{ "Event": { "published": true, "date": "2026-03-29", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-29", "timestamp": 1774828982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "88f44758-cb5d-410a-93c8-8ef321ad1e02", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ec4c9a-2ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774813532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813532, "uuid": "e3a08775-9ecf-48dc-80b0-a8ab54f29918", "comment": "Malware payload (ValleyRAT)", "value": "dd1de733c29417c756337b45de2cbb44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813532, "uuid": "af1cf9d6-bacd-493a-9ceb-ff011be759fe", "comment": "Malware payload (ValleyRAT)", "value": "01df83db7cc64db33ba0e1f16b7dea49d0e7c8f5f72a75558177ad23a04fdbb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813532, "uuid": "a39f622d-4502-4872-b5fc-5e8329b02fe9", "comment": "Malware payload (ValleyRAT)", "value": "cfa1390a46e79f72292cf31f425412382bbdfefc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813532, "uuid": "67474f53-83c1-4dea-806e-54600e88b029", "comment": "Malware payload (ValleyRAT)", "value": "35b0b5767ce71c72c02bafebfe753593562a09dbf2f69978016541135c631b03f16660ac3a991d67518e8fe53c5061d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813532, "uuid": "6cf3f565-e335-4c7c-b987-889043c41bff", "value": "T188D5330BE29A31D5C0F75276D050590AE377B8274B68C94F067897B63F77294CE3AB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813532, "uuid": "89da2ca4-7f11-43c0-9bb0-bef52c2d4745", "value": "8b4031b92c44016c8826162b179ab6d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813532, "uuid": "03b3135d-81b4-4448-bbd3-38b5894cd4cf", "value": "49152:QQR7XgF/L4vNq6b76P38iH674scXdYpZLjb3dOGC/8fOjdSHj7wXAQ7irAH:Qm7XsW43p6aXd+L3H48fOjywGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774813532, "uuid": "676d4ecb-a916-46d6-b619-c4daaabd6a59", "value": 2943488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774813532, "uuid": "b5ef5cd8-2e3c-4c91-9492-d9cdabc3ccb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813532, "uuid": "193d40ed-13d9-470c-b80b-d0df9b7a3b3f", "value": "80659af6_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb83970e-2b8a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774801108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774801108, "uuid": "903d9793-8240-4417-bc35-7e5abdee3cf2", "comment": "Malware payload", "value": "2bed31f3bd5cc4f6c21c24ea5dce8e44", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774801108, "uuid": "537ef9cc-2853-4b63-959a-6753c6a73810", "comment": "Malware payload", "value": "03f41d6baf40659b72817c4c6d4890971e4d1bbb55ce09c93b5cb84f53b1e423", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774801108, "uuid": "ec3cba50-c7c5-40a0-ae8a-44f1633574d6", "comment": "Malware payload", "value": "b341e1d978ed8ad55873d044cf70a1070be4b433", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774801108, "uuid": "97bf43e1-976c-4311-903a-d4f95fbedb72", "comment": "Malware payload", "value": "db311586f0f48cfc3526f7b1a28da137d2fada0a1f39c03bb78aeed5d6a26a94a998d80b945ea7c718569b953c09a3db", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774801108, "uuid": "dd205160-9d14-402b-bf88-6bdd83cd2e61", "value": "T1F128333F00B80470A8F5334BE6D1EF4AAEEDD00E58929D97D7A307BFB929A953055216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774801108, "uuid": "3ba8e897-4029-4e25-9ec6-209185964d6b", "value": "1572864:UifukvRm0c/ZmSb0zgjSVmWroyHHaLSYRnWmcrDiae7Ooy0HTUyX0:9WeRm0cXigQtroynaLPZDUCjHTX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774801108, "uuid": "6b608d78-975a-4fd2-9a10-3a307a9c1a5e", "value": 97324449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774801108, "uuid": "2b609e03-dcb8-4c76-8cc7-e7c781e9955a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774801108, "uuid": "292b192b-4a13-4dab-a0fc-d046448b6121", "value": "AssetRipper_win_x64 (1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f9a6e1-2b78-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774793072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793072, "uuid": "a3bfecfd-f5c2-4d99-9242-8e13ba2945d2", "comment": "Malware payload (Mirai)", "value": "59de86ed4a224460e4275e39e76b55c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793072, "uuid": "e12fab4d-8b5d-4096-bf87-a3c8aabea224", "comment": "Malware payload (Mirai)", "value": "0b3ccfd50900c6a377e91d4d3628e6f41d9934cbb2753ac01f546c6a4f33e170", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793072, "uuid": "5a5600d3-2609-4098-b5ff-6b89cbe13c6f", "comment": "Malware payload (Mirai)", "value": "55a764854d46dfb0e7b82b29816ae522c7092896", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793072, "uuid": "6c41d977-4b2a-454f-be9d-f6ec719ea21b", "comment": "Malware payload (Mirai)", "value": "6cc61d3f73ad6a7dbbbdf37d53fbc2bce56644697b07b816b13b564b7a5969712c11df9195ba0ef6240a49feff1708d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793072, "uuid": "352c80dc-58b1-4e53-a3ac-4752a39d41c2", "value": "T14CC3BED7F78B24A1CC6146F017C76B8E2E6361119E6BE9E76C1E663B093A0DF19063C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793072, "uuid": "c9aa096c-5e9a-4118-a41c-fd730c37182c", "value": "1536:BH6XXWAZxg6cgoWZKqUHQEyhBGLaDWql0W4s2sieEg6tCwxZJehgxuw/LWg:J6XXhxr4z+BGL+tJ2sd6tChhgxDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774793072, "uuid": "07309d2e-9fbd-4d99-b78c-5a7632586923", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774793072, "uuid": "3ddad7c6-807f-4f45-b2ba-60e4f24cf92f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793072, "uuid": "fc447557-8990-4f6b-be5b-ef9128682766", "value": "windy.