "Malware payload", "value": "8b8d13316549e9958a3e9854e373abf655e29916086a48f49b88498b46bbc20e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713074239, "uuid": "74b79520-7e7b-4900-98ba-c0b4cd175a62", "comment": "Malware payload", "value": "770b35d623670e18d23007138509c8641c465260", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713074239, "uuid": "d242ca83-f2a0-4c3b-843a-a5ac5307bbb2", "comment": "Malware payload", "value": "51d45b42ffe23f0b0e8ba5d9f9f9049f2a326eb25ce331355654130773a1d0ca2606ec9d23b04d3301fc190bd2ba36f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713074239, "uuid": "cfce2bcb-0745-4e8c-b8e6-cc1e3d397590", "value": "T1286692AD38977A88BC508E546BDCB6B8E34F5D7B4F6BE5B0439353702A780C9AD03416", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713074239, "uuid": "a4fd7998-14e5-4776-904f-d3b53ce48659", "value": "99aaff19eb4fcaa0c27882ad4f3abc07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713074239, "uuid": "2232eeaf-6301-41a9-b51b-1eb72281ce31", "value": "24576:Jv5GNSrFlmPFDPUojLookSxCE1gvljcxNUwq9ibCKoYYhh/wv3zCp49/0yb4/oUc:5WCE1oBrcb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713074239, "uuid": "e48f8074-cab4-4838-87fb-b5ab15302dce", "value": 6517760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713074239, "uuid": "4f2bb60f-ce9c-4792-8b23-17bff0d69d32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713074239, "uuid": "b92f7cda-a289-4c72-a2b4-abf902c9fefa", "value": "\u4f01\u4e1a\u5883\u5916\u9879\u76ee\u4f63\u91d1\u4e2d\u4ecb\u8d39\u4e13\u9879\u6574\u6cbb\u5de5\u4f5c\u53f0\u8d26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c3b7e3-faad-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713133394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713133394, "uuid": "33a12611-ff70-4ed6-b5ff-7772bf1b8228", "comment": "Malware payload", "value": "e368fdd3cf315cfd9fd71cde81f09d01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713133394, "uuid": "bb662810-54b9-4c58-86a5-db3196f1b2f2", "comment": "Malware payload", "value": "8dad7c07ef41ca78fff3451b5fda5cbb2e39f8c0b6e33a812c089b5a049d8309", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713133394, "uuid": "cdf1f8f0-1886-4232-a6b0-d053925efa14", "comment": "Malware payload", "value": "f5b08f38fd5802ad20e2f0a65dddfd3cff7ce4ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713133394, "uuid": "c5a40f64-811d-4dd3-a844-c06292b1779e", "comment": "Malware payload", "value": "01e9078ce6981d743aa0c8824935d03cabae77ca4422c888927149c85440564fb541e7ce0474d1fcd530214ed4b2c9e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713133394, "uuid": "76f6f156-b654-4b1a-bb51-d44e407739fe", "value": "T1E4F30189938A89E2C24940B093DAC3E73E75F0667947434BFF5877352A91B01ED439FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713133394, "uuid": "f352f5dd-0268-4b34-926e-2287d5b6c98b", "value": "c9749513208288305099900ce01b1603", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713133394, "uuid": "f5437bf0-6f29-45af-a04f-cafc996a38d1", "value": "3072:h80IwJxDieMR2F6hDmxLZqMCgWNky1jv+Zy+P0GKHEMYRrSa8FH1DDHz:hVYR28hmdZpCgGLjvwy+CkzSLFVDDHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713133394, "uuid": "8f80df7a-056d-4469-95a3-5043f5880fd1", "value": 166209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713133394, "uuid": "3a1477d6-2aad-4ee3-b4bb-b267d05cb2ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713133394, "uuid": "3b667bf3-c925-4e91-9491-ecf9415071e2", "value": "SecuriteInfo.com.PUA.XYNTService.13779.9231", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79adb4d-fa80-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713114150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114150, "uuid": "a5af1c4a-1e65-4dd7-a9ac-6508328b720d", "comment": "Malware payload (Mirai)", "value": "e83b0d13cdeb32d80c592fd7021d2cb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114150, "uuid": "9fdedfbe-acb6-4abb-b8fb-e6a5d3989c91", "comment": "Malware payload (Mirai)", "value": "8dd9a90c7f1d0a7e7537d5c1807a4d3415865e2dbb673832d34f27f4728098f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114150, "uuid": "c846d7c8-2f76-4c37-a1de-8da6631b8b1a", "comment": "Malware payload (Mirai)", "value": "62fce5dcec5960e7f49752c43e2f408c2b82f8fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114150, "uuid": "80769c5e-d62c-4550-97bc-8359661980c5", "comment": "Malware payload (Mirai)", "value": "e3cda519e347f0d9d96b00b20d6b281232e4de23b434c79f0fb3e6009647a0d1d6a5a47b1add9533c306e5a2f069c35e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114150, "uuid": "dbff7d1d-38e0-49ec-86aa-fb300fc59ca6", "value": "T1587329DAF801D97EF85AD7370C534D097671F3E106931A3613A7BAABEC36198281BD81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114150, "uuid": "c421eacd-7fae-42fc-93a3-f550743c21ec", "value": "1536:2e54isvfEEM8Oqle4QeuacWjcW0JcWcBYVfJfMLxzKhHTyGpSQIGzYP8Yni:t54isvjIqE4QeuacWjcW0JcWcBEfJfMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713114150, "uuid": "ea1f8f6e-1260-4d57-97c1-73a1816d20b1", "value": 78556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713114150, "uuid": "7e1dffbc-8a1b-44a9-a119-d09a7a14694b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114150, "uuid": "4af82d8b-9985-47cb-bc8f-d89a4eee712f", "value": "e83b0d13cdeb32d80c592fd7021d2cb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df607b2-fa2a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713077009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713077009, "uuid": "f28e3854-bba2-4779-9ee7-0ebc102d5573", "comment": "Malware payload (Mirai)", "value": "5afac81a2578f8ceda81ee9c5ffafb91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713077009, "uuid": "2e0abb0e-8be3-4a6b-ae75-d829abc19ad8", "comment": "Malware payload (Mirai)", "value": "8ec33e73cefb134e804721328467b08fcc1ea1fa9c25fa5580078799bdfc7e18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713077009, "uuid": "58e58412-70c6-4561-b90e-391f290d3e1c", "comment": "Malware payload (Mirai)", "value": "5d2ced36a1670325816f0c12ded4e9f9a5964938", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713077009, "uuid": "28ba73f7-27de-4aef-9318-5b4fc0f6fdfd", "comment": "Malware payload (Mirai)", "value": "cc9a23a0028581abc9711c7751d9e8347103fd8ebeb173ad26f4de8fe337932e7b433d96bdae2322d7d224f4a38839f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713077009, "uuid": "c73e02a1-4837-418f-8c6c-99953a5ffd6b", "value": "T11EC32A3790604EB3C0429AF525BB99710F126C930B5B1A94623D77F44B7B9CEB88EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713077009, "uuid": "c7c8c034-6f32-4acd-850d-783a0f4a775e", "value": "1536:vuaMiqPJYdiVg7qwXo/wKg3otPas2edRKHofPVfGvmic092cwDNm:vujx9VEX1Kg4ps09fsmN09XwDNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713077009, "uuid": "e02b49d0-6c25-4da6-a9a7-b631025f04ae", "value": 128636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713077009, "uuid": "cd11ef61-4f42-4aea-8f2e-0737adda477f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713077009, "uuid": "22e05a65-daa9-4709-a528-4359607da51e", "value": "5afac81a2578f8ceda81ee9c5ffafb91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a91500ef-fa58-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713096919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096919, "uuid": "189f00ec-cb09-43a4-bd78-d6920159eba4", "comment": "Malware payload (Mirai)", "value": "96b5b6c38e1f40731edaa46975fc43ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096919, "uuid": "7b6c799d-b27f-4e54-b012-0adfef7beab1", "comment": "Malware payload (Mirai)", "value": "8f67bf4d131d95f4951300a0297001735419e52c098f3ae1087a3d7092e2a258", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096919, "uuid": "c2137834-ba5c-4697-82d0-9a31d88e7a3d", "comment": "Malware payload (Mirai)", "value": "78bcca0a2482f9d6a2cce4de04958080fdab2675", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096919, "uuid": "68f3478a-68cc-4f12-b2d9-3e10f31d7efb", "comment": "Malware payload (Mirai)", "value": "373b5bff7749159527fae56e4e6542de74f9a14cc537a86dfa3e1e8e1c0ac17af6bd24fd9fe961ae69aa166b98239609", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713096919, "uuid": "016c0d8e-c97a-4a58-98e3-533db077a352", "value": "T187934AD6F410DD7DF84BE6B64A234E18A531B2204F630E23A667FD57AD720E8691BCC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713096919, "uuid": "15c43471-500b-4d6d-a8e4-c246ae44898e", "value": "1536:gE14eIkfIY8PtbRCFXLYjaMg+d58m3ZnuEtauQeuacWjcW0JcWcBiYUh9LMv7aVS:ZIYStb4lYjA+RZouQeuacWjcW0JcWcB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713096919, "uuid": "a62716a3-1858-47f5-9ed6-a7c2088c8994", "value": 96440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713096919, "uuid": "4d22cddd-3733-4807-885b-0e40db457b2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713096919, "uuid": "b151fa46-46ca-470d-bf58-7ffb0644f53b", "value": "96b5b6c38e1f40731edaa46975fc43ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db37b5e1-fa25-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713075099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713075099, "uuid": "52a3d3f8-b1cb-41fd-be24-f06bb6bc0c1b", "comment": "Malware payload", "value": "4a4d0377231979bc112e1ae608eb39eb", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713075099, "uuid": "93c86a62-9fdf-4234-9951-038435d5bfe9", "comment": "Malware payload", "value": "95342054740988555135945b165e1840ba0ab93dd6ae9358dca1c203cc7080f0", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713075099, "uuid": "baf9adc8-92bb-4f8d-a3f2-75f8061653b3", "comment": "Malware payload", "value": "c625dfa6ebff9cf8ebb79461ec20029dc495cfe5", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713075099, "uuid": "1f358ba1-27b9-4cda-b781-50a20e60c950", "comment": "Malware payload", "value": "cf579498854da9e218cecd52dbba4774b49d3ee24f0a52234b50394c87c03d981d2e609041d508ee636d7df7b2c524a0", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713075099, "uuid": "b4313904-171c-4107-bc6c-2619990ff84a", "value": "T10FB294B3EF5C1E57C40C403F1B863B4A2735E2168A40DF855E38E5668D7BD872E9A24B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713075099, "uuid": "6dfd35fc-1363-444b-81a1-1bb75a7f2701", "value": "768:vsrit/SAFy+k1e/KeP7e0ZiD+CA9uZNiFq7:1t/Suy+kE8vFZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713075099, "uuid": "1c980312-7ad1-4a3e-9e31-1033c536f949", "value": 25232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713075099, "uuid": "18d46a30-d2d4-493e-8153-e7b9268b616f", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713075099, "uuid": "bac67b2b-7997-485d-9e27-f52f1d3a3145", "value": "95342054740988555135945b165e1840ba0ab93dd6ae9358dca1c203cc7080f0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa7c27f-fa0b-11ee-a120-42010a9c002e", "comment": "Malware payload (TiSpy)", "timestamp": 1713063644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713063644, "uuid": "7ad3902f-c694-48bc-b9c9-3fc42ac7ade4", "comment": "Malware payload (TiSpy)", "value": "185725ad9277baef1aac4b41276761dd", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713063644, "uuid": "1305e050-30f3-4fd9-86a7-4b1157f17b03", "comment": "Malware payload (TiSpy)", "value": "95cb47bf1afb91a2d0762e31abb32a7a35454d54831d03347a34e859ecce179c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713063644, "uuid": "7bbe0d10-fa2b-4aa9-a616-8ccab4997097", "comment": "Malware payload (TiSpy)", "value": "d1a9208ecbbe011811d9662f6d0b8746206bf1e7", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713063644, "uuid": "8148b3af-c6a6-4cf9-9d7b-637ce4d58bcb", "comment": "Malware payload (TiSpy)", "value": "30bfc0c4e1c41e1e92c76cf5d74c8e9a0ceb2e2ae98258562ca3c15e4630bcc943666fb8d7eee13a43238fd032e0298d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713063644, "uuid": "57122a13-94bc-4ae8-9f5c-88e2ca792d82", "value": "T1FFE51203FA6298A7D4FAD3321E72613960365C1103839359391C3BBFA67F9D91F96AD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713063644, "uuid": "3b81a2c6-a952-44ca-8f29-56523696cb5c", "value": "98304:A4RKnO/jPaHl198jXWFEyiCYrFPNB1yrWK:AFO/jSHlv8jX9yFYfUWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713063644, "uuid": "c53e6de6-36c3-4f4c-92a4-2c7eef83ad61", "value": 3259319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713063644, "uuid": "5ba2ba82-d825-4924-a12d-b45b71994048", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713063644, "uuid": "5b3ae8b0-9ff2-4cd1-9cab-427835bf7bbc", "value": "WiFiService.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951c527c-faad-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713133393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713133393, "uuid": "ba31dba1-407c-45f4-925b-b054ddcbc551", "comment": "Malware payload", "value": "3b1626206412142fdf42ac30a761c78f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713133393, "uuid": "59cd41a0-06c2-4dd0-9faf-569efdd911c9", "comment": "Malware payload", "value": "95da3acbbc5c117cd5b39f1f27e88d6924554b888f2cbe47a1cdade8109b314c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713133393, "uuid": "2c0904a0-e3aa-4824-933f-684cc9d23944", "comment": "Malware payload", "value": "e686c4916f115bc514b22be4adc07e633eb43c76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713133393, "uuid": "acb2b7a6-c95b-4f54-b924-a4f29727bfca", "comment": "Malware payload", "value": "8e3c5f0fc425e7b43b7fc01b9afc78efb003a3fbf828714a69c9d0a0a2606260c1e8babc0e7ead0508fc45adf8f31256", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713133393, "uuid": "5b6d0ba9-863e-43d4-8ebf-2ff8887d2e82", "value": "T124F30216438889E2E14A487087DACBE72F34704B2B53534FFA44722919F6685EDD39BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713133393, "uuid": "5b9d82a6-241a-41e4-a2c4-af5ba1b19db5", "value": "c9749513208288305099900ce01b1603", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713133393, "uuid": "1597d402-9724-4c52-8501-78047feebff0", "value": "3072:q80IwJxDieMR2F6hDmxLdq471eLm5u3zy+PT2GKubEdl1RlJvGVpOWy0Vc14:qVYR28hmddq471eaOy+subE1vpGVkbz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713133393, "uuid": "bfeeea0e-9635-4bd3-bf7f-eaa0416fdd04", "value": 167019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713133393, "uuid": "5b24cc10-23b9-4c2a-972f-d9d18a1ba1bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713133393, "uuid": "fac3ad61-d8dd-4078-92af-7b84b41a2a7c", "value": "SecuriteInfo.com.PUA.XYNTService.8620.13703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "395affe4-fa2a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713076975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076975, "uuid": "ca2b0bc3-fc08-4e5b-b2d6-aa17976ad993", "comment": "Malware payload (Mirai)", "value": "22b36e0607e50fdf9e7b28b7cb416336", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076975, "uuid": "20be62ae-a9e3-4a9f-928b-ad2eb8f0e7e5", "comment": "Malware payload (Mirai)", "value": "9611a9e29ad0716ff1c93ba8738fed20ab85440f01fd15cb823ad1c9bda001c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076975, "uuid": "e738766c-e317-4f4e-9dd9-de3229bae0a0", "comment": "Malware payload (Mirai)", "value": "85666e9b4bae66394447b7a38cd4d27918f257da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076975, "uuid": "3fdd25fc-d4f3-4f4a-bd81-94d581230892", "comment": "Malware payload (Mirai)", "value": "e4a1231d3877c85c346ab47c9a6bc281257d66f77eb60c7be39fcbaadadb9b4b6d939867442d7daee5a03f0f6895d9dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076975, "uuid": "9904403f-cce3-41ac-bcb1-506008c3c60b", "value": "T115B31832A290C472D14706F101A3CF7B0C32FEB7176A5A96E36C3EB0AE3258575A5E5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076975, "uuid": "63858f8b-ce9f-4a01-8f7c-3b644b37d7fd", "value": "3072:tMmr9U9u2GC9RXTqclsk5Xb7kp9mFK0AYF+ku:tM8auRC9YcGkRb4p9mFK0AYF+ku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713076975, "uuid": "c7a2a2f0-7a28-4c7a-8cbf-b58944bfc324", "value": 111032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713076975, "uuid": "69eda74e-fdbc-4b7e-9108-c0a5af452b52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076975, "uuid": "7db8a537-9243-4316-9788-9309b9d89139", "value": "22b36e0607e50fdf9e7b28b7cb416336", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22969f6-fa80-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713114141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114141, "uuid": "374ac345-c347-4ba4-bf1a-dcefb72c7748", "comment": "Malware payload (Mirai)", "value": "474b55c7caf24458e4bdd4f618d415ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114141, "uuid": "4483643a-876b-42a0-940e-c51c41bd3754", "comment": "Malware payload (Mirai)", "value": "9890aced0f37a8ccdb8f25a00735aa52f1b22030409c76eebcb7dd49414b5bae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114141, "uuid": "589b394f-c33c-49ef-9ded-c067c8512576", "comment": "Malware payload (Mirai)", "value": "e7083cbd5163861ed4d9df7ebc931109d55806d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114141, "uuid": "766f1f92-0aae-496e-a953-d39d08d48eee", "comment": "Malware payload (Mirai)", "value": "d25713450fd065ab1336182ef8899ece18c003b17d8592b08fc4cf6bed3fcea134d4c9bcade10d16631f93679f8be7e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114141, "uuid": "459641c4-716b-4045-9ef5-73f175ae4917", "value": "T1E3E2E14722E6507FFEB56F3209AF839FDA116CB507EBE76842A015750710A40E71D86E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114141, "uuid": "88b49074-a1c5-4234-84fc-f4a3d5205f2c", "value": "768:UCSZj5UyKBi6gYT6cvh+YNZNYiQ/pZe3TyhSB6n:UCSdgT6cJhYiQ/pZe3Tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713114141, "uuid": "ab6f579d-476a-4713-ae64-0d3e74518c04", "value": 31836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713114141, "uuid": "02189ba5-4394-456c-bad0-8b00f26eb94d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114141, "uuid": "87340253-dfd3-4e4a-b7c7-8c7092fdd706", "value": "474b55c7caf24458e4bdd4f618d415ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7981de-fa58-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713096926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096926, "uuid": "d4b95ab1-f5be-4070-853a-73b343c7862e", "comment": "Malware payload (Mirai)", "value": "02e82aa87d7fd1c5f970cc5c01d68b17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096926, "uuid": "9af34d31-99c7-4d4a-9dec-6665b090996f", "comment": "Malware payload (Mirai)", "value": "9b39ef71d112d11b9dd1aee0cb4895f14f137331b361ad12b9b9679b43446848", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096926, "uuid": "8ee6a99a-be89-4992-b8ff-1ecca5e0a8c1", "comment": "Malware payload (Mirai)", "value": "914f0f37070150ea42739aee15d9db44b0ea4e62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096926, "uuid": "55a2dd8f-d58e-4aba-888b-2cf056531be4", "comment": "Malware payload (Mirai)", "value": "2660c76521160d89c019452055db53c64fc5516a6a29de7164ff1f0c9def13d83cfc08729c0ebb0afe20184efc1489bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713096926, "uuid": "0f6f7478-afce-40ed-b6c9-1801097b6b28", "value": "T103B36C0133294957D5974EB519AF07F083FAFCA016F1B609A90EEF944732FB22486F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713096926, "uuid": "f1c32ddb-cf03-4553-9cc7-1f5e6b8740f0", "value": "1536:VDIcH1oZX4EsyXK/Nw9NDQa8KIg5hSxBIdcWnggc86ml1OvLYAtgN/FIs+r6iP9W:CcHM4EsU+W9i+I/Uc86ml1nyr6Ag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713096926, "uuid": "c4e4874c-a1af-46a3-859c-51973e76e6ce", "value": 117490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713096926, "uuid": "63314eda-46e0-43e3-b248-7ce4570a2c40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713096926, "uuid": "f5e03f66-0b81-44d7-891c-c0e7bf606841", "value": "02e82aa87d7fd1c5f970cc5c01d68b17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d787e5e-fab5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713136789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136789, "uuid": "826a6028-adde-4f0b-8e60-a49093e85aef", "comment": "Malware payload (Mirai)", "value": "6ca73c70010fb22e65df2b716ee9a760", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136789, "uuid": "570a2827-f3c2-4ef9-b4f3-177523c64bc5", "comment": "Malware payload (Mirai)", "value": "9f72cc93658d01c11019906abb8f287e74f9e9313f180ab606e33c1f258addf6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136789, "uuid": "ffff7bf0-c96e-42c0-9b87-dba109331580", "comment": "Malware payload (Mirai)", "value": "c25e338b5e0401fcb8d7559721072008f5844db3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136789, "uuid": "a50a9a2a-0d84-4e79-bb5b-0809a1272f77", "comment": "Malware payload (Mirai)", "value": "48c48e21fe3f957d8060f9df63be1ea633734db7be44cadf1fa95bb85e63ae430ccad05e128e6d8c1d2a8fb431681454", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136789, "uuid": "a5b0862d-2072-45a1-a87b-0f8ecd9f31ba", "value": "T137333A42F30D054BF9A32DB0363B27D1D39FED8031E4E6C4B61D9A899172A319656ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136789, "uuid": "a96ace42-d7d8-4d37-bdf6-ccb271a317ef", "value": "768:e0qKJaxwsRHp70txpFcUM7cNe/fUQ9dQ96Qxk6f/jI9oiNFoZwtNHNCI5:eNHp7eX9M7ooUSdi6SkyjI3ewPHNCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713136789, "uuid": "e3d81290-0e3f-41c4-8c7f-ad58ed1bbd66", "value": 54872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713136789, "uuid": "c83f0eae-05ef-48a4-9d12-a4dfeceb1295", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136789, "uuid": "1055da74-076e-47c5-824c-f274ed23c89f", "value": "6ca73c70010fb22e65df2b716ee9a760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495dbf27-fa1d-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713071418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713071418, "uuid": "177d7455-0bef-4ed4-9b18-6b80a13091a1", "comment": "Malware payload (RiseProStealer)", "value": "bff833e31e294ad1a723d433daf380fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713071418, "uuid": "50e4cc9b-bb73-4fa4-9a7b-fa71a5e1d0b2", "comment": "Malware payload (RiseProStealer)", "value": "9f7586b19e779723513dc5dd122d78767e1148fc5f728535a5a61e5853283553", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713071418, "uuid": "a4cfc61e-49e8-45ff-9216-57283df90341", "comment": "Malware payload (RiseProStealer)", "value": "8dbaf17cdbd02b2ff872b203c09351f8d3d4cf05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713071418, "uuid": "f803d823-2ac3-403c-b73e-6b8d9ef776b2", "comment": "Malware payload (RiseProStealer)", "value": "ea0b2bbf32ae4b3994df7f1e49c71fa33e003816a92e2ac4e6577bd2c5cabbd4ec584bc736d65a688a63c87579dc8d62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713071418, "uuid": "9f0e6fe1-5a5f-479e-a023-bea10b0da628", "value": "T1CAA533940F85DB16CDE457344293CC376FB03A468DB65ABE78453CF37A6EA469B030A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713071418, "uuid": "3480e7a3-0d25-4cdf-8ff3-fdf3a1e98bc4", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713071418, "uuid": "bdedfe72-dbb7-417b-b730-70fb5adccd9d", "value": "49152:0SUl6vD5DxN6HHLJFwIZjkWgHRW67w/0luPDAg/nqOApLrcDoD1a:0SSwD5Dxk3jOVBiDAcqOApLr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713071418, "uuid": "ae9dd7f3-1933-420a-ab6f-a6ae969ded17", "value": 2224640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713071418, "uuid": "7f78af95-08e7-48af-bfc1-f7f0dd125532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713071418, "uuid": "0f3e75dd-7ec9-494d-b882-9e1e8b226fa3", "value": "bff833e31e294ad1a723d433daf380fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12628152-fa6e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713106115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106115, "uuid": "753a0dd6-9f1c-4c56-acbe-eb7c5b0b09b1", "comment": "Malware payload (Mirai)", "value": "dbac574c941bcc1969416c55b844f543", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106115, "uuid": "c33e62c1-6bcd-4964-a4ad-2456dc608e9d", "comment": "Malware payload (Mirai)", "value": "9f785d6e8fb703833ac59699d37268668ca0b2723acb0b4bfc5a1bd20c824bcf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106115, "uuid": "e5568be2-c61a-4322-b91c-2e90a53de213", "comment": "Malware payload (Mirai)", "value": "341d9faf6ca213e42c4418a890add9daf0f500ab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106115, "uuid": "64305037-a5ad-4b67-89da-fb138ecb7a63", "comment": "Malware payload (Mirai)", "value": "e757c0c0ca61b6bb481dbcba482106989d6ef856d06d717ca780c7a60404c380155869aa98cf17211488ec5e142670e7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106115, "uuid": "fecd3816-4cf2-43f0-bc46-c67476df6b6b", "value": "T1A5042A46EB404B13C0D627B5FADF42453323AB5497EB73069628AFF43F8679E4E22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106115, "uuid": "d3ea6680-1cf2-4dd6-b3d9-b227fc45a22d", "value": "3072:EZHZuVjxrvAqTkYaDsh+OcAc6/HSwBjQm2cJsoyM/RMuWpO:EZ5Gxr9oYaDsh+nA9RB0m2+xyM/RbqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713106115, "uuid": "60689311-c592-4f26-bb9e-fa1721621fac", "value": 179803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713106115, "uuid": "bb040984-e436-4cd6-9f31-fa980e9ffb4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106115, "uuid": "396c62d7-c029-4386-b59a-4785cbff54be", "value": "vlxx.arm7-20240414-1448", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf203ca-fa6b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713105193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105193, "uuid": "248438e9-1e39-421b-9b9d-b0814c269369", "comment": "Malware payload (Mirai)", "value": "6fd6d69de3edc6a9ca776964c5f17e8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105193, "uuid": "b78edf23-51e8-42b8-8c22-027bb0f3f094", "comment": "Malware payload (Mirai)", "value": "a06433ded3ebdd9021c167585a08ccac0ac4bd8e8a811b51770a4d0f6229e256", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105193, "uuid": "47369e74-7a17-44ed-bc40-c1d2fd9758ec", "comment": "Malware payload (Mirai)", "value": "7a95613c08c25eaaf641dbc33f7b0661feae52ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105193, "uuid": "6d62ebc4-d347-470d-9132-70b048713832", "comment": "Malware payload (Mirai)", "value": "9d0d7621d563f45455a91e1e71bb9269a0a3315b6de08bf90fe5feec65d3447b86f7f6d0a2214c702f37ff2037009186", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713105193, "uuid": "56a01d73-e3ca-4b26-9103-570b2361271f", "value": "T18D93B30ABF740FF7E86FDD3749A92709158C650A22E97B357930D818F64B26F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713105193, "uuid": "5e7c0201-3ac9-47da-a6f7-d4ca0b08eee4", "value": "1536:zahaNVXMDW/JxtjzYvTIqI3Lk/0B/BXsZiaBLTe:zahGVQWft/Mh2TXs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713105193, "uuid": "a59b5cf5-5eda-499e-8d00-2c241a888247", "value": 92444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713105193, "uuid": "20467a5e-34b3-477a-80c7-29cd80e4a9d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713105193, "uuid": "d52b9c10-b2b1-4dc6-839d-6ea2746f17f6", "value": "6fd6d69de3edc6a9ca776964c5f17e8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd500923-fa25-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713075076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713075076, "uuid": "96946e1d-7ffc-4fc2-af99-d4b74f848830", "comment": "Malware payload", "value": "b91858adab9e3705457cc4affa49fa06", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713075076, "uuid": "13efd89b-0432-48ff-b640-94febb3fd258", "comment": "Malware payload", "value": "a1648e9432c1ed8da3bc51f75de824c4699034c7658a4eea57275025a601d237", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713075076, "uuid": "d571caac-6759-4807-9280-d62f7f582a5c", "comment": "Malware payload", "value": "ceb1acc38049d3861272dd7daca78d2373b0ca20", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713075076, "uuid": "c08ca2fd-e1a2-4172-bf11-ad27c7943b6f", "comment": "Malware payload", "value": "3f6162c724af8435fdf8a0eb28ea060f1ad9856df036a65c92f58c5dcd553a2bd2ecf905f28fc497b1c3591697beaa58", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713075076, "uuid": "a977187c-7d92-4294-9ed6-83670f7440d0", "value": "T1CF3394B3DF491E4BC80D403E8E596F12572CC32ACB00DED59F24C468AEA79475A2B797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713075076, "uuid": "9c2180db-5cf9-418a-a2cd-18a872673f3a", "value": "1536:1t/Suy+kE8vFZDMm1TuirUj2jdMuN9u/TAdZz:1kn+kjFZDMqTuirUj2jdMk9PdZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713075076, "uuid": "eba52fb4-c977-4a34-aeee-79459ad715a3", "value": 53406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713075076, "uuid": "b2413b16-79d1-4feb-84ef-8f50e0a3a3f2", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713075076, "uuid": "f86f2451-fc55-4ace-98dd-cf85e34ffb20", "value": "a1648e9432c1ed8da3bc51f75de824c4699034c7658a4eea57275025a601d237.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bd11f1-fa72-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713108191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108191, "uuid": "29169f9d-0705-4dab-b795-1354a738b680", "comment": "Malware payload (Mirai)", "value": "0d889d1f1305e0d444cc6d8e9f56a03f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108191, "uuid": "e70f4dd8-a247-4add-a558-0586c55c3a4c", "comment": "Malware payload (Mirai)", "value": "a38be2ac7fa08a4f9e95a4b82d9303be686ecd02bbabe0920b47be68e409282a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108191, "uuid": "6535d8ed-c287-4469-bc18-e3a4bb63f765", "comment": "Malware payload (Mirai)", "value": "e4a54598de0898dc18535ec54abdf111c1adde73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108191, "uuid": "5f7294b7-0269-42f1-bbce-0dd1316ad65f", "comment": "Malware payload (Mirai)", "value": "427d7ce6a36ffb4b63db338eafa9ad4665367560f5f7bdb2af04d5ad80eda27eeb0d43a8173f585518bca5e0e6dee59b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108191, "uuid": "6847d317-f3b6-4e4c-8119-e23300fed4af", "value": "T195833AD7F400ED7DFC0ED77B4853490AB671A3A156831B3A3367B963AD321A44926F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108191, "uuid": "6c7d0e81-6306-4369-96a8-cce6f0561f20", "value": "1536:41LJvCCApMADod2480ydtklqtfCYi5Y4Tjr/ZDLl+xUww6F:WLJqdmADod2iydtkVYoYG5l+xbxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713108191, "uuid": "4d06bf78-39ce-47bb-bce2-1ee33802b6cc", "value": 85248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713108191, "uuid": "6a087cba-cf5e-4320-80f7-035e11941ed0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108191, "uuid": "11802391-5d17-49a9-bf89-cb04602a31a8", "value": "0d889d1f1305e0d444cc6d8e9f56a03f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f922a5fc-fa25-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713075149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713075149, "uuid": "c1f34a26-bd7f-4c15-b541-64f8b121f9a3", "comment": "Malware payload", "value": "080e1f878741e51f91b012d83ffe91b8", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713075149, "uuid": "36f1c97b-4071-4141-be5c-44058024130c", "comment": "Malware payload", "value": "a6026867bfaf705bd8a58c14dcc9c301313962cec11002c6e1488a084798c5ca", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713075149, "uuid": "79896f37-a7a9-412a-86d2-c29012a8c22b", "comment": "Malware payload", "value": "a01495b4e50d3bf8028d1e06b56e2a108d4ac701", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713075149, "uuid": "04f1d651-20a4-40c7-b8b9-a0c1e41a4bfe", "comment": "Malware payload", "value": "41e7382224cec3c72da72e5132c1a6a8e94c2807a0a366c18626fb0194b660015ceb1af2e1c7275f4467727000409221", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713075149, "uuid": "d77cff5e-f35e-4eb6-9ba3-eb9fad6d00db", "value": "T19874D533E3104906D6DE41394A1F9755837DFB448F00E7AA6BA5F220FEF2CE66E1A605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713075149, "uuid": "f3aa1a1f-9568-44e4-b204-c6d9c46e7cff", "value": "6144:vBVStFmqpGC18gjN8l4nsslSeVKSz3tBWa1ipbUCOgTmDpZIqTuirUj2jdMAPBkr:vBypd8gjieVF5fgpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713075149, "uuid": "265bf89b-bb89-4f01-a5ec-fa85810a37e8", "value": 340684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713075149, "uuid": "d85242d6-6401-4586-a410-4064915bfee4", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713075149, "uuid": "835b3ba2-88ab-4ab1-a8c1-d3ec7e36a823", "value": "a6026867bfaf705bd8a58c14dcc9c301313962cec11002c6e1488a084798c5ca.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aecfa77-fa5d-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713098989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713098989, "uuid": "c30ac1d0-75e2-4c98-8bf6-9cb3c3f47745", "comment": "Malware payload (Mirai)", "value": "bcf1c8ec7a53e3c22fb9357eebb3bdd9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713098989, "uuid": "ba4a111e-784d-4d0f-9f7b-5c1d107e3ac5", "comment": "Malware payload (Mirai)", "value": "a66293fea5c2af78f27c8f96f804f869dfa68b66ad6f664f24cff478dab647bd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713098989, "uuid": "b123a495-29a6-4c48-a2cf-2c14c0d5c486", "comment": "Malware payload (Mirai)", "value": "1ff3816bb26b7a41f4348e5f1e77fb11e7722bd2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713098989, "uuid": "920e29d2-5ddc-4942-849a-f9b9c331df48", "comment": "Malware payload (Mirai)", "value": "1249e773140e3a448b1e6ae2c9fb143b4a4355da48c2796b7e3a5578fafa19eb248cff61bf3d30bc78bb2748b208bd0a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713098989, "uuid": "febe3192-c4c6-41d8-ad2a-804a24189683", "value": "T1172102A751E8E832DB7200BA618A2F8713A89CA0B417FF0B9D900D02ED291D1D132778", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713098989, "uuid": "7c9148d2-5139-47ac-88d6-c8733a88bd6b", "value": "24:Flu5M02OyOg0ee7FAomceZGQleZzLmLvridDGu/Y/CjdruQsipc8:fW9L+GAcoGQlozLmLWDDY/IBHsiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713098989, "uuid": "547081de-598c-4c36-bfc6-1b1ef9a52417", "value": 1196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713098989, "uuid": "afdf9d6c-7acb-4c21-852d-1adf01ccb58f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713098989, "uuid": "29bc8145-90b2-48fb-8fc5-66b51f463d21", "value": "x86-20240414-1249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2652c206-fa2a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713076943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076943, "uuid": "2ed725e1-6dff-41a7-94c6-6ac2326ad18e", "comment": "Malware payload (Mirai)", "value": "e0a130cd2b2341838435ffafb322f993", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076943, "uuid": "0c1bcc88-6062-4d12-a69a-33054b5060a7", "comment": "Malware payload (Mirai)", "value": "a9338e781898a3d19d9c93dad48334ccd978f0abec02bd92a686a9455acdfaae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076943, "uuid": "f0359aea-c269-4985-a264-8c0f31ceb759", "comment": "Malware payload (Mirai)", "value": "20608761ac782f958df791ad6ce76cc902c7e490", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076943, "uuid": "c9b74739-bdb0-4fd7-b92f-99b447be0fc0", "comment": "Malware payload (Mirai)", "value": "6f2ea977be9a1ac6dc4c834d4c0a6567eb5978d5945e199de925174f162b0b275c483c0889387346a9ca05cb5bbc25db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076943, "uuid": "81a13a90-4064-4ab1-986f-1a7e86341c05", "value": "T1D7D33A3B922C0643C49B49F038BB77F34F69ADE312A651805619FF904B73AB22546F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076943, "uuid": "1a0bb119-01d8-489c-915f-404947c6ad7a", "value": "1536:6wOSvD2GpFQBhrqMd5BoGRQyGB/ND+36IzkzIcgWmLOh0nmJ2VNu:6LqyGpFjMJtRQho0BLmLK0nE2VNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713076943, "uuid": "beec50a3-6ba2-44e1-9960-d589e099eaf3", "value": 134902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713076943, "uuid": "a1bc3791-9a6b-44e9-9a46-b6226429cf73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076943, "uuid": "1726fe11-f847-4823-9167-87c02340ad33", "value": "e0a130cd2b2341838435ffafb322f993", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8617b84-fa72-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713108165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108165, "uuid": "1de1106a-c6c0-4bcf-97ad-819389734330", "comment": "Malware payload (Mirai)", "value": "05f3c0e2c731be80a68df7e87856050a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108165, "uuid": "ebbc8da1-744d-434f-89f2-bd4469171e3c", "comment": "Malware payload (Mirai)", "value": "b25fd94d5941b7737bf859904e05087be415c128e3148fc6c8a82cbc0184ded4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108165, "uuid": "e23d010d-0d9b-4c3d-9ee0-1d4bb8e5975b", "comment": "Malware