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1196d7e7-2b98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774806755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774806755, "uuid": "2de33e7a-cb35-484d-a41f-ac48161e43dd", "comment": "Malware payload", "value": "05d5932013d1d1884a6dfb562d8d51fe", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774806755, "uuid": "bb1c9cf7-d2aa-456a-9c15-1b92f5e17cfe", "comment": "Malware payload", "value": "0bbe245f57c8b85adda154a8bd1561de4167b1863ea999d4c987b4ce5027d8f6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774806755, "uuid": "b4bfb425-ed27-4c96-8a48-5e8c41022848", "comment": "Malware payload", "value": "0e32f6b8ad5588703ebdf22b32a6e3e1aa56679c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774806755, "uuid": "9277a60d-a341-4709-94b0-60a3e04b4cf5", "comment": "Malware payload", "value": "5792dc441ac92b4b73e330871a4e9ff33476edd77c3a330e7c27b37e198ed68635dfbd65dd01617fbe51ad5b457e7423", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774806755, "uuid": "0082f281-c302-440c-9c35-2173c15103c1", "value": "T126265A05A3D405E4E323D630CBAA973ADA717C5B5339D25F2555E32B2F33A908E6A730", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774806755, "uuid": "e15b3605-b0a5-4621-93e4-d82bbc369a29", "value": "b1655caee90dc288a505d1043c7bc3b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774806755, "uuid": "e6540d0d-b75d-4a4a-904d-57db637a39e1", "value": "49152:3AYF77YN6rzym8DOrZZvtjyYzAEAamZmNJUd6HytBAjS1VYAnoW3U/pio58W0SaZ:hrnZvt+83gRM0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774806755, "uuid": "36d8e147-9a47-407d-b207-b5535784193c", "value": 4557312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774806755, "uuid": "ac3380fe-47c6-41d7-8b77-304615d02b87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774806755, "uuid": "8ad25216-d45f-431d-aa64-cab467939fab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5372bbab-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825334, "uuid": "7e01f146-d706-4415-a9d6-92a83becfdaf", "comment": "Malware payload (Mirai)", "value": "7b6a4688a25b1e39c0499ec7eae4d07b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825334, "uuid": "cab5d774-5399-4026-acbf-c45f5c225df2", "comment": "Malware payload (Mirai)", "value": "0c37b80d7e6237f7901456adf23101dfc242565cc4069d344814c1ef139b72b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825334, "uuid": "53f337d7-163f-424c-9988-bce14111c2bb", "comment": "Malware payload (Mirai)", "value": "fa34f04e3227fb47b84753edca0214f9a9d94b6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825334, "uuid": "bb72473e-6422-4061-8fbb-aaa9df5f8ddb", "comment": "Malware payload (Mirai)", "value": "fc2a8565a7bc3f3ee74940b2232f0b3bb209aa08ab7842fb62126309add76f00ea49a89cda938c2334dbd2df49480b91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825334, "uuid": "2e20bb1c-6df5-46d2-8397-25916d5e846c", "value": "T104E2F227EA00AF91C71848B56A14F3075ADB69F0D69F7422B31981588EF36CF99FC191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825334, "uuid": "13043646-7dca-49a3-91cc-8c26919f51a1", "value": "768:Ol5Kw9zvmKXPL+wcRH3fkJj0ayGhEB26wWKO714+3UN:6Kw9iKKw+3fkh0ayuv6wWxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825334, "uuid": "ff0f8ad8-e66b-4757-a63c-a4054785d936", "value": 33832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825334, "uuid": "3375fae5-4054-4f7e-b1ec-284c3bc0e767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825334, "uuid": "58b7ca90-3901-4f10-97b2-40ed8ed7c1ce", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55cc875a-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825338, "uuid": "f50ee8b9-ef8f-4817-9c12-70dc4b066bee", "comment": "Malware payload (Mirai)", "value": "75b50111423fcf6dbd1cf3bea5868748", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825338, "uuid": "b6b1227d-b7a8-4453-a85e-4393169641e0", "comment": "Malware payload (Mirai)", "value": "0cff253c0176e91c2b4852d8eaa47778f05f4606ff44ccdd697e4f3087de08ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825338, "uuid": "28754ade-76e8-4331-8ce1-55ca505844c3", "comment": "Malware payload (Mirai)", "value": "3c6bc369cf4f7982fddc5fb9751f8829a7516111", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825338, "uuid": "f22711fa-c244-48a4-9eab-4f432b2ec317", "comment": "Malware payload (Mirai)", "value": "2db2430b76d08f192cb1362b5c7321e47f2ae54fd07aea0525c6d1e756e0432f2cef6b14b60fc7f683024e9ef21184dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825338, "uuid": "9482713c-9166-4f12-bdb5-79b44009da41", "value": "T137F2F1E5D27E9F81DB6A713A09EF72078014EF0C76008BE46CA86CB75612ED568CA357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825338, "uuid": "70f05d41-84e3-4f44-86e6-eecb31bfb916", "value": "768:lBHjsjd69ZZSarsLNjllgLmh/dx4Mjo5MFFjyVNQx8nbcuyD7Ub/22:Ljsj0v/6dlKEFjINQGnouy862", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825338, "uuid": "12d1a223-3746-48ff-a808-5b2274a36475", "value": 34760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825338, "uuid": "d1ee303b-17e2-4bd3-905b-e31e9f7756b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825338, "uuid": "f5a20acf-ec40-4ad0-b7e2-6f4d9faf2ef1", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1cde438-2b7b-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1774794622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774794622, "uuid": "b7bbceb7-052d-4acf-ba49-f51d9cafaa47", "comment": "Malware payload (WannaCry)", "value": "6809fea24d93597bc8171487efdc52c1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774794622, "uuid": "f519b9ef-0c1d-41c0-a991-b481f5417221", "comment": "Malware