payload (Mirai)", "value": "85c1351533386fe79d26fe2e3a1c67442c2d0f60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108165, "uuid": "2ab9ab27-93c8-4f3e-9639-0cf068cf33d7", "comment": "Malware payload (Mirai)", "value": "3068efcaeb5c24ddf4e72461241765a334e26dca5bfa20c95c632d85a35ba4a1122e60168602003c35c2d3ea39d5100f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108165, "uuid": "1ec840a7-1135-4ab3-bd51-0fb375a03980", "value": "T182632B81F687C0F5D81B09304077F33FCA32E5294171DA6EEF69EF36DA63541A216299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108165, "uuid": "0f2d3e6e-78c0-43df-9340-acc572ab01f9", "value": "1536:R+XkIsiWIGc8k1KDVmUlN73HOG/WtcR5RaCrZqfCxCEEXN:R+XvsidGyKDVmUlN73OFeR5RaCl+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713108165, "uuid": "317327a1-97ec-45b6-b8cf-34a3d1714ae3", "value": 67028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713108165, "uuid": "a830b811-c3b1-4de5-9bf9-f86950718b37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108165, "uuid": "2cf189ac-8b78-40b5-bf20-48c4cb44d675", "value": "05f3c0e2c731be80a68df7e87856050a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9082d20a-faae-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1713133815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713133815, "uuid": "401e988b-39d9-4d92-9fbd-c5a041a027b2", "comment": "Malware payload (njrat)", "value": "21d48723fd950d9b624103ee4dd625f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713133815, "uuid": "01b36550-8367-4426-b06e-898883c6c60f", "comment": "Malware payload (njrat)", "value": "b28b6fb51ad601426665371ccd212a0038865c40f73b76cc1adba27da491cebf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713133815, "uuid": "9353afe7-0c52-4d2a-a59e-985d9682a3d2", "comment": "Malware payload (njrat)", "value": "c8464eb2e1c60294cc2130143802dde486cfe215", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713133815, "uuid": "7d2f127b-33ae-4fbf-9b12-b752e9f3f9f1", "comment": "Malware payload (njrat)", "value": "532f1e0968f953a2219fd44ea4ef2365289b8f981de0c90ae2d29819d5e07c697ce61b00745334581fb363cebd8e5020", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713133815, "uuid": "8170cb6a-5394-4d68-b224-00ab11a14fc7", "value": "T196B3FB387D952133C67EC1F689E50A8AEB69223F3191E9ED4CA742C418B2F166DC1D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713133815, "uuid": "edff8b70-62e3-47d1-9837-2d699d970af6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713133815, "uuid": "51d71408-a2b9-4f70-9ea5-8f87d4d35e28", "value": "1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegoxmOBhp:w5eznsjsguGDFqGx8egoxmO3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713133815, "uuid": "1b52211c-f62f-47ae-84c5-45fffef31bc2", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713133815, "uuid": "fc9b9008-22af-4eee-87c9-b378282c3c0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713133815, "uuid": "eda19e72-2a2e-42cc-b340-1fc1201f4de6", "value": "21d48723fd950d9b624103ee4dd625f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf247b4c-fa80-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713114136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114136, "uuid": "67f86683-c5f1-4d00-a688-cc1116d4f477", "comment": "Malware payload (Mirai)", "value": "3ef9c149e1bd5e93fbd3b49da1f94131", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114136, "uuid": "f65368bb-2936-4af1-bafa-5a8ba0081b59", "comment": "Malware payload (Mirai)", "value": "b369830f39dfd4a1228d4e76f9f211ec29dbac8290508b2ae18189dac8084c20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114136, "uuid": "41a560bf-7142-4901-a01a-f21fb276f742", "comment": "Malware payload (Mirai)", "value": "ef5cd80a1f195c4d2b4791685e51732accb70791", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114136, "uuid": "a2a1359b-c1d9-497c-8064-770eeca00fad", "comment": "Malware payload (Mirai)", "value": "ad567bc2d978221fe0fee7ed4437fae3114e292feeca21f988b5fd072ecb732c4bd47406e8e124d320ba4d4ae2b419b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114136, "uuid": "0c21f92a-cd39-43af-9345-76d3da48ee32", "value": "T148932802B3290967C09BAEB015EF5BF147B6ECD026F1B604652DBF941B73BB11485F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114136, "uuid": "389879ff-562d-4e31-9eb8-e43dcd6870ad", "value": "1536:5WoRkUSTq72Tp1MJCBmc8rYp0zvh/Ljrlb/:soeSOp1IHswvhDjrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713114136, "uuid": "42068507-19f1-492d-8ff0-1256a8085c37", "value": 94511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713114136, "uuid": "b8263644-af14-4daa-a702-9e0d148ed971", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114136, "uuid": "807976e2-1ecf-4b45-be1d-b06798be12b6", "value": "3ef9c149e1bd5e93fbd3b49da1f94131", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea450cad-fa72-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713108195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108195, "uuid": "86e6664b-58d0-4d8f-9112-da62899b75e3", "comment": "Malware payload (Mirai)", "value": "a8c2689c50d9761f7563f30fc32eae91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108195, "uuid": "5862a852-85f8-4b4b-89c7-56acaa5429c3", "comment": "Malware payload (Mirai)", "value": "b6a49742e464559853836e6b6d4f3b0e8736e25004a253cc676c9412e3bb4280", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108195, "uuid": "1140d4ee-afe5-4d04-9e10-db9fcdebba80", "comment": "Malware payload (Mirai)", "value": "91e4e6a194c7e8570d0d41c913009e5ccbe40111", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108195, "uuid": "73483b54-4d2e-4943-a411-f9445e204b65", "comment": "Malware payload (Mirai)", "value": "0097b68f9bc279ce30a193297207d22dba49d315cf77e4936e450c1b32cbcab8e8802ae1c098686e4aa52bcf0114431b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108195, "uuid": "5b20ec8b-5214-4aac-82d6-5afde3944503", "value": "T1C3733B91B8819A13C6D452BBFB6F418D73261368E3EF7203DD25AF21378781B0E6B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108195, "uuid": "64bbc655-7bc7-42a4-a8e2-0a0aecdc137a", "value": "1536:Dwfv0c9K043hiw66vn/OMIuztV+wlOqtKTmIWSSPaNltRqSiG:DwfvKJmMN6ehA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713108195, "uuid": "4c175c21-bd96-4c17-ac2b-5c496f8542da", "value": 77640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713108195, "uuid": "5b4a7ebb-e0d4-4ee5-93ce-10f71341e8e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108195, "uuid": "d247c68c-2277-40c0-b7fc-70759fe69a1d", "value": "a8c2689c50d9761f7563f30fc32eae91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed2a5ce-fa5d-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713098996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713098996, "uuid": "9586415b-a204-4443-a3be-efdfbe330125", "comment": "Malware payload (Mirai)", "value": "fa7cc4ce03f6a30f8fa49f3527b22e71", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713098996, "uuid": "804c7e67-de38-40df-a1e6-f4e768061bee", "comment": "Malware payload (Mirai)", "value": "b6fa899bde35381326d1dcac6537771814bad017831d725663885476ab05c116", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713098996, "uuid": "a3251022-fdf5-4279-8e88-e25855eaf4c0", "comment": "Malware payload (Mirai)", "value": "edbc09624f66fa4b4a5a286f0f712ec149a99cb2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713098996, "uuid": "fbef25d2-f8a8-4c1b-b47a-904c93261354", "comment": "Malware payload (Mirai)", "value": "8586c265ae38ab003e58599914c9a5b30e11611138d8c252e8eb49aaaf6cda973dfa53555980146b76c906f0da82e2df", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713098996, "uuid": "245ae782-0e7d-46ce-8615-ed7e08e71195", "value": "T1B631DFD193E05DBDC8E411BEAD6B4314B3689F80F1C67A22920C73646D1AFBC6D2648A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713098996, "uuid": "67af00ce-e32c-4de6-a117-057e06674ce8", "value": "24:FlKGpa7Urz/jlfYLfCzXK1G9Vev3gRGiJ9i8/NBuLlUl+k9gSO:FlKGpa7UrLZYLKoRA9NBump9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713098996, "uuid": "80148730-8204-4759-845d-03587381eecf", "value": 1492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713098996, "uuid": "608775c5-30bf-48f6-a955-a486ee6ad9b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713098996, "uuid": "43c8508c-f569-4fe8-b9e3-49e763ddb837", "value": "arm5-20240414-1249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9190ea87-fa44-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713088290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713088290, "uuid": "791f6960-d9d6-40df-a692-77772d8e480d", "comment": "Malware payload (Mirai)", "value": "3d64ba01f95fdb8aa12a8660d4aeefac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713088290, "uuid": "8f98ba27-fe58-4bb7-b59a-c6c6f80abf5b", "comment": "Malware payload (Mirai)", "value": "b98e066303683dada861b57bcbfe1611eed088eee2feff6a90a03d9bd956c4ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713088290, "uuid": "c6d9a3c9-89c3-417c-8c8f-57a00f0ea063", "comment": "Malware payload (Mirai)", "value": "d2b52a4c8e3e55fafde1d75f7f31604f3c9e4755", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713088290, "uuid": "31c6b793-f24a-4e5a-aa46-dfa28c3bb8cc", "comment": "Malware payload (Mirai)", "value": "b8d0a00ba15ad0ce0a2e1a20fc4459580ed217a0725e6b47b5f87f627386289d34933a6b9e1d3e9d231a2777a7b3b64a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713088290, "uuid": "164b506c-ead8-435b-8d36-0157c6977b1d", "value": "T1CCF329C7F901DAFAF84AE3334C530909B230B7E145521A376257767FED3A099246BD86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713088290, "uuid": "c8d432d1-e128-42a6-b165-6d30b308da80", "value": "3072:93sDtSsBlQtP9LtYqrvQeuacWjcW0JcWcBZ2qdU70wtT/RmVdUKLorlG8A63Qii:a0sButVLtFvQeuacWjcW0JcWcBoqS71G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713088290, "uuid": "a8e56ab1-5986-4402-9379-84ca86ec71ea", "value": 163272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713088290, "uuid": "b1ceb6d7-cd71-457a-9b3e-c8b5571feb5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713088290, "uuid": "554d6701-f2fc-4ce4-a4fa-ef07120eddda", "value": "3d64ba01f95fdb8aa12a8660d4aeefac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4f72ce-fa2a-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713076955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076955, "uuid": "7b2b7085-3988-48c0-a275-4fd465485d16", "comment": "Malware payload (Gafgyt)", "value": "6de12036e5ca9b777013c151fd1c5bab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076955, "uuid": "aec656f6-cc5c-4a8e-b2ed-f71806a08e6c", "comment": "Malware payload (Gafgyt)", "value": "baa2ad2d41ad3d2ac9c7e0f07107949af484c8c1e0a45b56b9afb9d4d312c540", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076955, "uuid": "9647cab6-ced7-4c6b-be17-21c376cd53c6", "comment": "Malware payload (Gafgyt)", "value": "520f8dbcbea93f3f11b72ec06d674be3c7bb1965", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076955, "uuid": "dc278561-486a-4417-bf86-e266f739da1c", "comment": "Malware payload (Gafgyt)", "value": "589a22989b1ad7c165165e25eeef51c2242b04373bf8740bdbe1dfdeb3d816a69e3d4d6c33fa3950a3070da9886fb7b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076955, "uuid": "d5170a9d-4df8-464e-a730-05eaa9d85aba", "value": "T18A042A34D6504B17C1D223FAA69A424E3F234F97A3E733195638BBB03FE279A0D61915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076955, "uuid": "2980fbb9-78c9-4221-a98c-6d93590679a9", "value": "3072:6PC+RjGkWa6s/qSPeAjQM6PBtCvbPgoixVsAfymUwwFB7DXNu:61fWa6s/qSGAYPB8vbPgoixVsAfymUwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713076955, "uuid": "3c8ad90f-11d8-4671-adb3-ef3c9ea1d8db", "value": 181882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713076955, "uuid": "af296a65-3aca-4117-94d7-035ed5a92c93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076955, "uuid": "90110aac-0b23-49bb-8e4e-add86c5b2f61", "value": "6de12036e5ca9b777013c151fd1c5bab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265620db-f9fd-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713057616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713057616, "uuid": "f8a775d6-9738-4f18-ba5c-3def6c63a118", "comment": "Malware payload (RiseProStealer)", "value": "6b3218fcfb9620aad3c78b9b881cd73a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713057616, "uuid": "ef129013-9e50-4811-84ba-ba7bd8199c6c", "comment": "Malware payload (RiseProStealer)", "value": "baf757d4426a783292c3d0e78885969d6dde83fbe6334865c888895a6d10023b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713057616, "uuid": "7fe4d991-3fa4-47ef-a826-ff137d0d4a32", "comment": "Malware payload (RiseProStealer)", "value": "e76d10f5945be91e22fd9c2370326eb827a8e513", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713057616, "uuid": "0ea93fb5-d131-4611-ba1e-62228ad260bc", "comment": "Malware payload (RiseProStealer)", "value": "8fc25a996c179b33012218ac88566a91eb2b6c4aee524424476f97f8a7152afb47ca7208596cbfd509123d1712fbe5be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713057616, "uuid": "ab939a46-8ed9-4a3d-aeb2-c5efc0f6c88e", "value": "T19415132136F0CC3AE82A05B05929D7E51EBF7C346A6486477A57373F1EBC2E14632396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713057616, "uuid": "90e1c9d3-4ff3-428e-acd6-7504b6a1241e", "value": "331af798bb33bd4e783ea7c89c6d7b97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713057616, "uuid": "43eefe3e-6a6f-4d5d-b40e-13c695a442c0", "value": "24576:Fgh1RByvVHGDvhp6f21HPg61LPm8zFORuK12S:FK49Ho1zq8XKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713057616, "uuid": "c99df015-6701-4020-b6d4-9e29309afc28", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713057616, "uuid": "3292a837-ed38-4ae6-abca-02cc8d07a902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713057616, "uuid": "2efc4aba-9092-4588-9c58-ceb22e13c651", "value": "6b3218fcfb9620aad3c78b9b881cd73a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d050aca-fa92-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713121675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713121675, "uuid": "797cf735-66a2-4b72-9946-5348efef39fc", "comment": "Malware payload", "value": "e086ce76999f267eb515d72797a96afc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713121675, "uuid": "4e9fb1aa-a5ba-4d57-9c5c-5eccff4af1a6", "comment": "Malware payload", "value": "bc1b38d36be44ff0b3f853d4cbfadc275bcf0898a9ca41607887b7d1eb2c124d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713121675, "uuid": "1a7525d2-7870-4033-91da-ef703f73efcd", "comment": "Malware payload", "value": "426084ea3a2416f9565ee5e4c6f8eccf23bf9d87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713121675, "uuid": "d281a90e-e2d5-4afa-a97b-f64662ee8adf", "comment": "Malware payload", "value": "a3b99925d70f038b666a936dc200eb3f38e4edf2b977d767408d466f45cf7f8eb0250ab4b674718d7c038310bde6d14b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713121675, "uuid": "a849943d-571e-40f4-a5b0-405fe9603161", "value": "T13C033B18BB950226C9FD6FF559B366070274E217DD03EB4D0CD899EA2B2BBC08D513E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713121675, "uuid": "dfd4a078-50a5-4a33-90b6-9422225c0320", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713121675, "uuid": "bc2c198a-4e51-4d9f-bce6-fede561896df", "value": "768:v5QFv4GAumU04pouLHJiVEW16Fp9HfJOMhd3Ogdk:vGB4GAum16dcEDFp9HBOMrDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713121675, "uuid": "7938d932-08c0-43d4-acf3-d0bdd9092c7c", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713121675, "uuid": "9dbaa829-45cc-4235-8f77-5f679ad6d224", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713121675, "uuid": "c6f91582-e842-4c1b-bae3-ba2a0f9a6b6d", "value": "bU8H.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1290f31d-fa7f-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713113417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713113417, "uuid": "206d95d6-0000-422b-ab0b-611c1c60558a", "comment": "Malware payload (RemcosRAT)", "value": "649aabec22c5f5edf97f0d5c97637f7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713113417, "uuid": "5efb63f8-c9ac-4a2a-b898-cac0ce636f02", "comment": "Malware payload (RemcosRAT)", "value": "beb33fcbb23f1c0a51e722c62dbf23f85afba9dc1db17e2b6eade15fa7ce7ff1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713113417, "uuid": "a07b0c2c-365f-4c3b-8e5f-9a41c2f8584b", "comment": "Malware payload (RemcosRAT)", "value": "6ce265229cda768355151664168b4dda7119945b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713113417, "uuid": "17cbea84-6e0e-463e-aa61-de248bd6d522", "comment": "Malware payload (RemcosRAT)", "value": "6f53c3a5a50bc9d076c7c897eecb316b538d97a70dcdb8c424beff2010093d75c12ba7df0970a6df84e32114339b3d11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713113417, "uuid": "45a47fed-b333-418d-87c9-3a22dc866acb", "value": "T11CB49E01BAD1C072D57514300D36F776EAB8BD2028364A7BB3D61D5BFE31190B62AAB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713113417, "uuid": "e9833929-b743-4829-8d88-373bd81deb4d", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713113417, "uuid": "5d15cbb6-79da-40e1-b4ac-bd9d4b05727a", "value": "6144:8XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNW5Gv:8X7tPMK8ctGe4Dzl4h2QnuPs/ZDbcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713113417, "uuid": "2025c2cb-c2bb-4cc7-9da5-999082d301d8", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713113417, "uuid": "453b6386-a32c-4da5-8b1b-c45415ecf535", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713113417, "uuid": "fd67e443-be8e-4768-a746-4642035b3ece", "value": "649AABEC22C5F5EDF97F0D5C97637F7D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e685d55b-fa65-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713102606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713102606, "uuid": "58fd2c90-0f2b-498e-aab5-d06c808e31ca", "comment": "Malware payload (Mirai)", "value": "7a49889da4ebb546b1fc3d64ad5f94d2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713102606, "uuid": "486ce1c6-b57b-4175-acec-5fb47ccfc427", "comment": "Malware payload (Mirai)", "value": "bec8f13b6afef733385c875fe8119730b30bf028870143365d9519fc813d4ee1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713102606, "uuid": "45f3afb9-2e62-46e6-aff6-b2d592e0bede", "comment": "Malware payload (Mirai)", "value": "69a78de2e7dac6b49d8d187e2e2bb6d438f77e89", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713102606, "uuid": "4ed5eed5-0b12-4ed0-b9d4-38686faeaa8f", "comment": "Malware payload (Mirai)", "value": "46f5fd346782cd5b3ce737b73e3cb89f95fec1d8b232beba1a31a0471fba9f8a9b6f153a98e8c83691e2685ee8e27258", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713102606, "uuid": "ad36d22a-bfdf-4e4c-bf93-588db138d9d4", "value": "T177E34C46EA818F13C4D5177ABAAF01893332A75493DB730699186FB43FC6B6E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713102606, "uuid": "0a23fbc7-d176-4388-844c-a14e70907138", "value": "3072:qJs9NARj5/Icu+NGtKfS6LL1gMv3kigvNO6bl7XgwxQK3gSLOfM/9JJLxh:qJs9NARj5/IctGtK66LFcO6bl7XNQnSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713102606, "uuid": "fe6aedc9-bf0e-4767-90d0-7dc4fbc8817d", "value": 146283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713102606, "uuid": "e7f36b3e-f053-4dae-b8fd-a6d9f1755d0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713102606, "uuid": "0cc2dda5-9611-4dae-9827-3fb96299ee53", "value": "vcimanagement.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1567861-fa06-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713061687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713061687, "uuid": "ce6ccc09-30ea-475c-ba20-51350cf04878", "comment": "Malware payload", "value": "0bf4ce4ce82328c9da402ec9732d7f31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713061687, "uuid": "43645df3-7d4d-473b-bfd7-036b22b6acae", "comment": "Malware payload", "value": "c012acb3765a8ce150a41293e7f48a69ee7598a618982997a15e805f0b2a57e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713061687, "uuid": "1f5c65c0-9abc-4ff0-add9-9fa5eda9c482", "comment": "Malware payload", "value": "ff884a1ac182aaa86e8ed6921e78606b31eebc7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713061687, "uuid": "c7dbc214-3ff7-46cd-b9c8-8485d3fc82e7", "comment": "Malware payload", "value": "0e43a85ca2a4f09b864bcc7de052054c79842b57ad31864d9a7ed1b1585bf660413389aa4b6b1154542bbf9f37879682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713061687, "uuid": "05bf520e-3e0c-4718-938f-182ed4816990", "value": "T153A6233FB268653EC4AA2A714973C250987BBF61A81A8C2F07F0691CDF365711F3B645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713061687, "uuid": "3779ae39-62f2-4c14-be78-af21e93418e5", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713061687, "uuid": "8f79bc89-3ede-410e-b399-494513c8162b", "value": "196608:IYXqGph5113gf3U1+W22Dq9zVeaO87v78MOex9NGQAyNy9xu:IJGX51SPU1+WK9hLRwlehGQFKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713061687, "uuid": "e526eccc-1d5d-46e6-986d-f53f3d218996", "value": 10118224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713061687, "uuid": "8605f7f0-f08b-489f-a404-3aad977d545a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713061687, "uuid": "7316f052-07c1-420b-a362-15b6414a71dc", "value": "SecuriteInfo.com.FileRepPup.25801.19165", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ead07ee-fa44-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713088285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713088285, "uuid": "b2c17d06-fdc3-48c9-8c7e-aec5494da619", "comment": "Malware payload (Mirai)", "value": "4fcc45775eb4779d48aef4b25b831e80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713088285, "uuid": "06832a6f-72ab-4ad3-b25d-e079f402abe6", "comment": "Malware payload (Mirai)", "value": "c08906ac6fd2b30a1437e9ee6565b52babe4f84c9cee523a058cd27b5c62fda7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713088285, "uuid": "3601ae8f-29f1-4a9b-bfa6-a84e0e0b684d", "comment": "Malware payload (Mirai)", "value": "aa92734630a72364c82efcd4336db45b08ce744d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713088285, "uuid": "40b07a32-732e-4c63-a775-8f44127e87f6", "comment": "Malware payload (Mirai)", "value": "849d8add90d6239c39c9e4568b075d0929d6a11af6b9678b6397755dc1f975077df42160e5f0e8299214c7e5b883e390", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713088285, "uuid": "e0d9d300-db02-48a0-bfbb-fb11a84e02d3", "value": "T138E3176277B60A27C0E0A579B1F75733B2B947C514A8C60B3FA11D8D6FA95903213BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713088285, "uuid": "60e0efa2-7300-4571-bd15-4d8f3c86af83", "value": "1536:kUieDQLDy+duZoeKyayi2z/lz2XjzhtVTMNH+wiCCLHtvqyTysGrio6znuO:aOU0N+pXAp+dBqyFo4nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713088285, "uuid": "69bd8745-99f0-4270-a605-67f1145ff708", "value": 150888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713088285, "uuid": "e1741891-de0c-4636-af20-255c5bdadee5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713088285, "uuid": "09c0254c-405c-44b0-ab7d-27c7c50aa893", "value": "4fcc45775eb4779d48aef4b25b831e80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b7be01-fa58-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713096934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096934, "uuid": "9f0ffadb-c750-4112-9883-a0880da9da2d", "comment": "Malware payload (Mirai)", "value": "d0c2da5f05963f0c2c2cea5da61dc44b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096934, "uuid": "8c343068-9e8b-4d3f-a9f7-e65e95124f66", "comment": "Malware payload (Mirai)", "value": "c1aaf42f7b5e9c7a0476ef09a513b4ce56823883ceda3bb819fc723980f97790", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096934, "uuid": "4b49f80e-0a21-42a2-8393-95e13c949131", "comment": "Malware payload (Mirai)", "value": "287e4717872b76ad178c8d5fe7cc65a4166665aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096934, "uuid": "ed19760b-941d-4d67-bca7-c361469b0ad2", "comment": "Malware payload (Mirai)", "value": "a5a1f4efb403b8833f2388bd2069bda6e151d75af958bea3b50d704b8ba9248094765391bf8f0af23be1dfb5bddf2fbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713096934, "uuid": "6850a8de-f34a-4fbc-9eb3-943e53bb70c6", "value": "T1EDE34B46EA818F13C4D527B6BAAF41893332A764D3DB73068D185FB43F86B6E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713096934, "uuid": "43efd83e-380b-4c49-b133-3e13f6cc4a60", "value": "3072:xEYsjVxdugyXFtkpJL89tIFjPYK50woBqAqDrUjM/9YAFBX0:xE7VKgGkpJ4bmjPYK50pBEDrEM/9YEBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713096934, "uuid": "cf2127a8-29c0-4f90-b7d3-1eadc5385edc", "value": 156998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713096934, "uuid": "83793e00-446d-40a8-97c6-f323e5b0e6d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713096934, "uuid": "408046aa-124b-4e8d-9be5-ff72578687ed", "value": "d0c2da5f05963f0c2c2cea5da61dc44b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9c43a4-fa9c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713126215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126215, "uuid": "3656c212-4893-4630-bfde-89321864c33f", "comment": "Malware payload", "value": "2bc99a018da0650c9bc0fa56c7c79320", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126215, "uuid": "ae1ac9fc-dcc3-48a4-8492-d3dc8649a709", "comment": "Malware payload", "value": "c3b9ffca2b7f5c9fdefb39d6c13d657769ec140efd4513842dbc68adbad99efa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126215, "uuid": "dad66088-44ba-46b1-beec-91173d4b6cf2", "comment": "Malware payload", "value": "f25a1690f4bb55010b710f2c142082d47f189b5d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126215, "uuid": "a602ab58-f9ac-46a9-9dcd-c06164ebd5cf", "comment": "Malware payload", "value": "64e48863f1d1cf8ba18511c254e2d1f68cbefa02b4d5b6939a81f03ea87d605b143d86da013172ba30650077957f2052", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713126215, "uuid": "ef92a552-ddd4-4962-92cd-a829f70dd4f6", "value": "T13EE31985FC509F26C6D221BBFF4E428D372A1768D3EE720399255F20379A95B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713126215, "uuid": "663d0853-04da-40e7-9372-41e5826257e6", "value": "1536:C3BLVWVHCVPJUpbC19Bw0spuLhAI0ztUADcyBTZhnhZhFOxOy990BkI+p+a/ldO8:OL0hQ7sELhUeAVB91hZ/MQkRp8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713126215, "uuid": "2c2262bc-cff3-4bd7-9d17-467df6b4deee", "value": 146368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713126215, "uuid": "474ce55c-d10b-428c-b5ae-eebf12608830", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713126215, "uuid": "b8be1fab-dea5-423f-8668-f8dc1f7bb567", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f81666-fa42-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713087255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087255, "uuid": "2d556452-b2af-422c-bfe1-9ec8ccd83478", "comment": "Malware payload (Mirai)", "value": "da62b4329ce3ce702a1be9f1b6013934", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087255, "uuid": "d9c0945e-28f8-40f5-8756-69c242fa14e1", "comment": "Malware payload (Mirai)", "value": "c4e88acac0459deb7aaddbb884eecb5f4e25f25d9e31494e2ba32ffb69cbf2c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087255, "uuid": "c8d2324f-fd1f-4df4-b6a9-5658f2a651f2", "comment": "Malware payload (Mirai)", "value": "34e606e24e708aaf7aaa515c93ebb5cb240775d0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087255, "uuid": "6b18504c-be37-41ab-8295-f0870e9bd5db", "comment": "Malware payload (Mirai)", "value": "4a46f057999fc7cd1dea59d0686b44c05971d850415067dbb3f31ed433bed7c8b3a23d96595bcb4bb8cd99fc15ccc138", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087255, "uuid": "e711976d-3973-4c9e-9d41-16375234a12d", "value": "T111D31949F8814F13C6C652BBFB4D428D372A17E8D2EA71039D216FA1378B95B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087255, "uuid": "1daefb08-7a90-4186-8e8f-dc72ccef6c55", "value": "3072:GrpjAZDhhsQSiiLGXvlmIF5sJ1LsuM7wjfJuP5pF:OAZDQQSKXvlPsJ5suVM5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713087255, "uuid": "74852d84-d832-46a8-816f-e61c6678a47c", "value": 137448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713087255, "uuid": "fbd01ea5-995c-43fb-941d-76f49f709f79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087255, "uuid": "82b527d5-b88c-4dc8-9b8c-d52a3cf880b2", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8011d933-fa5d-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713098998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713098998, "uuid": "e7a22496-b0f1-498c-ba6a-5de213d8665e", "comment": "Malware payload (Mirai)", "value": "843aff9d410e187e3c8e888e07d1cd2f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713098998, "uuid": "2799c150-22e6-4977-8c9c-efbbebd4b05e", "comment": "Malware payload (Mirai)", "value": "c5188fc8ae3bf7238ff832c7b68a55008ad31d76dd21260892b2aa164cccd6f3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713098998, "uuid": "df85043b-7dd8-4c1d-8fde-c9754ef6990c", "comment": "Malware payload (Mirai)", "value": "46b54ec9eabe3be22ed426fd99380a0b3f9325aa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713098998, "uuid": "cee3b12a-4b6a-4f54-8895-cc9e1de0a7e2", "comment": "Malware payload (Mirai)", "value": "63f652f76d071f887d847cee09e144154cde0b983644dec0bcb1737cd713f65e8b90356549f24a0904b7941037c0dda0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713098998, "uuid": "ee3744c4-f04e-4b26-8730-1382c28c5f7b", "value": "T17931219553D05DF9CCE451BFAD5603107368AF80E0C733A392086715BD2ADBC5C2348A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713098998, "uuid": "604098d6-1a66-4215-94d7-58409b1a1f0d", "value": "24:hpKGpa7Urz/jlfYLfCzXK1G9Vev3gRGiJ9iMi/NBukel+GlxrR+zHGS90t:7KGpa7UrLZYLKoRACNBuk6TlxrsHGS90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713098998, "uuid": "41326a4d-14b0-4dda-9f00-5962e5257fbc", "value": 1448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713098998, "uuid": "a66e3a53-33ec-4b6f-af47-f6e299756c86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713098998, "uuid": "7d927339-b5f9-4df1-a4cf-56cc2dbf43d2", "value": "arm6-20240414-1249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afdc743-fa02-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713059932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059932, "uuid": "07b550b6-0622-491b-bec9-50bbaac417e5", "comment": "Malware payload (Mirai)", "value": "c03130eb73d39b14670f4d28c68c3532", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059932, "uuid": "e51da478-a212-4bdf-9845-54c1174eb565", "comment": "Malware payload (Mirai)", "value": "c7d81335f2aa6d4661e58a0b343acd94b1bf2a234ebcc3a2309a7f6ef010e5ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059932, "uuid": "983806c4-c5bd-4807-9225-7a293cbeea32", "comment": "Malware payload (Mirai)", "value": "41c1fb9d3f6bf12dda2bb903b322ead187353be7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059932, "uuid": "c49aefcc-6655-468b-8545-b191068f6033", "comment": "Malware payload (Mirai)", "value": "9e6cda6fa429ba7b230aca6e0d1916612c7621aa2346c2e30ba266cf5f675000f89cdc5f6e1ceed937ac47f335a7f4dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713059932, "uuid": "2f0a336b-0cf8-4c9b-a28f-549beb5969d4", "value": "T1F0932A45BC928A02C6E422BBFB2E118D372963E8D2EB3113DD205F6437CA92F1E77555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713059932, "uuid": "a4af51de-28a7-4fb2-b9ef-ba2224e4fea0", "value": "1536:gyKd61d2QFjbjQuq5s41V6a8YuLTv8aqVnjHB/YzZJ7fzuFa9Gi0NPH:pK81dHFjbkhjHJuLTkBjHuV9ruFa9Gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713059932, "uuid": "c7f535d1-bd78-4a5a-a9e1-ad6dfe734fca", "value": 92504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713059932, "uuid": "b57e46c4-e15e-497c-809e-15b5afc74d29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713059932, "uuid": "5f426ba4-0b5c-4272-a4d8-59c7b404f5a3", "value": "c03130eb73d39b14670f4d28c68c3532", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "357f05ed-fa2a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713076968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076968, "uuid": "56dfbb0f-d965-4389-b4be-6c0515e40aea", "comment": "Malware payload (Mirai)", "value": "66cebf4f5621274842dffd5c5e1ad0e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076968, "uuid": "5f44d6b9-5ed5-4a7c-a634-a99fc132b1ac", "comment": "Malware payload (Mirai)", "value": "c90fafea556a851702a9555f3397fb3a1c0e43a1c8694458a1df4baeec9e8492", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076968, "uuid": "bc92d754-4f24-4264-a059-c0641098cff9", "comment": "Malware payload (Mirai)", "value": "6cc9533ff73d8624fb594b95b2844011c2fdbf5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076968, "uuid": "93ad330c-be27-4ba4-9a55-3c00e9141c67", "comment": "Malware payload (Mirai)", "value": "94290350378bc42ab7da6523063e393de80c21f0d2228d997d39d6c4a42c01e525897ec2ab6c31de1a93ff18427b1ec8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076968, "uuid": "b76165ae-5e27-4743-aa40-06bd37a6ea70", "value": "T1FCD31AB3F504DE66F00AE67208D38B257E70FEE30B63156263173A6AED361C5285BE45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076968, "uuid": "f3c1af35-223c-4ab2-a749-2040122a499c", "value": "3072:3v/xY5MqJdV3QeuacWjcW0JcWcBUsbWAxpk5k78tHZEmm2s0UzZ6l0Nu:3+ldVQeuacWjcW0JcWcBzbWkWG78t5EO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713076968, "uuid": "32172465-6c2c-4bff-93a1-cec2ed2ae805", "value": 135609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713076968, "uuid": "24c53a92-7928-42a0-a01e-90c94375ab53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076968, "uuid": "8bf91ea4-bf81-40e8-86f7-6fba00333ab1", "value": "66cebf4f5621274842dffd5c5e1ad0e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a91d6ac-fa5d-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713099015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713099015, "uuid": "496c1400-1a85-484a-8af3-1f6afe75dfa4", "comment": "Malware payload (Mirai)", "value": "c44e8ffbadf99f89d5f9d472b8dbfc8d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713099015, "uuid": "155e897f-feb4-49ae-89aa-bf742869b974", "comment": "Malware payload (Mirai)", "value": "c927eeadc43a9f1b64d213bba80d7c25154f420634c7acd2eae7d06c1a20b738", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713099015, "uuid": "d14c0a90-52e4-411b-89f8-11a71fecf61b", "comment": "Malware payload (Mirai)", "value": "a706415734001dd0417166759c4531022972d7ca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713099015, "uuid": "8014b5f9-9090-4831-9a4a-5d6db3878b5d", "comment": "Malware payload (Mirai)", "value": "556ea6280ec0f6eecec9203a408524ade0d72c47279d0a91a283f1d4afe9c9ebed3c98b43bc7f813fc865b168c99a6d6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713099015, "uuid": "87fe12f1-6ba2-41d2-944c-821f00d0ae56", "value": "T11C21211397A1BCFFCC5A61F9597702B69F6188ACE7259207350A2F069D0F2C01C516A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713099015, "uuid": "95d942c7-80b1-4861-9fd1-2646544584fb", "value": "24:GY/YJHZAo6m1gWi0DmeKdqbNhmOt0SR2rpNPEuG:GY/YJZQm/DmecqbefrpNNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713099015, "uuid": "dfb3339c-1f31-41db-b865-5a3c90af96d0", "value": 1336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713099015, "uuid": "1726f27f-d653-4a0e-9041-d10b829cbea0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713099015, "uuid": "c2ff2269-e8ae-4b00-be76-34f2eab61ea1", "value": "x86_64-20240414-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2142d40b-fa42-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713087242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087242, "uuid": "48884e57-ebb9-481d-beef-f26b1ac7cae2", "comment": "Malware payload (Mirai)", "value": "a7a1124be172e1f50e36feb7855c9a9a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087242, "uuid": "ec274be6-81ae-49c8-b33d-af0284d6bfeb", "comment": "Malware payload (Mirai)", "value": "c97b6679904cf85b90b30c3898eb6b16558870390757005c3007e9ebe47b78cd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087242, "uuid": "2ed558ef-a671-4a9b-a821-2410d5b412b3", "comment": "Malware payload (Mirai)", "value": "9b40e0840a6b3b551984511e1e8a4f94647c9dcc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087242, "uuid": "a622492d-7bfd-4c8c-a50d-6c764f668e34", "comment": "Malware payload (Mirai)", "value": "94c23d1d3b8984836ada536f6ff7a11c116705db8a138fc18a1e0ac93ad476a7c38d3e59871f93b968ee53cee3cdddec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087242, "uuid": "8710b722-71a6-4cc5-8a22-90fdc7d84468", "value": "T16A143A0775C580FDC8DAC1744BDEB93AE933B4AC1225B17B27D4AA225E5AE311F1EE40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087242, "uuid": "452dff3c-2279-452f-9ce3-b73f3bb23e2a", "value": "3072:S5CltdsX1viyo+3wvk828SK2JE+VtiQ/Mp0wB5:S5CJsX1viyo+0ewVHB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713087242, "uuid": "49287061-d917-421d-8f06-24b0dacea9bd", "value": 190544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713087242, "uuid": "39658bb3-7e6b-401e-870a-f3e73bd38ebe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087242, "uuid": "37bc8e48-38d2-49e8-8dc4-c8424011dc3e", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e98a56c6-fa6b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713105188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105188, "uuid": "55cbc067-0c7f-426a-9031-f14c00d734a5", "comment": "Malware payload (Mirai)", "value": "09a4e4cc04ab65def23a2f5f50e19ab5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105188, "uuid": "3410f698-3e6d-40af-a08f-d06986cfe77a", "comment": "Malware payload (Mirai)", "value": "c99be2c4b00466d263345d3a18200e0828736957cbff3377a9bcc1f8d72701ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105188, "uuid": "b9630715-3eee-4d96-a640-046c99759fa3", "comment": "Malware payload (Mirai)", "value": "ea58fead80f8f8b1723dd74e8aa0b85331cbb8c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105188, "uuid": "7146cff7-af48-4487-9b90-a06c4b57fbd9", "comment": "Malware payload (Mirai)", "value": "4de921b61f18bad9fa6887c623fa251bf505e23c19dca849188a1c068b52d03bd0faf4d1dfb21a19f2bd85f7f8cb7f66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713105188, "uuid": "2e2686ce-7fc0-4ffd-90f2-d22d4a072c2b", "value": "T16763079678C19A12C6E423BBF96E01CD332563A8D2DF321B9D212F5477CA82F0D77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713105188, "uuid": "b3a265f1-6688-4bc8-886f-d9874074a683", "value": "1536:U69Uvb15Wu1S7+hIVt5f6pxCCpRT8PyOcahWMUXH4g5b9/e35uEfh:U6ex9RIyOvhTNgm3nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713105188, "uuid": "556970b9-0bc3-4961-a206-86689a6153ef", "value": 72188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713105188, "uuid": "4afb838b-c9ad-4c66-ad49-d71c1fb0af75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713105188, "uuid": "9a1d052a-72eb-41cb-a7ab-bcebc5e28d32", "value": "09a4e4cc04ab65def23a2f5f50e19ab5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726fd939-fab5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713136771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136771, "uuid": "036bb7a2-5edb-40ea-b708-94a1b8d2e869", "comment": "Malware payload (Mirai)", "value": "4295d47546e5ad322e0c84a16f198889", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136771, "uuid": "24a56e71-2051-485b-82ce-d50ebb1f1b80", "comment": "Malware payload (Mirai)", "value": "cc62aad56ee7279a1a753bee22caed721060056fe1924ea36e1301bb91d384eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136771, "uuid": "72fbb609-f030-4f6d-95ad-d28d0d1314c7", "comment": "Malware payload (Mirai)", "value": "6c29309ec479c067e79acfc163959ed452b5466f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136771, "uuid": "7a4a3c1e-0858-4511-bb5a-fafd1959bd6f", "comment": "Malware payload (Mirai)", "value": "9f4188f4aa45ab25f83df7e0d0592074e9a77cd403a516a0806032ce9518f782651b6d48967ef6d75ec4702ef1f2a394", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136771, "uuid": "68fe218e-c3b2-4ef1-b9c2-891a2090c901", "value": "T15A63D847AF604FBFD82FEE3705A90606359CA51713A937393534C928F64EA4B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136771, "uuid": "f2d63600-3bce-4a2c-8a6e-d08e3ee6061d", "value": "1536:k1z4r3aOmNOl55425y62eZ3ZWoZTvE0jRg:sz4r3MNgy62a3BNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713136771, "uuid": "eafbd988-792f-4493-a028-3dc2b229945e", "value": 72904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713136771, "uuid": "eb162954-7fdc-435f-b4c8-3deb515bc88c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136771, "uuid": "b2ce5c84-f58b-4711-bf06-6d84235da256", "value": "4295d47546e5ad322e0c84a16f198889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141616ce-fa6e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713106118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106118, "uuid": "3087681b-769c-4364-b087-e7e524bdb7cb", "comment": "Malware payload (Mirai)", "value": "807986f31ab85a5669c59ad0c8db2c7b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106118, "uuid": "7ac22863-4dd7-444a-81ae-fc879ce3e7b6", "comment": "Malware payload (Mirai)", "value": "cf94289782374776acc2fd749b721539ea58ccb2fcddd2fbb8dc556f7e6b3eaf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106118, "uuid": "3a05b3fc-1106-4a10-b328-6f94dc8273d3", "comment": "Malware payload (Mirai)", "value": "14fa582f8b944181ea7ed5e1b385e9d61c73a1ba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106118, "uuid": "704f260a-781a-4855-8d6f-902982a2f05f", "comment": "Malware payload (Mirai)", "value": "0846e3d7bcee3ea1d8db5eebbc46aef8600698cdae47ac7cbff43854c2c463fdd681a44aea37720b1f2fc2bbebb32af9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106118, "uuid": "be0ec2ba-1875-4b73-b76c-67d015e5f6a0", "value": "T165E30A56F8819B12D5C111BAFE1D128E37131B78E2DE7312AD246F747B8A87B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106118, "uuid": "79944f75-c484-4f5d-ad69-68d5d3a24a0c", "value": "3072:0CK/UmbgWz4XFQ9sHwIaOOxGjBPCm3CR5Rjv:0CCpn4XG6Hha9q/3CR5R7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713106118, "uuid": "1393c55d-2abd-4755-9f5b-a5a20e125268", "value": 143260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713106118, "uuid": "617631b8-a6c9-4735-a759-3b0a0a46d948", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106118, "uuid": "80f03855-a7c1-47e5-a6c4-3573cc799d5c", "value": "vlxx.arm6-20240414-1448", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da903d45-fa9c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713126208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126208, "uuid": "630e36ef-df85-4858-9bc3-f926f8ddf9a6", "comment": "Malware payload", "value": "7dd1328c8b65428d8ebf788eaff0af26", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126208, "uuid": "fa744190-71c2-42b4-b1b8-67c7402a7664", "comment": "Malware payload", "value": "cfed0b36678bddecb63cdbc437860dcd72a66eb3c3c5a169d6d7e0bbc76bac4b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126208, "uuid": "473c930c-2e96-4edf-985d-8f164e956819", "comment": "Malware payload", "value": "e9aaf7735bef233da5bf9ac40f2492abd7e4ebbe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126208, "uuid": "df0e821c-7308-4367-9313-c26a29d9e5c3", "comment": "Malware payload", "value": "996a5a36d3cdc2401faa59594a52a2d5b591ce8b10586c05a4d592a07d10e2fd1c38aa0e7042125135fa2cd71065d1d3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713126208, "uuid": "e39dbff9-a046-4b48-9465-37e50ab59103", "value": "T14D14961E6A328F7DF669873047F78A21A76D33D623E1D645E2ACC1105F2029E541FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713126208, "uuid": "6a89d913-fceb-4b73-9692-8855adc777a8", "value": "3072:qHsSeg2hEXrJgM765cC/gwbEQvreI/R84Ah81Q:qHsSeZhEXrJ27/vJTeR4AoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713126208, "uuid": "1c5aab99-3a44-43a4-8565-8511a12ec78d", "value": 199520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713126208, "uuid": "aab7b218-b75c-48fa-a1d4-e1cda841f5a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713126208, "uuid": "9a21d23c-7561-40ab-b222-ff66a188593f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d282477a-fa72-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713108156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108156, "uuid": "9f322911-0c78-47a0-9204-ce747e1bb3d9", "comment": "Malware payload (Mirai)", "value": "3ecad8fb0c8f4935b75933c89da41af5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108156, "uuid": "49b973c9-e216-4a7c-adcc-bbbb85a5803b", "comment": "Malware payload (Mirai)", "value": "d0c69e51d31fdc4d775a0b6163123c74304b70ab41481fad2d6b0f29194ac0ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108156, "uuid": "3652fb3c-51a6-407a-b077-73c8d1ab2725", "comment": "Malware payload (Mirai)", "value": "0592f8c0a631cbe9a09070899920ffc0fba74f65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108156, "uuid": "1fe40901-9a0d-4304-b65f-9b5165324ca9", "comment": "Malware payload (Mirai)", "value": "ee8ab627ef556067194f0ddf7dc0828c141b51975b68987cc3618e1da48d1d9f40f2527cb3d854e665a51d01ebad56c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108156, "uuid": "3cc6a47f-ef29-4ced-9f0a-a82419e151d3", "value": "T1B3833A22BA761E1BC4D4A8BA62F70325F1F24B9A24ECC61A7D710D4DBF6064026477F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108156, "uuid": "296d31f9-7c4d-4739-b351-42e2ef2e3bd1", "value": "1536:EPljSSn8VDHZNhwen+vHjDjtc5Nk5fFCQNriGtBciGBy:EdWJCeIe5NUw+wBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713108156, "uuid": "5c5d3d84-0d36-4667-9dae-38442a654b59", "value": 81124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713108156, "uuid": "cfdd993d-0be7-45f0-95d7-3d5fe63f3bc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108156, "uuid": "802f9b9f-6856-4cb5-9fb6-97401aac0830", "value": "3ecad8fb0c8f4935b75933c89da41af5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29cf1b1-fa72-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713108183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108183, "uuid": "db5454b3-9482-42bf-95a2-b5974eac0a57", "comment": "Malware payload (Mirai)", "value": "6cb8d5511979aab81d86862dff59a885", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108183, "uuid": "b01e4df3-b27e-4418-8d9c-b5cacd0596e0", "comment": "Malware payload (Mirai)", "value": "d11df60d751887527423d1af67efd8d2c388d928e008a940d8164a018a13374c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108183, "uuid": "68f7501d-cae3-453d-bb57-a4c8629eea94", "comment": "Malware payload (Mirai)", "value": "a927f205981598397eb329b84b224c383b41022c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108183, "uuid": "62d7ef8b-177c-4257-97cd-de7e6f591196", "comment": "Malware payload (Mirai)", "value": "deb1d8a9f6e5d7a96b624378c8bba2a26cff109a1c81f922028905b6858ee2504dc2db0363ee6ed7e53dc8bbe5e51b42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108183, "uuid": "1f7d10bd-5c93-4775-9589-caf6fb6f2972", "value": "T175733A42731C0E47D0675DB02A3F2BE0C3BFA99121F4F689651EAB4692B1E365186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108183, "uuid": "f964cab1-c5e7-404f-a346-1a86ea11683b", "value": "1536:FjhOPFdZZ9qJ3j8h2Uvsi4rc8BSJIgoDUMDes2kOSivT:mfh4fpBSJIdDOPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713108183, "uuid": "4c584479-0fb9-4644-bec3-6d248fc56850", "value": 75608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713108183, "uuid": "26781d27-312a-475e-9706-7521cafb0f45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108183, "uuid": "490bd6d4-f3ca-4c44-95d1-027b0dc32b55", "value": "6cb8d5511979aab81d86862dff59a885", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4b4d00-fa58-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713096956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096956, "uuid": "b630b1a5-b20b-4720-91cc-cc5117f659c4", "comment": "Malware payload (Mirai)", "value": "0847b4018a2afffd6e67f6345009e345", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096956, "uuid": "d58dbd68-90e7-4919-84ec-bf6698708911", "comment": "Malware payload (Mirai)", "value": "d1243388aab4d37712e7d85f9a6e98ccd67b10589766896ed71bf8553ac94faf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096956, "uuid": "c3813ffa-f6c1-4a78-8500-c8c5775f95fc", "comment": "Malware payload (Mirai)", "value": "f4a533422ec9869ebf9428236f3de40f36eedfa4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713096956, "uuid": "15cebb2b-6fef-4a7f-b88a-b08432ede7b8", "comment": "Malware payload (Mirai)", "value": "ef1235aef4d94fd0efc34f38194cbe6f895144e3d38d0626bb7c266b0852ef8ef47f397dbe303fa8d9132d6c46bb9a8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713096956, "uuid": "1436f66d-c44e-4c3f-b09d-ccb43916966a", "value": "T1BA930846BC918E11C5D422BAFA2E118E331263B8E2DFB213DD105F6477CAA2F0E77556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713096956, "uuid": "cd20bcbb-15de-4f22-b9ea-c246dc5bfb04", "value": "1536:Jnwn82iLavbcSOVIQuo5sYg2565FT197sdTZfaSo//2Vc7Ioi/zJB4XrKP:J6iL1V5ussOYP1m11owzJB4Xr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713096956, "uuid": "28cfb5a9-1aba-46a5-8388-2452f12bbdce", "value": 91500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713096956, "uuid": "f6a5738a-d533-4078-89bf-fb849aa94674", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713096956, "uuid": "e61e92d4-536c-4d89-b3d3-8592cfe9bb95", "value": "0847b4018a2afffd6e67f6345009e345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82cb114f-fa02-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713059918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059918, "uuid": "15a253bd-9e8e-46a6-8722-5b0548d1cf93", "comment": "Malware payload (Mirai)", "value": "604f52f4443b53f21124a85e68a1dafc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059918, "uuid": "fed1c901-1550-4f25-bcab-a7eca696494f", "comment": "Malware payload (Mirai)", "value": "d1ccf54d466c5212ab479d5791e0a660554d1d4582631a50b748eeedf724be19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059918, "uuid": "4a2733d3-1f7f-4a94-9de1-9d51cc4dd6d7", "comment": "Malware payload (Mirai)", "value": "5e8373d2cb1a85155408e30ab3f7a93130e22592", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059918, "uuid": "bc0e8686-3974-4e38-8909-e426dc03a521", "comment": "Malware payload (Mirai)", "value": "ef9a3bb6b31584a291490a98379fab7a4135df8e4f956d6c3428c7fb1326f6bdceaf1d8f129e09275ed34ebf24942a2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713059918, "uuid": "e82921e1-b435-4520-82fc-9bde68acffcc", "value": "T152E3D61A3E258F7DF799923947F35A30966836912BE1C045E15CEF002F3138E685FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713059918, "uuid": "a135ae54-2c7a-43db-a036-762dbbe3b862", "value": "3072:x6Z9ry9otRABvESe/qoqPRwhuWPmb4cmvFhYTA:xyry9otRAB8SstvuWPm0RyTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713059918, "uuid": "157f40b0-30bd-429d-85fe-56f14376b5ab", "value": 151670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713059918, "uuid": "be0233b9-b77a-4c9b-91ec-8e71cad04dd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713059918, "uuid": "dfabf3cc-1147-4f55-b7d1-61e97bb4a649", "value": "604f52f4443b53f21124a85e68a1dafc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe482ce-fa72-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713108151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108151, "uuid": "1f28d6d4-4d26-42d8-aabf-26e36d2f3a70", "comment": "Malware payload (Mirai)", "value": "45c1efe5f2853054a7f4216f7ac41918", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108151, "uuid": "f206ca7b-75f3-49a5-a2fd-4d138159789f", "comment": "Malware payload (Mirai)", "value": "d32291545c56eab82f30326694e2963d05fbf7a84e75442566cc626e04d9e174", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108151, "uuid": "a07faa53-bcc2-42a0-8d99-530c30c0591c", "comment": "Malware payload (Mirai)", "value": "8cbfc65739c214d39abd29acde4976caff52ac1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108151, "uuid": "a4312c6c-d2f5-4df7-bc76-14c088c90490", "comment": "Malware payload (Mirai)", "value": "ba9f94d737a1804a46086a8f01a01b3052aae2c83e54d2895208a4e6cd3db3875627807792cfd9a4d67cfdf4cb304d07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108151, "uuid": "69cec26a-0a46-41c8-8d06-6bf0e1163918", "value": "T16DF33B46EA818A13C4D2177AF6DF424533239B64D3DB73069928BFB43F8679E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108151, "uuid": "fe6aa8bb-0eef-447c-9ce8-4add5d5eeeea", "value": "3072:30MUdehIVNTkaGGiuM1BB6+5rhW+cq3Ma/mCGM/9zODF9z+:30MUMhWdkaGGiuM1D6gWduMa/mrM/9GK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713108151, "uuid": "b2fc6b5a-000c-4fd2-b1b1-fa8637b68380", "value": 157306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713108151, "uuid": "748e4559-7b7c-4d7e-bc27-84657e70adae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108151, "uuid": "aa401244-5462-4420-bc21-3ea1bf5c958c", "value": "45c1efe5f2853054a7f4216f7ac41918", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a89ac7-f9ff-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713058817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713058817, "uuid": "203a3ec7-a00d-40f2-b83e-87953140601c", "comment": "Malware payload (RiseProStealer)", "value": "3dd4ded8937cf515194fe34d4382d949", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713058817, "uuid": "23f6412e-6edc-4f20-a6ff-8a0dffb964a5", "comment": "Malware payload (RiseProStealer)", "value": "d55963645f59ad463ef56f97933de1acceede3aa831c1e0b3a0ecb53011bf5ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713058817, "uuid": "5af29348-5d89-4ca3-ad03-f42630bf0b18", "comment": "Malware payload (RiseProStealer)", "value": "a97cd2bfa68c4418cb4ae871a66dc9c4205b0da3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713058817, "uuid": "5ac065cc-edc3-490e-b1da-3e06cf961153", "comment": "Malware payload (RiseProStealer)", "value": "6505913ff6ad74273463b0245f0599f7a9d16e5ed9f9f516d86c39a2922819fdc9f701c2de157c3cabaf8996a66588c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713058817, "uuid": "8d513488-6915-4154-b690-d87bd56304df", "value": "T118B5339267749B37CFBFB37009DB56111DFA74028AA1B55D648EBCE3766F228A384007", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713058817, "uuid": "c7ac1109-7cb7-414c-944c-ae7e1eb19ef3", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713058817, "uuid": "215ff82c-d5e2-4bfc-bee2-04b94c8327aa", "value": "49152:XSUl6vD5DxN6HHLJ9tiOZSwyomaCju4Y7w4yQQ+G4hSGs:XSSwD5DxkMcfUu4YwQZGkds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713058817, "uuid": "0301765c-f0f5-4378-86b8-cafef63e8bf1", "value": 2274304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713058817, "uuid": "00d428ad-9ccc-42d5-aefc-bb8ea2652b81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713058817, "uuid": "8adbad54-f06b-4045-90cb-108cfca6b346", "value": "3dd4ded8937cf515194fe34d4382d949.