payload (WannaCry)", "value": "0e42e5927b3e7628d578f609700ed180d5dece5d0639a681b96f183e22c8ac8a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774794622, "uuid": "2922daf6-dc1e-47c6-b63d-e0e1f841ccad", "comment": "Malware payload (WannaCry)", "value": "c74650d0763c72e5e872569ff6b17443067fcb16", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774794622, "uuid": "9bcb3e29-b733-4c81-8d1d-bb60396fa7e7", "comment": "Malware payload (WannaCry)", "value": "cd26d9fb9918fbc732b3563659caef6e02a0885d1c9fb0dcba8765acd712a66f0852c7a7be6f2194fb28e3a8a57ea083", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774794622, "uuid": "bca9c39f-5d11-4c34-9bb4-d24970cae8bd", "value": "T192363394626CB2FCF0450EB44463895AB7B73C69A7BE4E1F9BC086670C43B5BAFD0641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774794622, "uuid": "73d4b76c-d6df-48dc-9f72-5a0892242fbb", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774794622, "uuid": "d5969e24-293a-427e-868f-4fd80e399fbd", "value": "98304:fDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HO:fDqPe1Cxcxk3ZAEUadzR8yc4HO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774794622, "uuid": "083259b0-7dcc-465c-9770-8a291f97a30a", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774794622, "uuid": "e862598d-823b-42b5-a816-b826248eb242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774794622, "uuid": "40f821c7-1ddc-4e88-91c1-e6716116e4f9", "value": "0e42e5927b3e7628d578f609700ed180d5dece5d0639a681b96f183e22c8ac8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8981e14a-2bc1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774824566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824566, "uuid": "45cd92a8-c255-40b8-82f4-79d5a3e5d031", "comment": "Malware payload", "value": "62ddf127fd8a82d65385e3645f118d95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824566, "uuid": "e50315f4-236d-4dcb-ac97-f98a8f1e88ef", "comment": "Malware payload", "value": "12ca2254de1736b8efc63c7ba4e597740ccb3b922286311836c3a37b96f08a75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824566, "uuid": "ce1cb8b4-37ff-4ea3-bfd2-3298d1e5bbcc", "comment": "Malware payload", "value": "d872913e98d75757e640fd08750bf71f6fb121c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824566, "uuid": "08ca99df-7f43-4f85-8f57-4453c44b0dc4", "comment": "Malware payload", "value": "0bad1feb0cc7e8b61783fb6166431471108410740183e63f47cab886dd83d65b69b0aba527c0e1aff56eb5861c139a46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824566, "uuid": "a2b58b73-bc43-4fec-9397-46d5aa6b7785", "value": "T17C8602C5729C721EE168B5924F91D1D3C7CCCC6066F6E84ABCA7D6C5084A6EFAC7021B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824566, "uuid": "8caeee98-5f7f-4296-af03-fd6e5a55a97e", "value": "3ec40ef258012a6a096f45d9e8821282", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824566, "uuid": "3f35a26b-6f8e-429f-9d91-c08e985432b2", "value": "98304:Yq0DAAhRRtVqho8nIxAab2YbhAcPM83BlGGfrWSvhOp0COvSUWT+Jk3FlMN:Yq0TVDxpfhzdxcY9JK7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774824566, "uuid": "b6b42bb7-df4d-4779-a2a3-513db8ec7c64", "value": 7914496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774824566, "uuid": "f6aff2ba-8084-4f7b-b8b4-1dbc1282e4c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824566, "uuid": "00789248-4068-424b-815b-3018dec68481", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d59ebf80-2b7b-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1774794629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774794629, "uuid": "34255fa2-de83-4303-8ed5-0bd351e107a3", "comment": "Malware payload (WannaCry)", "value": "6f5645362e7d52785a5026d3dd38dbcd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774794629, "uuid": "a80200aa-e129-4a7d-85d4-41eb8e9ab3c1", "comment": "Malware payload (WannaCry)", "value": "139bf62f701613c60d5b18b5468aa32d555c147605c8a43465039f966b578cf2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774794629, "uuid": "37b8b416-82c8-40bb-a357-0f25a31282a6", "comment": "Malware payload (WannaCry)", "value": "a635b80f54172ee209c26d0b41b14acd6161bf55", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774794629, "uuid": "226e3a8f-9020-49f6-9049-de4f2652c5c4", "comment": "Malware payload (WannaCry)", "value": "0a4a7713a613f57b46ee063af338802ca5cc5bfd6061803b36108ccfe9fdb4f15c43dd81c9ddde235d0934de41e46e10", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774794629, "uuid": "e05a5237-8127-469c-bb78-93635408d563", "value": "T11236333861BEF778E39508FD10639AF66A73B4195AFE294E4B504C5B0C23B5FAE54803", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774794629, "uuid": "acc9455a-c39a-4268-ac68-ae09ec521ef9", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774794629, "uuid": "a764597b-1107-4591-b1ed-3bbc6956973f", "value": "98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9oftN26UBZA2:+DqPe1Cxcxk3ZAEUaEtN26UBu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774794629, "uuid": "2da9d95b-e7e6-425b-8dbd-25f609b51288", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774794629, "uuid": "d9709e19-92d5-42d4-b37c-26fdb3e066cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774794629, "uuid": "b81ffc9f-0e35-435f-be61-1532339b6fdf", "value": "139bf62f701613c60d5b18b5468aa32d555c147605c8a43465039f966b578cf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21920d0c-2bc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774823962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823962, "uuid": "ae96cb6d-6030-4fc9-90d5-d85d06f65d7b", "comment": "Malware payload (Mirai)", "value": "2c44734ab7aa4ca8dc908da9168971a1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823962, "uuid": "629054e7-add6-4fd6-aa6d-7caf4b36dda4", "comment": "Malware payload (Mirai)", "value": "147b9572375029155f270dfeaa409050cd192d3a2c17bff547fdc993e3dd988e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823962, "uuid": "b5297a55-5309-4c76-822c-bfbedd689f1a", "comment": "Malware payload (Mirai)", "value": "1bbb698f7dd1ee83edd667543d550284df887e48", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823962, "uuid": "502e59e3-3540-4dac-8205-1b10149a5b22", "comment": "Malware payload (Mirai)", "value": "7d89566d0044751b2517c3e86493d4a869d07c4bb10eae2e36e6e62c18c7b0b9e6aa1ec6e51d7322bdc4faa35d33faca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823962, "uuid": "651be58a-bc46-4f37-a75c-fe258af92ae1", "value": "T1BB13F18804E56566832059B6EED0D7C683DE8B3CD5FA98231E045ED4E6E6C4B3BFE4C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823962, "uuid": "cd1c3bc1-d020-4a03-9e59-79b19e88a6ad", "value": "768:erzD+GX7QWruIIOkByjnKkYEyEol8HKmJ77ZB7pCLabcQ+mys1ehX2a9q3UEL8i:evDZJuInJY8qmtD7pCLaj+myEehXQLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774823962, "uuid": "a61be80e-b193-44ba-923d-c2f89c0bafd7", "value": 44788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774823962, "uuid": "4364c204-d2a5-4a68-b811-140bed469c70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823962, "uuid": "06eda5a6-bf02-48c0-9bde-b5e342de6f7a", "value": "windy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2289fb-2b22-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774756334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774756334, "uuid": "64b7b6eb-df99-4d2b-a76f-ebc81377c49f", "comment": "Malware payload (QuasarRAT)", "value": "9dbd549527f715d839bfcfb75f9a74f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774756334, "uuid": "d4854df2-c407-4b50-843c-f883364bad02", "comment": "Malware payload (QuasarRAT)", "value": "1634d8e3e41040ba216ebf67d4c830cbd38c5e9c1f6623dcba630e2bd489d696", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774756334, "uuid": "2d37d71f-df5f-4dd9-af09-0c8f55195cdb", "comment": "Malware payload (QuasarRAT)", "value": "68f2abf1273b79365c9fd65358409e4be8717125", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774756334, "uuid": "5dc27791-51c5-4882-9d31-337bfc4a99a8", "comment": "Malware payload (QuasarRAT)", "value": "477e6c5c348b90dc975d4f765e07abb48e1fb71ff4797abbabf28030eeb5ed66395e36840b04443d91ac4354e92cddc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774756334, "uuid": "d1b9f2a0-062f-42eb-8f49-05e028be0b36", "value": "T1B34607242DEB102D7373AFA55FD8B8EF895FF6B32B0A64A9205103864723D41DD91B39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774756334, "uuid": "36581b16-d53a-4b5a-b15e-3fd4f4b583aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774756334, "uuid": "a24e6fb2-057e-4d03-b2df-d6b86cee0f10", "value": "24576:TzvislWlQT3HGQlJBPepkdPXk3+rxYa4tN3Sbty+PLqORKtOGyrLRNHEOXDrgCVn:TeOxrBGoNtsIKt/EnrT51loiVssKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774756334, "uuid": "3d3e3b0f-7632-4b69-8845-b5b7015489d4", "value": 5364224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774756334, "uuid": "ba33cb8c-c3b9-4577-9d2d-64d83f2bc2ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774756334, "uuid": "546499c6-b81b-47a0-bc35-4480f67cfc8c", "value": "1634d8e3e41040ba216ebf67d4c830cbd38c5e9c1f6623dcba630e2bd489d696.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690f9ea1-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774825370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825370, "uuid": "2ab250cd-06ce-4e2f-8ba5-40e2f281ce63", "comment": "Malware payload (Gafgyt)", "value": "8a154b80b5451704381ab4cac114af3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825370, "uuid": "629f5284-f36d-4f91-adb9-19d7c8e32fcf", "comment": "Malware payload (Gafgyt)", "value": "1a6603e91b01c18b7e4b61d911015d2376c6e2a01167cea85a181de42f95a2c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825370, "uuid": "e8bd2169-e2c0-41c8-a9ed-df8389d61e26", "comment": "Malware payload (Gafgyt)", "value": "c88540eb60e7fda413e66f45e42d61d31160a697", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825370, "uuid": "bcdbd4ad-265b-47ce-937e-514fd6303bbb", "comment": "Malware payload (Gafgyt)", "value": "ef23c331f6fa95c6b76f6529b634dc8728af8f0f62fa7b0bda0b3a96c8f9b21ee7c5cf839098dc10de41a66b237e8776", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825370, "uuid": "c9c042ce-e717-43e0-8168-613b9f2709a1", "value": "T1F5836B23A691C67BC08757F91BDBDA615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825370, "uuid": "34a51544-6a68-421c-8411-6a6d35113cae", "value": "1536:UB7crF7FePF5tZuEqdPUq0aJb9sqx3CjrM3XwuWALwimoIYuOVje+ZNne:URQFet5O7dPr0oSwyjr4XwulRmrYuOVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825370, "uuid": "b123a17a-1026-4972-a499-e10da29fc59f", "value": 85799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825370, "uuid": "007062f1-d361-42d2-b16a-19e84dbe85c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825370, "uuid": "085b3f27-27b0-4af0-acd8-2e638220c821", "value": "x-8.6-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9cbe63d-2b7b-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1774794636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774794636, "uuid": "189b2d45-3aac-4602-8766-3469e68991e6", "comment": "Malware payload (WannaCry)", "value": "7eff5deef51f8b9e9251b9e4cd13fe53", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774794636, "uuid": "117fe47b-9c2c-4142-a817-1e8c833af88f", "comment": "Malware payload (WannaCry)", "value": "1d2f1a8c2962658d14927983d05a370aae179f6d010fade109a6a5d918e9be84", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774794636, "uuid": "ac5ffb08-56b7-4094-ad68-aad24bcaf0fe", "comment": "Malware payload (WannaCry)", "value": "3a08ba046f82aba584c164080df1af41b437f39d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774794636, "uuid": "a843405f-e2c1-4b0f-85a8-8e621d8a3f02", "comment": "Malware payload (WannaCry)", "value": "55e93d3af3460daa3203c08e4ae279ad257f45696838a40f50d3d67cfa7b709829d8b5bac00dc44ea1d3569228c88762", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774794636, "uuid": "8c16c16a-270f-4d81-8acd-1fae6d7fc0d0", "value": "T101363351DAA896BCD0384970C87B4575F7BB7C941EBAAF0F8788C6711D02B15AFC0AC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774794636, "uuid": "867916bd-f50d-4c05-a348-07883c3601d6", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774794636, "uuid": "1fe0df28-7eea-4c99-91e6-dd5112284835", "value": "98304:+8qPoBh5uaRxcSUDk36SAnhq/a5xWa9P5j3R8yAVp2:+8qPAuCxcxk3ZAIadlR8yc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774794636, "uuid": "c7877e95-bb22-465b-b72b-2a74b5bf747f", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774794636, "uuid": "3721c75d-00b4-4629-850a-ae747505ce90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774794636, "uuid": "4dd3b30f-078d-4b66-b398-df9a83cd050d", "value": "1d2f1a8c2962658d14927983d05a370aae179f6d010fade109a6a5d918e9be84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2eb928-2b7b-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1774794643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774794643, "uuid": "c8f49416-0e3d-456c-b98e-53f8d352f21b", "comment": "Malware payload (WannaCry)", "value": "7c72ffedf679cbe21c41d0ca593dfed6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774794643, "uuid": "351b53c4-484e-49c5-84ea-b9b4990a29bf", "comment": "Malware payload (WannaCry)", "value": "1d9427b7739d112e11fefe58ece6d8d3758e10198d978c4cc812a10eaac0941c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774794643, "uuid": "fe654620-0ce7-49bd-bf40-f0b54e1c903a", "comment": "Malware payload (WannaCry)", "value": "184421fc1d2cd5a54ae31b73e25df68908bb1654", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774794643, "uuid": "9afcb8ab-37c7-47ac-953e-968bfac40ad6", "comment": "Malware payload (WannaCry)", "value": "e2c91860a5a7b1c84aa12757a75c996e7b7447ce03f3de173527cb06274ed0411589833d4fbda50567f9ba541d8d3f61", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774794643, "uuid": "e7d8419f-7a43-4408-be9b-a76b7ad40e29", "value": "T1EF3633B4A22CF6FCF0551EB144638927A6B33C6567BE4A1F8B8046670D43B6FAFD0941", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774794643, "uuid": "cd4c106d-433b-4605-a859-3fe9ae8f40e4", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774794643, "uuid": "dc60842b-fc3e-4dea-9f65-64e8ea7bebb5", "value": "98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:+DqPe1Cxcxk3ZAEUadzR8yc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774794643, "uuid": "6dba0f15-6bae-48fe-82a3-8fb448658e6d", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774794643, "uuid": "3eeb1dae-546d-464b-b903-c9630e7d07a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774794643, "uuid": "fb29879e-38f8-42db-9bba-e42902e5a1bc", "value": "1d9427b7739d112e11fefe58ece6d8d3758e10198d978c4cc812a10eaac0941c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb52daea-2b8c-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774801966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774801966, "uuid": "884a60aa-7ab6-46cf-b2d5-6139fe4c94e3", "comment": "Malware payload (RustyStealer)", "value": "7318155bf851f690f2bad7b39dc074ce", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774801966, "uuid": "96f17216-67fe-4bf1-81d7-7d9817379ed6", "comment": "Malware payload (RustyStealer)", "value": "1de78794bda5c92ce8c2369394e48a4a3013b3a6a3a2297acdf30c82f546a29f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774801966, "uuid": "950ef2a0-23da-4b1d-a15b-cd4774babef4", "comment": "Malware payload (RustyStealer)", "value": "ea6273f3e3f8a76dd9b1a891d20dae7e396a4e77", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774801966, "uuid": "40c4ade1-5b41-4a42-9914-edf6d85ec71b", "comment": "Malware payload (RustyStealer)", "value": "2f6e1c853eaec53d28dfe00f1e35d019d0083cf00d87313d5ff6349b6d86128b7239f421a3072852627220c09595efb0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774801966, "uuid": "8f7b30b5-8ebe-4342-8ee1-a199b0271328", "value": "T171957D07F1669CA9C7DAC075CF0AC162A761B80D07F36AFB359456E53F62AE07A39700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774801966, "uuid": "f8184af0-3caa-4e1d-aa84-3c30aab28a75", "value": "5541abf1016312bc2242ae797eecc55b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774801966, "uuid": "c2c4d634-a77a-4d5e-b54d-ea5bde417ea3", "value": "49152:Z/0g3wE+HdBfHIRD81ARimOPPjBWpHp9t5glL4iT+2CP:Zw9BfIRD81iOPwSL4iT+2CP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774801966, "uuid": "b2132ffd-2bcd-41e0-bb59-9f350af9ddb4", "value": 2008064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774801966, "uuid": "b96154de-3617-492b-9847-0c263e93e8f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774801966, "uuid": "ba2e56f6-4a59-48af-880a-a08ca049f8b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe516a2-2ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774813570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813570, "uuid": "713fef46-8c20-4958-a55a-2bc1f54f0b8e", "comment": "Malware payload (AsyncRAT)", "value": "d9a417e8486a0b038b35c6609a787438", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813570, "uuid": "3c0a42bc-25a5-4f68-a9cd-d1d06e8bb229", "comment": "Malware payload (AsyncRAT)", "value": "1eb1c7ec7f5e135172848f45bc7c4bc467d6fc2c6eadcaeb65be620013d0640f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813570, "uuid": "839b6b18-2781-4fad-9368-46dd14a02410", "comment": "Malware payload (AsyncRAT)", "value": "8d3f3977ca7de2d51375880b9ae248c7b8821df6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813570, "uuid": "be3f0e2b-b03f-4506-82d2-c67fc085ce2d", "comment": "Malware payload (AsyncRAT)", "value": "900fff665e6be6b3b899e4701ac0826ebd84ceea3c86466309ffdaaf071a1ff90695fab2a3fdd487fca1fc2c9dab1a4e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813570, "uuid": "2ca8a95a-40a2-43c6-837e-d82009aee3b6", "value": "T176134C007FE5C57BE3BE5FB858B2630545B5E9632603EA8D2CC010EA1A17BC59A416EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813570, "uuid": "3bc00091-b722-4453-be9a-3e02bd3e4243", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813570, "uuid": "d0b039a7-a06d-46e8-a467-723d1b189c95", "value": "768:twISQ2LrxI00vlvw/XNJM6DrglGVfhHydRC+:turVwlIfNi6DrgWpOC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774813570, "uuid": "b32a1c8f-df9b-4987-91c9-d4bd4eb9d204", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774813570, "uuid": "a0102c8a-3be4-4640-a208-622317a77123", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813570, "uuid": "d03e8ff3-8b9d-4b63-a88a-dd8fd4d40c50", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741540ab-2b1f-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774754951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754951, "uuid": "14453557-4953-4f60-88d2-d9a554ac71ab", "comment": "Malware payload (AsyncRAT)", "value": "83aa0bffa2f3948b056b39a83ff85784", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754951, "uuid": "c7841da0-8871-4bcc-b16c-022179626069", "comment": "Malware payload (AsyncRAT)", "value": "1f21c7aed67039f484041ab49770f127898d05aefce1b7962df29433ce88a8bb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754951, "uuid": "b7ad9f71-5906-40ee-b6a8-ffc8a46abe52", "comment": "Malware payload (AsyncRAT)", "value": "c769db73fc6f7e9ab72efc29fada643646ed72b0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754951, "uuid": "ce706ff3-9b0f-4a54-974b-66dc1deee1bf", "comment": "Malware payload (AsyncRAT)", "value": "1ca11cd8855bb5e7d89e8c8304b7a673af2a331e8cff03cf13fe3cf2a02e987f39edec3ac653966e4bfd603d91d726ab", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754951, "uuid": "b66ea022-28e1-423d-9db1-cb96e6b7dc68", "value": "T192135B48B7E04612E6FE6FB059B3A5070771F6139913DB9E08E4899B1B27BC0CD417E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754951, "uuid": "6c852d68-76e2-4bcd-8c7e-30b855d169aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754951, "uuid": "fbfa1267-f3b7-4a5e-9dfe-95f3fa4060e3", "value": "768:qRnravqZdb9ekxLjbsgNLmF+H9jwj67O+h8CbeJjRhGz:KravwX3bsg0FE9sj67O+DWj6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774754951, "uuid": "61c550f6-0954-4e39-a6b2-40aa6ff20f9e", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774754951, "uuid": "1eed5699-caf2-4139-b714-4009ce63d5c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754951, "uuid": "c68f5679-9f43-4870-a531-cea72b98bdb2", "value": "ZenithUpdater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9812b42-2b7d-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1774795521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774795521, "uuid": "018b2627-0f0e-40d0-a3fb-8e114738e6ca", "comment": "Malware payload (RatonRAT)", "value": "832f9bd4bd5b18e3764d9c6750504636", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774795521, "uuid": "4ca937a8-064f-4ef4-abb3-177255cd51b7", "comment": "Malware payload (RatonRAT)", "value": "21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774795521, "uuid": "43453e20-6616-4df8-bf7c-011936dba502", "comment": "Malware payload (RatonRAT)", "value": "ba14ba9f05dc608e77e62cd1aca15da0350c4d59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774795521, "uuid": "88765a38-7be0-41f3-9114-51e88e1b1d8c", "comment": "Malware payload (RatonRAT)", "value": "9f3dc60997a8feabe3dc4ce5593745a3bb6a9011b52e7ead91d3ace75e26dfc302e60e76f6df90ce7539bf7be0c47137", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774795521, "uuid": "0a880344-3757-4685-b8ae-4e02eb83b9c1", "value": "T1CAD5010C33FACA08F2BF4BF4A87585654771FE179C62D76C59A1799E14B2F08AA10723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774795521, "uuid": "5645f485-f862-4a4d-893a-b6b190c28608", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774795521, "uuid": "f056d322-33d7-4750-88da-479aedd8e94c", "value": "49152:/ugVUlsHjkmiGWU5FLGpMZ7iKPJ5W16sclR0BxMfzaRw4msF:/ugVUuHjkDGjzqpgmwQ13uRxfzew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774795521, "uuid": "91859a7a-abf7-4c4a-abe0-d4085059d341", "value": 3003904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774795521, "uuid": "e7700a50-587c-4e53-9863-b3728e0c176d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774795521, "uuid": "562c17e6-6ee0-4596-8f40-66068e4f1005", "value": "ratonClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05878f4a-2b26-11f1-a769-42010a9c0008", "comment": "Malware payload (Spambot.Kelihos)", "timestamp": 1774757772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774757772, "uuid": "06abaadf-0c5b-4239-95c3-bd3d60e5d398", "comment": "Malware payload (Spambot.Kelihos)", "value": "56639ce27cc7d7eb971c0ccbd0176c88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774757772, "uuid": "00c6b756-ca2d-4339-87b2-7847e6331836", "comment": "Malware payload (Spambot.Kelihos)", "value": "248210ab5672dabf88d101d810bd3e8a9050df0c2d026a19f92576aebfeb23f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774757772, "uuid": "39929245-d76a-495d-a374-0377de577f8a", "comment": "Malware payload (Spambot.Kelihos)", "value": "1146fa062b6e794220b785d25b74d87a658bbc4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774757772, "uuid": "b0e57713-7611-491b-b955-dec6474d4be3", "comment": "Malware payload (Spambot.Kelihos)", "value": "5365ce795c11088287f9b98f17bedd04c427468b5eae4bf31f455d9a1e426a339761c4ef0fac76a4243015a44e758286", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774757772, "uuid": "d59a36b8-e31e-4de1-b773-62a4b31e501a", "value": "T1E705D7E2EE0F98E4EA5101F5D925D1996D9F1CA07921B2C3A2C273DC8A70D87B325D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774757772, "uuid": "f510b75e-a739-4a68-bdf6-273d110092b6", "value": "9971e0363a89ffbd9253b320d60495f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774757772, "uuid": "6db71b49-b422-4c2e-a005-066aa799b5a3", "value": "12288:kc8Pzl9YIHKmklWCTBaHFZpcssaS+XMDkN:sB/hkldTMFZpjsJ+XMDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774757772, "uuid": "48207f86-8584-4aad-ba66-27d010888399", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774757772, "uuid": "f92fd748-242d-4396-ad01-f357374078c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774757772, "uuid": "1945667e-ba17-4c20-bf26-13a07e9c200e", "value": "Roblox.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ea55be-2b79-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1774793503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793503, "uuid": "1a07d83a-5f48-47d5-9efc-9f4732453d46", "comment": "Malware payload (SheetRAT)", "value": "06a1882cfb40365ca45ad2bbd9dac240", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793503, "uuid": "f3106d87-6d63-42e4-b61b-0e9700d0221c", "comment": "Malware payload (SheetRAT)", "value": "285eeaf46e455ad7a4405c71c404750a6882e7718e31cf2ba9636ad79d147384", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793503, "uuid": "50576891-713f-4f79-bb70-8c046c3ebbe6", "comment": "Malware payload (SheetRAT)", "value": "a51c6d0781939958574ca0d463f1316267f48e12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793503, "uuid": "9fda2c00-8fec-4c46-835d-d948ae902d82", "comment": "Malware payload (SheetRAT)", "value": "f3d737c3fad1ad48e8be10015f63d6f3539b53130442c05a1c8cfd4d18a1e98887d3e4ee6b85ac62ac73fd64c014ca6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793503, "uuid": "cc91ab48-d100-44c6-ad2b-06a6c8b274bd", "value": "T10FC4B41DFD81F805CE2A3EB3CFEA10049B7121C16E2195462159AFFD87A63B358E667C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793503, "uuid": "bdb53dba-8038-4841-863e-1f2d9b19a773", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793503, "uuid": "031214a2-dc73-42cd-85c1-e5c0c125f887", "value": "6144:vv2yBCYf1VoGfExk1sYJe6VlWT8b9ho7XQfNbwKCrHJ3KtEBibwulsctNq:vv2NgVoCLJPVle8twKCrHyEQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774793503, "uuid": "21da740b-81cb-4eeb-a534-9d5ae2904d63", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774793503, "uuid": "9b9d64a7-4da1-4dbd-8716-ae7a087fea68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793503, "uuid": "853157b7-814e-4847-bf69-925b2cf119f7", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3acb96-2bc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774824030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824030, "uuid": "52bff0ae-e28b-4543-98f1-61d35b0ab669", "comment": "Malware payload (Mirai)", "value": "f51d2756a32cf8d054008d056cf414a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824030, "uuid": "bccdc49b-d30f-497e-8b8b-ccc8e1716429", "comment": "Malware payload (Mirai)", "value": "288210752522c7df904be326de5c5f047d2a674393d7f010ae680c081d33cdf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824030, "uuid": "b9a467ab-ea3a-419f-8f1c-fc53b6248ee8", "comment": "Malware payload (Mirai)", "value": "57d6fb8fa15998bde3d2bdd4c31e81f088b52b59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824030, "uuid": "f434dbb1-6dca-49b8-89a4-ad7cd2a4905c", "comment": "Malware payload (Mirai)", "value": "167ecd9c100e785fca600f92037d632aca81b9084a92c650e36015c276512b8fa16f820da57e68a5b84cf56f293eda56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824030, "uuid": "54eb2eab-e0eb-4f47-8258-cb077338aec8", "value": "T189834A0273580D43D1A71EF02A3F37E593EFD59121F4BA89660E9B4A81B5EF2154AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824030, "uuid": "885b20be-a2ee-4dbf-bcf8-cedc3b2b9076", "value": "1536:r9UIXOVeWbi7RnNdtp4OlEFL+wmCWoyntMTYw5:r9UlViRnpdEF3mvkd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774824030, "uuid": "e04dacd7-4ef9-4878-a665-0cd7c1f82294", "value": 87736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774824030, "uuid": "3ecb67b8-0b10-4f38-83bb-37cfa2710377", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824030, "uuid": "984a80fa-5944-42d9-995b-8dc47694cf22", "value": "windy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90bf7795-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825437, "uuid": "8d4c66eb-136e-48fb-bd4c-6981e68958f4", "comment": "Malware payload (Mirai)", "value": "a2fa0ed8363274bd17e1be29001f805c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825437, "uuid": "37925b37-a96a-4213-9045-61a238b36213", "comment": "Malware payload (Mirai)", "value": "28ce7cea642540f5ea6cb8ac9398223074af0025276fff7279d4bae6ab7d6435", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825437, "uuid": "b4d351ca-2c0b-4061-ba58-9eaef2b63c54", "comment": "Malware payload (Mirai)", "value": "d0df7107d0fe3e21291aca70925c793ed014aaab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825437, "uuid": "99e33244-0382-48db-80c6-130c7e08be8d", "comment": "Malware payload (Mirai)", "value": "d3b0a12285e7f7edfd4dc5eef30620112552842035ed44616102bd9e464cbdb026a7672f1facea1cef6738d5ae749fff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825437, "uuid": "8dd8ad9d-20fd-4e1d-83d9-aa2415aa5072", "value": "T16F93B71E6E218FADF76D873047B78A21A75833D627E1D685E25CD6002F6038D641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825437, "uuid": "f3525b9b-7bce-4294-ba0a-ab628fcb3b4c", "value": "1536:1cDohjvTfUHjK6dCLP7iswE2H2MGJpmcnenH2qd2us/VY:Jhj7sH+LPTeHxGJpkdsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825437, "uuid": "e2b509db-4a10-4a67-a014-ca14369c1a7f", "value": 93500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825437, "uuid": "54c1b781-b6e1-4861-9901-3a7c2f740867", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825437, "uuid": "7802ad4f-72eb-4b58-b248-fb2b3a8c0984", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38636ee-2b29-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774759379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774759379, "uuid": "0b7efaf6-3ff5-49c4-af06-0fa55b584d99", "comment": "Malware payload (Vidar)", "value": "2a361b6d8cc482bcd2f22fb52c458416", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774759379, "uuid": "53bebe1c-5a29-4799-94e3-551e0705669b", "comment": "Malware payload (Vidar)", "value": "29cead46e54add46a02f4f8c8650bcacbc083d06560ac96f16b1085aaa2b0209", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774759379, "uuid": "4e86222a-1209-4457-bcce-261b6dd78884", "comment": "Malware payload (Vidar)", "value": "f17ca3780d7fa8a8b8acb492aca1e69117fecd49", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774759379, "uuid": "56ef3c3d-5204-4823-9dcc-c61ee5554621", "comment": "Malware payload (Vidar)", "value": "4701a51ef9a1077dd77c78cdb38b40f506d78489a37862387879c46ca0c936fbc25626481bd6805529dd83465567327d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774759379, "uuid": "acba9d44-460d-44ee-8ef6-eea8196d9591", "value": "T1ACD5AF46B8E928EEDA56C238829F93327779B8450531EFBB13B0D6353E13AD52F08745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774759379, "uuid": "f8fe4ae6-2eba-4c2f-9c76-1a8ed8af3eb8", "value": "ed963c018a7023f5fedaf9334669acbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774759379, "uuid": "953b029b-7c14-4bed-97a8-bb70be4a176d", "value": "49152:GeOAqNaiskrlEgePd/M58ltO5FmAnQ+unxLXGk8oOGoQS8frFH0sdATLDkktANxU:RKN7skid/MH0WgNXGYXomH0sdATLDkk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774759379, "uuid": "dc29c669-b26f-467d-b2d5-a176c33aa8a7", "value": 2914650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774759379, "uuid": "849d95be-c1d3-4b6c-8ce8-5a7e88a38b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774759379, "uuid": "26588d3e-3fd2-49ef-bbfa-23bf48cfb523", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3780c384-2b78-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774793075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793075, "uuid": "13236735-c102-4ca8-8fe6-1d89014c29c3", "comment": "Malware payload (Mirai)", "value": "9bee07f2af6cbeab14f145ff451811fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793075, "uuid": "9a78ce06-b003-4fdf-a3db-d8b6092f64a3", "comment": "Malware payload (Mirai)", "value": "2babebf57645fdf53226c5b91a2a512217ed7e993fc7925fcb2ec6f14664452d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793075, "uuid": "0a6a8029-dabb-4eea-a554-a14d05190133", "comment": "Malware payload (Mirai)", "value": "2b4fe845eb7142db6822f617ae7daba01338b296", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793075, "uuid": "e894bfe8-a47b-4d79-ae56-457adefd746b", "comment": "Malware payload (Mirai)", "value": "9b82da76166b3ef115d2236faf7a327f1efa41e514ba0396780b82fae552de0fceb2580a92c8cf96ffb2d76d9b6ee485", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793075, "uuid": "6dbd93f1-c972-4753-ad88-f39eb494029a", "value": "T14113F118E70108E1F292527B26BC0FD63FD31FBAB887D55D7518B640D6AA7F03462DA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793075, "uuid": "2416512f-1025-45d9-a039-27e4143625ea", "value": "768:WVSrYS3JuIk8or7wskgzNl2/wkRY7aYUeG4pU8T3BomHAdH5c0/FldKJgGlzDpbm:W8DY8oXws/f2/wkmuYUeGh8TG+EZpuVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774793075, "uuid": "280b866d-431b-499a-b54e-2be6ede28a51", "value": 43240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774793075, "uuid": "bcad5b68-965b-4c92-b0a3-ecd44b289f95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793075, "uuid": "f62b3530-2f73-4497-8e68-fd049e4308b0", "value": "windy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57afdf95-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825341, "uuid": "917e0032-eaf9-4942-af86-366df346ade1", "comment": "Malware payload (Mirai)", "value": "c4f26dcdf46595b5800a57d45e81140c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825341, "uuid": "eef90ff0-0e60-474a-b1fe-8851ef83736f", "comment": "Malware payload (Mirai)", "value": "2cbf8aab437d29c4f3fae1d5a754525766092ad07bfa2c3553b0b38a288ede2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825341, "uuid": "5e99253a-778a-4729-aecd-5f01295d488d", "comment": "Malware payload (Mirai)", "value": "f8506a3aa361d50dfbfb1ddc06cf8399590bf772", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825341, "uuid": "6e8e58c7-cbe5-4c68-8074-16ceaf880ab3", "comment": "Malware payload (Mirai)", "value": "14f570b0c9d140a9cdf62f61ef3e1a172343092a29a31db2614bfdc47136f0ac58c271e8cad65c97b6577