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c1bb17-fa10-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713066017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713066017, "uuid": "527395c0-0c4e-49ae-b6b1-105f6357a702", "comment": "Malware payload (RiseProStealer)", "value": "dee688451dfcd52d620e8c8201a7a5bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713066017, "uuid": "0e11a83a-68c4-4593-b527-d22176481733", "comment": "Malware payload (RiseProStealer)", "value": "da45b9473e33ec85d94bbf19ac10b86453ea7527e8da86040384eeb3105d6cff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713066017, "uuid": "9cd2d106-3bcb-4cf4-84c1-516bf2b76a8e", "comment": "Malware payload (RiseProStealer)", "value": "4f798d70892251af7c0e31ca56f79abd7252ceff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713066017, "uuid": "b2a9df97-3eb6-41aa-9a61-15ece457f15c", "comment": "Malware payload (RiseProStealer)", "value": "ff1e62a6a0415439b3f74edea02e938a8de3f1759a54b9f14e7332b222a2dc5dcda72ad5f8cfde489e65ab59b575a80c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713066017, "uuid": "191e1be4-04d6-4c95-8c33-78a96180b2a8", "value": "T12EB533CECDB15714CA6AEB3166CBD412EE7039484034049DAACF3C637E7B586BF169A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713066017, "uuid": "af71fbba-2bc6-4e69-a6ed-c53ba03beef5", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713066017, "uuid": "7dff3a9f-db7e-4249-a84f-09f50aa0ccd5", "value": "49152:oSUl6vD5DxN6HHLJ9tLb69B7Bz6rmPxwg9c7SEDkVz1ZYL+sZL:oSSwD5Dxk56j7B2rmPxwXXDkVzUnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713066017, "uuid": "ef03bc8b-af1c-4081-bcce-c4677671af81", "value": 2311168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713066017, "uuid": "e49fc685-a353-46bc-9df1-67b717a547e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713066017, "uuid": "5cba87aa-1213-42e3-b3b6-5cecbc871575", "value": "dee688451dfcd52d620e8c8201a7a5bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3176b60a-fa2a-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713076962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076962, "uuid": "b9905577-adf7-4f45-a620-5f7bba1a07dc", "comment": "Malware payload (Gafgyt)", "value": "5ec7147fe992e7f7fcf629193ad29981", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076962, "uuid": "4ff80ef1-f622-4325-b3fa-1923ef8d6d46", "comment": "Malware payload (Gafgyt)", "value": "da6046de95d47e04456e98604b7fd420beac4ea917eeae1766d537c61d5d8d11", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076962, "uuid": "bf1da043-5d1a-4624-b71f-e816f0137ddd", "comment": "Malware payload (Gafgyt)", "value": "8e084f77d83195d5a0ebf0df267a0a7be69cd7ab", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713076962, "uuid": "df9c3429-c2c5-4b84-bb84-b01a8888917b", "comment": "Malware payload (Gafgyt)", "value": "b986b56589a68ca82ac1086b08b2ad6989c6df7768b85ee3e1f97a2f626c9c801f24f9904959070962fdf7abc18b0561", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076962, "uuid": "9e37b271-b52a-4cb3-9c06-cb3edf274298", "value": "T10CD30837D654887AC04712F11BEFC6229D23BCFB0731215723987E605F378AA9E99B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076962, "uuid": "b6bcd6bc-79dc-4bf5-8113-73f7422e0495", "value": "3072:7GGZgLD3hhI2fKGHOZOSp6iK3KkSmr1zwTdWNn:ODBvcuK/mr1zwTdWNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713076962, "uuid": "4e6b677c-7515-438c-9dbc-0d5373c05807", "value": 132185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713076962, "uuid": "9623dd00-b15c-45d8-b2ce-d37275f39a1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713076962, "uuid": "7d1cafec-131c-4acd-9353-b57322af2606", "value": "5ec7147fe992e7f7fcf629193ad29981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88596bfe-fa02-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713059927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059927, "uuid": "0bb09c24-b946-4817-b382-7fba06d4c735", "comment": "Malware payload (Mirai)", "value": "669fd3cb15554ae292bac7ad853afc4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059927, "uuid": "11bf3202-5f1e-4420-a64c-949b9669dfec", "comment": "Malware payload (Mirai)", "value": "dc489ed62a36b034c22dd55d0d3f7834272135376db5858f6517688e2147857f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059927, "uuid": "9ca57d16-03bf-4a2c-b768-6b3bad68f4d2", "comment": "Malware payload (Mirai)", "value": "10853e2f3bcc3c74c5bdbe1659da502b8691fb91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059927, "uuid": "001cf80a-6177-4ea1-be23-d462153aea67", "comment": "Malware payload (Mirai)", "value": "20b5065d0569288120a52269f784319ad0d0f14492a40381bf20d3b51664193e99edd8e0d23d3390e9c38e98acd06022", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713059927, "uuid": "5d1fbb60-c944-4e72-a89c-f39d433e2d3e", "value": "T1F6B34BC166A3D9F7CC820B7512E7EB314632F97B272D9A46E35CAEB55E066C0704720E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713059927, "uuid": "d81efab9-0ba2-4cd0-8452-72a9598d05f9", "value": "1536:tiCFkE9Q8RMU9Fqcpa9CSbiXIS0kJ/gywcQhUYZXbtN1EOzPgfhKPSFJyekdy:tiCFkE9Q8RZ9ssMiXIS0kJZRY3EhtQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713059927, "uuid": "15ff11eb-71c7-4395-bae7-3cb755954436", "value": 107504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713059927, "uuid": "ea4c2050-39b9-4ed6-bbbf-c3c8433f7230", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713059927, "uuid": "483fb676-4e14-415d-8865-ca90390ca31c", "value": "669fd3cb15554ae292bac7ad853afc4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b570e6-fa9c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713126205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126205, "uuid": "cb230967-e933-4d1a-b4cb-6d16a548996d", "comment": "Malware payload", "value": "97c2440f8e3a52da315c84d79d69413d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126205, "uuid": "699b5a1d-65a3-4afc-ae21-da19bd7b67c4", "comment": "Malware payload", "value": "ddacceb8a4db5c8ebf364da501e0a06c67a5a839aa27e24e5d7f1db4bb8d8c35", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126205, "uuid": "629f4623-e802-47a7-8a81-afa0351a8db1", "comment": "Malware payload", "value": "4334bff7d8f51225400f7738bc369856217b5190", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126205, "uuid": "bffbb2d3-0308-4983-a9ce-2be6e20c4516", "comment": "Malware payload", "value": "d932f44c46ce8d219ea956012799f0d68676a46d1df3fef9f6a0e66c49b52e0eaffd2b94ea9a74d6224d34359585ea57", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713126205, "uuid": "7b5b84ea-8b19-4e83-b9e7-ea635059255d", "value": "T16CF36B16B4C188FEC49AC1744BDBF137D971F4195238B26F67D4AE222F4EE202B6DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713126205, "uuid": "a6238219-b147-48c5-86b9-c82a65a96d12", "value": "3072:WyPsVAed9oI+deNBNAmAw16VQKauC5r/2uxk2de:7PsVZTo11ah50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713126205, "uuid": "08b864ec-1715-4574-9be7-21f72e77b631", "value": 164232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713126205, "uuid": "7e2b25c1-567e-4ea3-98da-940a2724a6b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713126205, "uuid": "7af0865c-254f-4e14-b09a-97ddaad6c97b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f1c6de-fa25-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713075124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713075124, "uuid": "c5c69155-a21f-4e4d-96fb-b55045d1ffb6", "comment": "Malware payload", "value": "4209b1024d9853c65f7bf52c0d565c2d", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713075124, "uuid": "a763a731-dd16-42b2-83dd-32858714d160", "comment": "Malware payload", "value": "dfe7f4a66422420d6f73c57b64cd22225b4270963cbf00619c38d5f4c6e0a8a3", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713075124, "uuid": "dcf6679b-a134-48f1-bfc5-86025f0e4ee4", "comment": "Malware payload", "value": "bf9153561765996594eabef29506b78d67c2397d", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713075124, "uuid": "1b9d7c58-d7a7-4b62-a5da-331d11f9b209", "comment": "Malware payload", "value": "09be729de39f1571ef9356ba35c795c7b3eb950eacd2fb00e0a83bebf234f80a586fb3109c9340348c513714f28d2272", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713075124, "uuid": "c654fcac-a5bc-485b-98fd-c8fa62f67c29", "value": "T1E2C293B7EF5C1E57C80C403F1B863B162735D2158A00DFC95E38E66A8D7BD472E9A24A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713075124, "uuid": "531c2117-5c2a-4ec6-b0e2-32d6bd989ad5", "value": "768:vsrit/SAFy+k1e/KeP7e0ZiD+CA9uZNiFqWFUPC:1t/Suy+kE8vFZDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713075124, "uuid": "21f451e0-4d72-4daa-8b7b-784decd7ea83", "value": 26392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713075124, "uuid": "0d153aa3-b868-47fd-976a-6f655cf65dd7", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713075124, "uuid": "7bef00df-3e91-4582-a4fa-d063b9be5072", "value": "dfe7f4a66422420d6f73c57b64cd22225b4270963cbf00619c38d5f4c6e0a8a3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acdf6583-fa6c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713105515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105515, "uuid": "753100b7-6c6a-4069-8f00-032ac01a8553", "comment": "Malware payload (Mirai)", "value": "f129f1b3cd8aec200c6224da721d0a7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105515, "uuid": "9a82886f-d6a2-4020-9fb6-de83f9625b28", "comment": "Malware payload (Mirai)", "value": "e1b4ed4e6af1239a7c2e6db5381e83ef631b73f009cd50e78e687a8f8f2267ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105515, "uuid": "f167cf2f-325a-4461-8f81-509e61121603", "comment": "Malware payload (Mirai)", "value": "4f60267d18120d75a5d0cd43ddeabfa53ad32955", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105515, "uuid": "a1cd32c5-aa83-42b2-a36d-7bc006d7e873", "comment": "Malware payload (Mirai)", "value": "3a74ac6647fbbf576047afa98aacbd8ecd8474a7b8b06bab440b62bfb98bf1de19c57e9d59ad0a383cf925afd983db21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713105515, "uuid": "abd8d2f5-30b4-441e-bb07-b72a53d36014", "value": "T17E93B71E3E258FBCF79D823547B78E229648338A26E1C545E15CEA011EB034E741FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713105515, "uuid": "f590ee00-50d9-42ad-a470-43fe119210b2", "value": "1536:bK/QR35eT0Ata648QFTyAOVDZZYHWmdXSWYkhoh96:ke3sTPiBOAOVNZrmdXSWXha4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713105515, "uuid": "a6967beb-d029-412c-b9cb-5ee442f3cba3", "value": 89628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713105515, "uuid": "bccd2526-d9ec-4650-9f99-aed014c15815", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713105515, "uuid": "6c9ee7b8-0e36-42cd-b273-c1426ddabd83", "value": "f129f1b3cd8aec200c6224da721d0a7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858815fd-fa02-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713059923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059923, "uuid": "f3b199cc-55c2-4a0e-ae6f-49db813a6cb3", "comment": "Malware payload (Mirai)", "value": "f8336f5fc55aafd0cec993db10993dae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059923, "uuid": "03982b30-cc23-43cb-af57-4c96da91c5cb", "comment": "Malware payload (Mirai)", "value": "e27db830a651c47631d00dc6ff382ef637f6e389bcfc57b45805b37452e320aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059923, "uuid": "f7f174b0-2dad-4848-afab-af58b806ec2e", "comment": "Malware payload (Mirai)", "value": "ffb458804d5a1e135955fd65f2bce41e5e5f9894", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713059923, "uuid": "63df0fa3-9e09-4dc0-a574-fad2d4343cfa", "comment": "Malware payload (Mirai)", "value": "0f813cdf58d3c8bdb5e527dab2203b8b0022ade27627470baaeaba9910d0e734b5f6b64096edeb8fce6f531a3987710b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713059923, "uuid": "a6ed98c5-336e-4d8c-8b5f-d6a8576af307", "value": "T1BBE3E80A7FA01EF7E89BCE3701E65711158CE82A33967B75B53CDD18BA4B28E25D3460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713059923, "uuid": "7d85480d-1777-41fd-98c3-15aa76a4aed6", "value": "3072:6XvobAeYEto21e7ru9eMtNAIpNrvwSZWSN3hA:ateffeOPtjpNrvw0NxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713059923, "uuid": "c0df13a7-dfae-42cb-8710-50d2bb95e84c", "value": 151718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713059923, "uuid": "9416ed23-168a-4401-9c5d-349e7ddb4ab3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713059923, "uuid": "35b920c0-9373-4dc1-84c9-1b83571ee877", "value": "f8336f5fc55aafd0cec993db10993dae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa7d1f3-fa06-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713061685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713061685, "uuid": "4e1f12ec-c700-42cc-a2e3-ba6269caf9be", "comment": "Malware payload", "value": "6037ef5de2cf58d3c8ec1710689a7c57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713061685, "uuid": "461edf8b-1866-4056-a71a-a6df4cc5c270", "comment": "Malware payload", "value": "e695401d7718b51cf1f15353e6d450a9a79d00a3e062c105c03d8b3d01458a6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713061685, "uuid": "0014a461-0c7f-4cb1-9f6c-10b213a846ff", "comment": "Malware payload", "value": "0bb85e76b033037a9657a5beaef8dbbcab976751", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713061685, "uuid": "bc239fa0-2d3f-4c07-b077-7677714c2d2b", "comment": "Malware payload", "value": "ef0cb1b20989f66def09de964ad4d95b40b8d6708dd75cbaad287f8bd055b8d985638417cde114e64450fd0fc242f282", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713061685, "uuid": "690fd6cb-5f16-4e15-91b5-6945bb3ef752", "value": "T1A7E53303B3CB8032E4158975DD6A80006D377C3828E1795A2DBCDA0E65FA3D68DBEF65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713061685, "uuid": "13a12672-311e-47a6-aa2d-00f6871a5ebe", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713061685, "uuid": "81f58354-b950-4fcc-874e-37aaa9a2e347", "value": "49152:v4uA7mNbnUMCjzrObhdghPln4bQnHO3qaoOKONhbx3XZlUlUecAbIR8eQCaYvWH:w8tKzr8hQcWwq383JWjbIR88aYeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713061685, "uuid": "93779052-28d5-4398-b208-50d63c79edec", "value": 3071272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713061685, "uuid": "5eca9eda-5855-48b1-ba4e-17b3e78a302c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713061685, "uuid": "70ca7f9e-5453-4b6b-a83a-6f09d0b552f7", "value": "SecuriteInfo.com.Trojan.GenericKD.72337245.11917.15352", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4269386d-fa84-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713115645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713115645, "uuid": "5945a642-f929-46a6-bc00-46fe548db547", "comment": "Malware payload", "value": "979397380a9ad6eed74f6e37da60d23d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713115645, "uuid": "4d4a709c-384f-4697-bd37-028a434bdfd6", "comment": "Malware payload", "value": "e74abcf8b70d6258c5cc7d95886a59bad35704cfa97070d04db9abc4a525e841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713115645, "uuid": "393f05ae-d5cf-4d7b-86a7-41dc9e887bdd", "comment": "Malware payload", "value": "e571affdac6fc7d41c42fa61ae81d83d1e0b328d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713115645, "uuid": "0557bcb9-156b-4f1a-86fe-ce8af3dd5e2a", "comment": "Malware payload", "value": "8da3035cc4fa4584885292c92f0bc74ebb3cbece301db1426d22191f3f955f10f2bd63de786f3e805c2c467a8e86ef2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713115645, "uuid": "27ee9a8b-4ba7-44ba-b4c0-a11bc60b2402", "value": "T1C056331363D20275F9B98B32DD7292915E323DDC0AF62A9E1EFCC60E59B85C02D72257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713115645, "uuid": "c61eab28-549a-4589-8247-9d091f15e309", "value": "48aa5c8931746a9655524f67b25a47ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713115645, "uuid": "8f4aab86-074a-4031-a6d2-16f111c5f5e3", "value": "98304:VIEtheJIChmhahvtBkE9MLbW8IXJWWIRWzZAa8/sIwWkMLv4iTx8oXi:OEtheJ3hLvta4MLbOZWrkOaSUM8idy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713115645, "uuid": "d3ab190f-fb68-430d-b538-2703bda5d01e", "value": 6393449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713115645, "uuid": "bd4a9e34-c4ec-47f7-a707-aea494b115e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713115645, "uuid": "1161b186-c7d4-430e-9ca1-0953b94cdc87", "value": "SecuriteInfo.com.Trojan.Siggen6.63101.22463.30047", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37145a7-fa6c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713105500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105500, "uuid": "23f9389d-e5a9-4ecf-a159-43a728bf25ef", "comment": "Malware payload (Mirai)", "value": "aabf3402587c6ad87e1dfaf302843e76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105500, "uuid": "988e520d-094b-4901-9bc2-a26c43b8a389", "comment": "Malware payload (Mirai)", "value": "e852d736309637459f2d1c1028ff3ae2502af2db009f2bf9f8051c5f2620be00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105500, "uuid": "69080be4-d683-4136-9eb8-421d5995beb4", "comment": "Malware payload (Mirai)", "value": "1d2a2c65a3334fd099cc2a6294b8ee7142f86691", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713105500, "uuid": "ce9833d2-294b-47aa-b472-734541d30ffa", "comment": "Malware payload (Mirai)", "value": "a84e12e7fb1393b5b762cba7d39a18500509de3e76ad3e00834d50ca0049f631e0941e6d720515f85f2bd71e97e49241", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713105500, "uuid": "ac4b8ab1-9127-4a7b-bb13-631b23d6f92b", "value": "T1B6634A356D7A2E27C1C0A53E22B74764B2E1578E3AE8CA1E7D730E0EFF50A5060176B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713105500, "uuid": "881f51f1-3193-4f0d-b417-315ce8196042", "value": "1536:xBzNxnVCvXUB5HtSxZ8ChB4YXgy+j/9T7t:fzMx1vZwD9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713105500, "uuid": "b00f7853-ade0-407c-8ec4-b7de7e987ef9", "value": 72800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713105500, "uuid": "37a705ac-db8c-4e69-ac51-7e439c6149bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713105500, "uuid": "b8954f24-ecc6-442a-a767-e2920f7b4447", "value": "aabf3402587c6ad87e1dfaf302843e76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6347282d-fa30-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713079622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713079622, "uuid": "6b74618a-4243-49c1-ac51-f6645e51c7cd", "comment": "Malware payload (RemcosRAT)", "value": "b1c47e018ecacb353e0044d19ec4e3d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713079622, "uuid": "b0615c43-320c-46f3-a9d0-4f3f3050ba3c", "comment": "Malware payload (RemcosRAT)", "value": "e86adacf5c97be5994270db2e7b294eefcdf29e888bf9c957c9dc4b5040acb9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713079622, "uuid": "985b3920-0f9a-409c-9136-15a09d61565b", "comment": "Malware payload (RemcosRAT)", "value": "2c9d17de8176feed0fe14367b04b565df08f4b96", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713079622, "uuid": "8bfce8a6-b3c6-47c7-aff1-efd7fe24de3b", "comment": "Malware payload (RemcosRAT)", "value": "53032bd2149c7aeee50a1773eaf01ccbbb475edfb1f3e35645ab9b773b991e3d243a2964d04504dcda67a2cc9966bfde", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713079622, "uuid": "153ad63e-5f25-4cc5-b773-c240b9930559", "value": "T143B49E01BAD1C072D57524300D3AF776EAB8BD2028364A7B73D61D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713079622, "uuid": "5ff01fef-ba96-45d3-9cd4-6847eb3caf60", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713079622, "uuid": "93bafbcc-d0ba-45c6-8ab8-e3483009ba84", "value": "6144:6XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNr05Gv:6X7tPMK8ctGe4Dzl4h2QnuPs/ZD80cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713079622, "uuid": "607f8d62-851e-4c64-b2d1-5116ade96ffe", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713079622, "uuid": "5b01f09d-d4a1-43b8-8b57-5c9fb00bac4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713079622, "uuid": "d54c1b6b-2662-4817-acf4-2d779a9afb1f", "value": "b1c47e018ecacb353e0044d19ec4e3d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51cfefe9-fa2a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713077016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713077016, "uuid": "45a72276-714c-41ea-8d29-863ce7d61b77", "comment": "Malware payload (Mirai)", "value": "70d876872173e0c1f794b62dbc739ebd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713077016, "uuid": "8c5c5c92-e2dd-4e1b-86bc-b82d8d7c3e8e", "comment": "Malware payload (Mirai)", "value": "e87f717f70c7e2636c4ce64de1cc31bf4200b683fe8bc555cc1e540799c43c9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713077016, "uuid": "d28b899e-06ab-4ec9-8330-90f250cbc951", "comment": "Malware payload (Mirai)", "value": "7e0db50b3ada3db413fd3ec57b0021e7557859fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713077016, "uuid": "149ddb8e-516c-41af-ad1f-737696aa04b5", "comment": "Malware payload (Mirai)", "value": "9d43800e7998aef15443d56d2b16ea82753f2a44339f14795fdc6dc4f7867fc6a64bfd89daf84b0e92cf30ab3368f289", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713077016, "uuid": "039db0c2-fc00-4da9-979b-18534cc65fdd", "value": "T1D104B53677A10DB7D80ECE3301A685220C8DD99712D96B6BB274EA5CEB6BD4F04D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713077016, "uuid": "28abdf84-e41f-44c8-87dd-f1620cd9644b", "value": "1536:CLejsz2WUWqT/IeB4V9Q/VYDIGXGtQrTFLY9fHi8ZzQG4mBixv4vnaNu:Cnz2WUL/6IGXGtEh6i89QFmB0v4vnaNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713077016, "uuid": "c6affedf-32cf-4afd-8fa7-d5384393dc5b", "value": 181137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713077016, "uuid": "5a92bdc6-eddb-4809-8aef-95f5012c6dd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713077016, "uuid": "ce39c45c-134b-4df6-88b6-1b567486f8be", "value": "70d876872173e0c1f794b62dbc739ebd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f8734d-fab5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713136780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136780, "uuid": "6f0671fd-cc6c-4c44-b866-df531910a5a4", "comment": "Malware payload (Mirai)", "value": "e8e8bd0ecc6cd2a0d684978b32454dca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136780, "uuid": "23d916b3-f4ef-4e97-93a0-c2dcc9811b23", "comment": "Malware payload (Mirai)", "value": "e94bdcbea47c970f63b77320209457c023d1f55c2f1dd1f6cf5bcc0b40c28664", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136780, "uuid": "b8cbad1c-1ca3-4449-b807-dad56301005c", "comment": "Malware payload (Mirai)", "value": "6e28970f8d74e850fd61188761645f5befb4847c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136780, "uuid": "defd323d-a6e4-46ff-acea-e6ab4aa10593", "comment": "Malware payload (Mirai)", "value": "3e15ad970a09e8dfabe6036bd0cb1cc9c9cb1dd56e4ed55829b0717cb9203fdd0ca1b380f778788b84831d179f88c10a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136780, "uuid": "937a080d-786c-4069-9863-b1729657fa66", "value": "T195432AC5F941AA26C7C15637FF0F0289371A878CD2EA3303D9295FA137CB9560E2B216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136780, "uuid": "0d82737f-c39a-48da-b303-4df4a4f967e9", "value": "1536:xbYnWdw3RZaxoJRYRIpSPpRZScbveXfvcq:qWqaxonYRIpWSiu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713136780, "uuid": "6e861d43-a466-4404-afcc-a52aabde52e7", "value": 59372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713136780, "uuid": "f1e0174f-3018-436e-b4e4-f7f423ea4a55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136780, "uuid": "0e09340b-fc1b-4cf2-a779-ca586f6e8b86", "value": "e8e8bd0ecc6cd2a0d684978b32454dca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7065df0-fab5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713136859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136859, "uuid": "ca3a469b-315f-4c56-adea-25dc37512e31", "comment": "Malware payload", "value": "aa8d77d1cf54b7af6cd184abe968d886", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136859, "uuid": "be7f3d23-a8e8-401b-9dc1-c578f7e84931", "comment": "Malware payload", "value": "e9c569a39410edbbf2035e18b47deb8e3284f30e39fdb2aeca9559b241cdc512", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136859, "uuid": "e31d6be1-fe23-4036-82e2-dd566baac4d2", "comment": "Malware payload", "value": "35933c0e6d7cde0a063b5734353e19405e850ba3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713136859, "uuid": "b3f076c0-549d-43a2-a9fd-5d541db67032", "comment": "Malware payload", "value": "9abfdb279c6c0b661c4c59bc26ec8172724535b6801eda65e07241235e05637fca6d9397ab4e6e889c9e2f8519b960e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136859, "uuid": "592c7934-63fe-4086-9b9b-f9bdaf7e01c9", "value": "T121923B0BBB8758FAD669927A84134D29D773B41603119BCF23E156A90F7A2C07C3BF49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136859, "uuid": "2855a095-11fc-4803-8c27-b944fd9b0d2d", "value": "31671574a0da1db65bd851123c8e2ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136859, "uuid": "1ae2710d-3e02-4d25-a66d-7a8bdaa33435", "value": "384:zbRzuq00z0s+FoagXckaUscNPYoNb3x2K:i0zxioVckHND3wK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713136859, "uuid": "5f115361-1a43-47be-b8b8-6207ceaf45c5", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713136859, "uuid": "ec42d809-9f4b-4d64-ade2-af05a8dce41d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713136859, "uuid": "a61579f0-e98b-47bb-9fd3-9a7b9ca5a923", "value": "malware!!!.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23003294-fa42-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713087245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087245, "uuid": "5176a910-2f40-48e7-85ad-98b49b5b95f7", "comment": "Malware payload (Mirai)", "value": "3ab5d54a7196ab118c618fd71e83bf1a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087245, "uuid": "1291be81-906e-4fb3-b175-d0d9b72bb609", "comment": "Malware payload (Mirai)", "value": "eab86ef0c925d232b003ce58d294a396fdf5437913ca110a1bd40770a6f7a2e3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087245, "uuid": "c62efde1-1c1b-48de-bc28-866dad1be1b3", "comment": "Malware payload (Mirai)", "value": "e53c8dce7feb8c79e331e7dcb5f60d1d89cbea47", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087245, "uuid": "66cb5c17-ab63-4872-8c5c-de7b5310f9cf", "comment": "Malware payload (Mirai)", "value": "478a07cefcdac3ffc91328079e4404a3e230913e8be8cf4cd6752a8830f95ec46075def28930c81fcc88080d78cec1dc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087245, "uuid": "100b2455-3fa8-49bb-8ff7-0f1cbda49e63", "value": "T19BE30A56F8819B12D5C111BAFE1E124E37131B7CE2DE7202AD246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087245, "uuid": "77996187-7663-41f1-a31e-1ef51dc5a8f3", "value": "3072:5U0sn2UgORBzXEwSjjgGazWiuE/b+YCW3M2Rpo:5UqzszXFwjba6hcP3M2RW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713087245, "uuid": "5f4e0cfc-dc66-4dfe-8a77-c896fd0668a3", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713087245, "uuid": "9190c85b-7c20-4f9d-9774-f73998d1311b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087245, "uuid": "25404a7e-46e6-48db-838f-288da8574510", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f474d1-fa2a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713077003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713077003, "uuid": "52dd132e-16eb-4d67-9f40-d79415a9f0b7", "comment": "Malware payload (Mirai)", "value": "4796a062c8ad85da98a365a8ad5f9b9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713077003, "uuid": "523bc7a6-9b16-48a1-b88e-306af1b04701", "comment": "Malware payload (Mirai)", "value": "eb9f5116773316e3e1da1feb7afa632e06cfd3d80d80fe506da0f9f5cad66b15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713077003, "uuid": "22115220-13fb-4b36-941a-741e6dc29f6d", "comment": "Malware payload (Mirai)", "value": "db0057ae4d03672b0db5618f3d239b5f076b49c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713077003, "uuid": "e20ac11c-1e21-4bc3-96b1-e949eb6cf482", "comment": "Malware payload (Mirai)", "value": "8c5e2f560ee03d040a49a50993873854096f61bc983f4987f8d624382aa54da9f5539a344c55632dc9bd547a5dc6a497", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713077003, "uuid": "12108771-c309-4e37-999b-a61a1a23abcd", "value": "T14704B53E7A11ABBEE169827107F66F708F9529D327A09341E26CE7185E3124D1CCFB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713077003, "uuid": "012ae1f4-cc73-4760-adc9-6705bfbd95dd", "value": "3072:PKn3FSO7m16k9DfF1sHEENZYmW3amB0v4vnaNu:ynmgXNZYfqmB0v4vnaNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713077003, "uuid": "f862521c-1147-4af5-9580-aab094b74467", "value": 181137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713077003, "uuid": "11960969-4c00-44c9-8cc1-81c57f7025fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713077003, "uuid": "87e50852-2528-48c7-bf8c-c1a90614a8c8", "value": "4796a062c8ad85da98a365a8ad5f9b9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2608dad-fa41-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1713087083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087083, "uuid": "3bb42dea-8c98-4d81-b3ed-857a0b66303c", "comment": "Malware payload (Adware.Generic)", "value": "9cfa0cb7a345bfe8278642eae69fbfa8", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087083, "uuid": "7dcf171d-3716-430a-930e-e93c3225b4e7", "comment": "Malware payload (Adware.Generic)", "value": "ed692e804c10483e0e6e1e50f34b9d5f9fbf43ab33357dbbedf5e7494b22872d", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087083, "uuid": "89065558-3702-4da9-96a7-5c65ee0b0f88", "comment": "Malware payload (Adware.Generic)", "value": "fe4f056af9c2e54e1ecb3b10ffd73311b23fb171", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713087083, "uuid": "fcace122-c1f0-4e50-bed1-c3a30be02a36", "comment": "Malware payload (Adware.Generic)", "value": "baeae91270465bd1482bc7d7996e531b42b82a17e70ce142b4eac665d21b8501a25ee73b0d3c3d4b7d365335e8f91a4a", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087083, "uuid": "9a143f43-036d-4a11-8553-ed7e827dad3a", "value": "T16CD5F03FB268653EC5AE0B3245B38260997B7B61B81A8C1F47F0090DCF665711E3F65A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087083, "uuid": "b28480ce-a245-4095-9241-47db3306ef97", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087083, "uuid": "925800d1-dca1-4a46-ba12-3c62a2f5f96f", "value": "49152:HBuZrEUn7ljV3A/kxPdS57F2W4rrLoqWFZ9S+ICTBSG2mPS+WkWE:hkLJjV3ykxPdE7F14/LoqWP9BeG2AS+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713087083, "uuid": "e1eba752-aa0a-4114-9e38-fa435f899bc3", "value": 2948192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713087083, "uuid": "6a4aa6a7-1052-418c-a174-094694fad492", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713087083, "uuid": "f6c4e5c7-3eec-43b9-8ad3-5c86dd9322ae", "value": "SecuriteInfo.com.Win32.Malware-gen.7955.29099", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1593b819-fa39-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1713083357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713083357, "uuid": "ae675292-3e58-44fa-9185-b37c020e1c85", "comment": "Malware payload (Adware.Generic)", "value": "47a8e64139841fc3ac2286576cdcc9a7", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713083357, "uuid": "862bd536-f840-4eaa-9042-50b5514c72cd", "comment": "Malware payload (Adware.Generic)", "value": "ee0053bdea56cd03d6e0304cac4e1f65d9276f8579f1fbb0b356c64d3284f715", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713083357, "uuid": "a3547224-b928-4192-be27-d451cd75631f", "comment": "Malware payload (Adware.Generic)", "value": "9d3222ad8174c5f5c3ed70c2edb6cdead4851508", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713083357, "uuid": "a03a107e-11a1-447a-a6e7-1c8fdc036fff", "comment": "Malware payload (Adware.Generic)", "value": "ce053d6fd22b91fcf3a36039e7c8dc3c6baaf2a90e317c31ad4462e97bc20a40e8542a8b9580998ba925f5d4718de26a", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713083357, "uuid": "ec643a7f-17b3-4812-b6a5-cea3893c937c", "value": "T16027233B7559E12DCA565A31D9B3C2F0A8B76E60E80A8C1B57F07E0FFF355202E2A541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713083357, "uuid": "7ee1ebad-4229-42e1-8c1c-5f2b0351aac6", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713083357, "uuid": "3eb6d559-1421-45e7-9e80-490e10b2c438", "value": "393216:/GDsk1CcGfF9zYNkS+z+Q4xrTLa0BmEQ2YyO:/GwcCfS+z+tvLTmEQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713083357, "uuid": "c57c56d1-beb0-4711-b67c-fc73b1ece25b", "value": 20771258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713083357, "uuid": "2bbdc57f-4434-4cfa-8562-0401cf4fb474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713083357, "uuid": "2659fa0f-e8d2-4c63-83fc-817c6af994e2", "value": "SecuriteInfo.com.W32.Grandoreiro.AG.gen.Eldorado.1708.15193", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333e7e7f-fa95-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713122921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713122921, "uuid": "4c0540c1-65ec-419c-8657-653951ac29ef", "comment": "Malware payload (Mirai)", "value": "b4c41c6cb6e62a22d112139b489c4515", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713122921, "uuid": "7b086ff2-a346-491e-a767-c3b097eab153", "comment": "Malware payload (Mirai)", "value": "ee2596d16f106498e3a47230e2a3c9060125f63c1e5ae84d396dabc27109f726", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713122921, "uuid": "0f3159e4-7b36-4956-8650-55d1bf49793a", "comment": "Malware payload (Mirai)", "value": "67175e4c3b9443ddf8f833ae0a094d195e40ba94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713122921, "uuid": "a0412921-5861-4c25-a857-84e33cc725ba", "comment": "Malware payload (Mirai)", "value": "54249fa32df5dd1dcba097d8f78cbe2ad976f7b34ae0ab159d4f2c79508687a9cef94605e4bc6c775996f3010b748a7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713122921, "uuid": "e442fec2-b899-4d9e-a2ec-c99db553cf2c", "value": "T1A2F2D13DC34B4C55C8AA98FCDAF807E56AB81EE2A041C55FF41CA1579EC55907943E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713122921, "uuid": "61245bd1-3abb-431d-9a9c-d136e0b072e9", "value": "768:9NY7ncg7H7lwpnQyjaSgxFxQvIHhHsz1HMJgGlzDpbuR1J+:bOcg7WnQyHI2WVJuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713122921, "uuid": "56b57844-9b09-44b0-85f7-c79636b14e87", "value": 35628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713122921, "uuid": "f13213aa-3e63-45b4-8294-b98530209036", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713122921, "uuid": "6195a5dd-9d18-4cb2-b6ec-0ded5abd2134", "value": "SecuriteInfo.com.Linux.Siggen.9999.31843.31356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a202e80-fa7b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713111792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713111792, "uuid": "357b764c-da89-4efd-ae86-9f90a3125b69", "comment": "Malware payload", "value": "59d47042d4d55974ffafcf6613b8fb8f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713111792, "uuid": "aacb6900-046b-428d-805a-11093729f247", "comment": "Malware payload", "value": "f116af8c8c597186d5d4c7e62c8797fc39a95906641bbc002d7c32a6d0f1e143", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713111792, "uuid": "731d817b-aecf-43f0-a0e9-9c70aa642bb5", "comment": "Malware payload", "value": "76d9cbab50ff61fda4a67d298f1ce34722689566", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713111792, "uuid": "e16eebea-8500-41c8-95c4-03686ee62c30", "comment": "Malware payload", "value": "9da9ecd0ef5b2744453c3c6d14e9bf28705d10bdea5b2d0f05b8446483c49665411e36c8f68cb7642b693bbe872ebea7", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713111792, "uuid": "42d026ae-85ce-4a85-b6f3-36fa4d5ad0eb", "value": "T170C4AE12B7C6C937D4AF06B0361DD3AA4529BC2047F2C4EB23C85E1E1E725C1563AEA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713111792, "uuid": "6376cf55-fadb-41db-854d-3e6456b8e093", "value": "12288:WsEYQtBqnkbIQ6HHI/RpXupEP49v63zLrVVdWeAoH:WsEYiBqnGIQ5M6DLrVVdWeAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713111792, "uuid": "4b7a33af-fd70-4ff8-a4cd-d98b973c2667", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713111792, "uuid": "13a7a09b-1171-4e8b-863c-8db09689d442", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713111792, "uuid": "0344ec79-bf67-421e-a18a-c94e0d14e347", "value": "SecuriteInfo.com.HEUR.32731.13860", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2430479-fa9c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713126221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126221, "uuid": "c63715ef-efbc-4189-8020-2c70d94e1043", "comment": "Malware payload", "value": "1f4ce0f91861b4a83fee34568a94f61d", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126221, "uuid": "bad9db96-6a2a-4c40-875f-8a2b55a313dc", "comment": "Malware payload", "value": "f4f0dec8ac9d05b31a60e8b079a482384867bbcbb95f51241cf18399c4a5924f", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126221, "uuid": "b53a84b8-b679-4f5a-b701-d038166f4465", "comment": "Malware payload", "value": "71c0f02d1219bf1a26dd7776837d0668159abbb0", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713126221, "uuid": "c6e5af13-923e-4093-80a3-95940f52da55", "comment": "Malware payload", "value": "1dc5b23d2e1030c5e60ff3b36cbc1e6065980f873efd25ff864645aa137a4847c01f37e2512a45c56e64dee409e311e8", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713126221, "uuid": "5ddab01e-d316-4e5b-a09c-b9f556861941", "value": "T17E144B46AA418B13C0D72BB9FBDF425533339B64D7EB63019528AFB43F8679A4F62101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713126221, "uuid": "e59d4d2d-23f4-4bb4-80b0-0fb3e84e1487", "value": "6144:tUO/zly92apLcWiiiYyByZlanXBoM/RKmRjH:Fy92apLcWiiqAL+B9/UIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713126221, "uuid": "097ce5c2-ac9c-4144-8be1-e6a7db4f5881", "value": 202547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713126221, "uuid": "edc08cd2-086c-49a1-8c20-b187727e3f5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713126221, "uuid": "0cb90555-182b-4e15-b1dd-cf2550556f1e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0669164-fa80-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713114165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114165, "uuid": "1b5b1f01-88cb-4602-87d7-5cf707d9ab68", "comment": "Malware payload (Mirai)", "value": "bfec2284fed9b2bbcf4573a655ce931e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114165, "uuid": "f900aeca-9b58-433a-a0f9-89369e1ff8fa", "comment": "Malware payload (Mirai)", "value": "f95f2f425700fe4c5222ad08b9115be028a2e5f1f14dc521621fccc727910d09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114165, "uuid": "7f75f678-d072-44c3-89c1-39d1e989b13b", "comment": "Malware payload (Mirai)", "value": "46d4bb66ac96665bf322f40e64c1babeec7acefd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713114165, "uuid": "0456012d-106d-40ae-b1ef-77a298df8654", "comment": "Malware payload (Mirai)", "value": "4b0527f766abcc7990681db79824c63794c322e15ee7e8c6a51729ffd3a9846e2f8f90784b78f514eeaef7fc16c0f102", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114165, "uuid": "06e08771-5602-4b03-949a-662f9eac2862", "value": "T1B3E2E18B61064226D700E5BB30FD78E93EA4C3159BDF81C0507EF4E89897766564CAF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114165, "uuid": "fc526e27-89fb-4fb8-84b0-45e29e7b5387", "value": "768:owHckKmDEvInjI7IqxcHHicsfrXkMnzKuqpFjU:owHcfAtHHkfF+7FQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713114165, "uuid": "719f4d63-6e6a-40f8-b12b-73708b92623a", "value": 31728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713114165, "uuid": "e1678698-9e20-4876-b050-52d3a688c904", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713114165, "uuid": "4e624a71-7aef-4e65-8296-f36ae5ab74f1", "value": "bfec2284fed9b2bbcf4573a655ce931e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb79ebd-fa6a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713104549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713104549, "uuid": "b25566b2-ebaf-4ed7-9f48-068794af9a6e", "comment": "Malware payload", "value": "788b876e49d419beee895fe4a072c381", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713104549, "uuid": "96cd6183-23f9-43f2-8f4e-44f52c7e0386", "comment": "Malware payload", "value": "f9b9034411d8190fafa5592aacd427fbf49c21eeda708b4675aa72d71bc37f21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713104549, "uuid": "36b6bc20-54aa-443e-a2a2-10d604c20e02", "comment": "Malware payload", "value": "78638003499bff95a0bbe4c08aac5e5ede588abd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713104549, "uuid": "3c7a3abe-ef60-4866-91ac-63d7cd89ec80", "comment": "Malware payload", "value": "1f2dce2dd6342a4f3f1050677740a1a3d617dd0d9dcf7fe4beff944cfb050b9660af2cf5e8ebd5311aa03e5ec0034050", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713104549, "uuid": "ce50f211-d3c6-4696-ad63-f5568639a649", "value": "T15CC5AF22B5808077C56317319A9FB339B2FDBD704939827363996F6D2A71483DD2CA63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713104549, "uuid": "a20d2bfa-b931-45df-a74c-37dc56c92b05", "value": "a0732ad41ce31400ff18c2ea64cf2f1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713104549, "uuid": "3c365fe4-4154-4228-b155-6acbec91fdae", "value": "49152:JWt4VQvCw0sq7qmPqB+Yn6G/hZQsLSCo6DlUI4y/nTZRnu0AgBr:04VQvBZq7q8TYn6GZmsGp6DlUI4yPuJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713104549, "uuid": "577929a9-e898-44c4-b7fb-2c34fe35d5d9", "value": 2602064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713104549, "uuid": "47c0cd61-dc28-43e4-b5e2-dcd2d4295c78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713104549, "uuid": "62864302-e69d-44b0-97bf-a598804fdf5d", "value": "SecuriteInfo.com.BScope.Trojan.Wacatac.12246.27629", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "545bb3b5-fa08-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713062417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713062417, "uuid": "f19e2e6e-0776-4bf7-98a9-9724202223fd", "comment": "Malware payload (RiseProStealer)", "value": "c075631927eba86d9c9c4589c08a6ef9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713062417, "uuid": "77240028-9240-46a5-a0b5-f3082c426cd6", "comment": "Malware payload (RiseProStealer)", "value": "fa0d1d51d06bfea117b9283aaeae09bd66375f917c7bcb4f145cea24c0d18c30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713062417, "uuid": "dc69b206-7fff-4361-8083-6ce206810005", "comment": "Malware payload (RiseProStealer)", "value": "d7eda553dc9ea73e8ff161ad87c7cf5c5d591fd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713062417, "uuid": "a3b40ac6-1c99-4f22-bc60-e7ac995e20d6", "comment": "Malware payload (RiseProStealer)", "value": "380eb6a1500e15f72908cf7476b2b9d6644ca78331569f3f753beba4397343620eafefc1c89d59e3f97de6cd0cec97f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713062417, "uuid": "63043015-9dfa-4ace-8b55-ec229633ae0f", "value": "T1BBB533455D7D8E10CB97D33126EBFB267BE031124431AA1E63C63C9336AB3AE7729815", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713062417, "uuid": "024ac3cd-92a7-4f98-8831-2a0d0e00ae7d", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713062417, "uuid": "d0df3977-e61e-4e48-8bfd-820bbdfb55f0", "value": "49152:5SUl6vD5DxN6HHLJ9tL7snWn91Ax6LsT2YUkXXlkaiVSoVWfxyys:5SSwD5Dxk97sWzAQsTVjisoVWZ9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713062417, "uuid": "ac786d79-26ee-462c-ac4e-162a43f492f9", "value": 2300416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713062417, "uuid": "39ca5a6d-d50f-43c4-b435-173d157cb27a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713062417, "uuid": "27021929-4a25-4278-b251-dc8217a9748a", "value": "c075631927eba86d9c9c4589c08a6ef9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df60b293-fa72-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713108177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108177, "uuid": "bb7c859e-2128-4510-8d14-0eafb69415ff", "comment": "Malware payload (Mirai)", "value": "0d665e3fce901c2ec5954057443d693d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108177, "uuid": "e30ab8bf-a26b-4484-91ba-ed8d0898079e", "comment": "Malware payload (Mirai)", "value": "fb775b6c1ff243d331b42ac6e3bc8d958e9ecf2519a3d741e25f5717e0779049", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108177, "uuid": "c757e131-73e2-4879-8c16-427231b66954", "comment": "Malware payload (Mirai)", "value": "58ea68567d0b2491c76986f965489ff557fe371f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108177, "uuid": "ab495f3b-abba-46a3-b27b-43748c33dc31", "comment": "Malware payload (Mirai)", "value": "24ee319b16f42dc5cd7503a6f692bb32176990174acf190dff3cd5dafd44efd564eb8560b4cc064a8ae7b4a63deb6333", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108177, "uuid": "12ea566e-ff7d-4425-bb78-dd6e0ec21a94", "value": "T18A639D73C9396E98D1A991F0B4349F745F23A11082A71FFB0E55C1799087EACF6463B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108177, "uuid": "b400431d-56b9-4cfe-b786-c02d21720732", "value": "1536:NatwtVAbFF/lAKuLVGpiKh5knZmU6iCXIvGaPASiG:Nqhbn/ltYVGbhamU6id+Qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713108177, "uuid": "60fc25c9-7c40-41c6-b2c6-3af11424329c", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713108177, "uuid": "a20f5927-1863-4308-9f1b-d03cce71c1a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108177, "uuid": "cc47b09e-59f5-4a4e-915c-f7632167783a", "value": "0d665e3fce901c2ec5954057443d693d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd21fc27-fa72-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713108146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108146, "uuid": "b6b42e80-715b-4153-98dd-d0f30f09a276", "comment": "Malware payload (Mirai)", "value": "04f257782ae8acc2109d56a432dd6ff9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108146, "uuid": "dbd6089d-ee99-4e31-b8b1-9fba45262485", "comment": "Malware payload (Mirai)", "value": "fbde07f0582c954a0300e48cf4e70b54c155b05bc8780c04a34ad80c3e738ef8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108146, "uuid": "f749b9ce-2368-4982-a104-5a81488bd831", "comment": "Malware payload (Mirai)", "value": "bdf6b5f0b5e83467c32f8ec3b294338cac3f7610", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713108146, "uuid": "06808b54-556c-4b32-83be-f3b48cae63b1", "comment": "Malware payload (Mirai)", "value": "ccaea6ef160eca0378982f38f2a497cc0297191da86435b8d0a1163652bfc9c2cf0dec6d8258f7f5c8cdb80c13ba849a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108146, "uuid": "568541aa-a2c6-49fc-a557-704d74a90bba", "value": "T16C634A13B58190FCC29DC374476BB63AE93375BE1239F2AA37D8FA126D49E211E1E540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108146, "uuid": "0bbe06ec-6a27-4171-bb1c-545635d8dc90", "value": "1536:GBEtqb9a7oY6uHhK0ygRZKbBqApwFHP57atD9kuQTGJ0OGjnp:htYQsYFwERYVqApwJPctD6TGOO+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713108146, "uuid": "edead67c-c967-4430-a56d-e88632eca272", "value": 71824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713108146, "uuid": "9fcdb336-e1cd-4dd5-b945-25e5b6bd08f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713108146, "uuid": "b4f53162-0860-4dc6-9f02-5bcbd3f070e8", "value": "04f257782ae8acc2109d56a432dd6ff9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d4214ad-fa6e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713106107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106107, "uuid": "b1b199c6-7ec2-490a-a1e1-4fdcff61dada", "comment": "Malware payload (Mirai)", "value": "46283f2077adbb2a0d5b6d4cd5d18e7e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106107, "uuid": "dbab1763-ea7d-4bf8-accd-3217ee6a1373", "comment": "Malware payload (Mirai)", "value": "fcb5afaa87ff83a780d9b542114cb16768391c0a0a725ebaabcf07962304243c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106107, "uuid": "48b2cc6a-5be0-4dfa-92fa-0cb780676046", "comment": "Malware payload (Mirai)", "value": "103e9023450b7cac0a8bd9b5cfc978cfc8da31d8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713106107, "uuid": "f610d3e8-25b2-4e5b-afec-afde91d85e95", "comment": "Malware payload (Mirai)", "value": "76ac03499d563b8109c05b2482155f430113ab1a9357e843adcbf3a7d30e3e5ce58e6a4877a8f034aa5296afa98a0837", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106107, "uuid": "33ea12b5-6f3f-48d2-aab7-43422d3539b6", "value": "T17604861E6A228F7DF6AC873047B74E20976D23D617E1D684E1ACC5105F6039E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106107, "uuid": "d65f0da7-b720-458b-bce3-44a7dca941c0", "value": "1536:8f/8ANwxlq37wW+nff238a4EonKya16QmXVMOUtPO3L3Y5kdDsg/EjCUr7bx77hO:8XFNyleCtoMMtFkNseUv8OCwjCR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713106107, "uuid": "0b575a2a-544a-4438-9dff-803417f4bc14", "value": 189712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713106107, "uuid": "7c31d68a-30a9-401a-8dd9-93e94c2d1a45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713106107, "uuid": "26257715-fb3e-4b39-be1e-bc5b2664debd", "value": "vlxx.mips-20240414-1448", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "415dbdf6-fa4b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713091162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713091162, "uuid": "16bed331-932d-47c4-948a-f7238670c865", "comment": "Malware payload", "value": "946f9875958c6ff0a4ccbcc8717068a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713091162, "uuid": "7a360b94-0ad1-4756-8d1f-abdf10a88d74", "comment": "Malware payload", "value": "fd643dfa49e7411994295979b06bf68659ddb28f1942fe80f6149696d4aa0d2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713091162, "uuid": "54afc3fd-06a6-4509-8592-5d2a465ea068", "comment": "Malware payload", "value": "229484accad0a2f744b0f7c857b12de1c2896f38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713091162, "uuid": "87cfef5a-10ee-4dd9-99f4-c9f62492a15e", "comment": "Malware payload", "value": "b81d8bd0364183afb2dc4b786f56e90c375b9f47b770d904d8489042342dbf49dc83ee3a671140eb38500e788e31975f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713091162, "uuid": "58a9e4c5-61a7-4157-a32b-39b02799722e", "value": "T11EA622517EACB815D0EA4635D9A70C381BB3AD417521E71B228A3264ED7339A4FCDF0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713091162, "uuid": "1b456cdd-5e38-43a8-a569-5ed8164c3031", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713091162, "uuid": "568bb6a8-392f-4216-a992-0a8a80a18846", "value": "196608:VFg/KSH4rynHHiJrWnfossDb9NfwSdcvTP5AUewGUeF1w:VK/ZH4OniJrcOfwSdcv1A02w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713091162, "uuid": "d519609e-4dd7-465a-bc44-325a445f33ed", "value": 10256896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713091162, "uuid": "020d7377-7708-478d-8d2a-cdb9b5a7c9ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713091162, "uuid": "620aa3df-095b-4f85-9c17-af8d5d48fb68", "value": "946f9875958c6ff0a4ccbcc8717068a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89fd73c4-fa52-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713094290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713094290, "uuid": "b1066447-8e59-4391-99ea-a5e312afab53", "comment": "Malware payload", "value": "ca0fdb8973c0938b29a1dbbbb991706b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713094290, "uuid": "752a7aca-bde7-458c-9c9d-4d09d885409b", "comment": "Malware payload", "value": "ff91377fdef662849ca77b186b7ecf1febe8a2155f2d4b32ef2cdb0264f84ed4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713094290, "uuid": "f79805ea-d324-4d42-8838-d617ee636660", "comment": "Malware payload", "value": "d59c24218eaf8862bba6893e02a527704cda02ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713094290, "uuid": "7d961667-a6df-40cf-9c92-7cfa6e67e305", "comment": "Malware payload", "value": "b538d17c696aed72fd52fa4be72697246a31d4a7b53aa568f9bc076b719597e7349aec302e01b312ba6b34e3a345c652", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713094290, "uuid": "bdd8a819-8807-4ce7-80c1-707581254b07", "value": "T1A2573328E6D19E7CDF3719FCD08E98EA592F9EA317C9407317F086C68A546C0881ED5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713094290, "uuid": "9ac0ec0a-4145-427b-8152-5719d903b150", "value": "a0722f4d4407b49f848f72fd4df721d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713094290, "uuid": "143f6d09-669a-4e1d-b815-0c2636aca2c1", "value": "786432:k6f80CnSdFmwDE7elaEtyG7O36we3FJBl4J0kfpIm:fiSdJtakyGG6weVJBeykfSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713094290, "uuid": "c1736ad9-a664-48a6-8140-da96fdff2def", "value": 29227744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713094290, "uuid": "2d1cc158-c40f-4d5b-bd0d-ddcb484cc655", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713094290, "uuid": "91944fa5-0334-454d-9acf-32990111d552", "value": "SecuriteInfo.com.Trojan.Siggen21.29401.5442.21101", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17a2803-f9ff-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713058815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713058815, "uuid": "ee2e750e-d8e2-4064-9dfa-0836dd94db72", "comment": "Malware payload (RiseProStealer)", "value": "2a09d9b3cbac28ee87a63a7bb712fa97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713058815, "uuid": "5362cded-f68b-47a3-84ad-ab47f4b49bc9", "comment": "Malware payload (RiseProStealer)", "value": "ffc7f5418c90b4cae8522de15d5ea399781fa8076841eb4158e0bd4472c67a75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713058815, "uuid": "9dd83b5e-2934-4a41-b6bf-3aad1bc9c7cb", "comment": "Malware payload (RiseProStealer)", "value": "c468292a8241b6444fb1eaf36c64ff6fa449aa72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713058815, "uuid": "603af146-e48b-425f-b5b2-8f71fb330690", "comment": "Malware payload (RiseProStealer)", "value": "e3b6ccf179b29ba37ba1165685e1490aadc162584b7ad784e378747efbc9db0d6eb586bcb79e39b077814ac39a4bb692", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713058815, "uuid": "36eadb77-0cf4-4ca6-ad0e-9f68ce2936b7", "value": "T1E2B533900E386B54CEBA9BB30BB2D6552FA979040630E91EE5CBBD53B12F12DF716143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713058815, "uuid": "8a3ee5b8-203d-40f4-861d-cc16cdcafbd7", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713058815, "uuid": "060a0078-5972-4c73-b512-f102c8fcec94", "value": "49152:kSUl6vD5DxN6HHLJFwKJG7sPRgo2dNkWx9xnjblj52M7SrG0qrxo:kSSwD5DxkFvINddj72MeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713058815, "uuid": "2f5d3cbf-cc4c-4041-94e4-0efe898e1a1d", "value": 2294784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713058815, "uuid": "f568eb18-4183-4702-aa4c-605c78476766", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713058815, "uuid": "9cfd5e3c-b716-4caf-b08e-2d326bb49673", "value": "2a09d9b3cbac28ee87a63a7bb712fa97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }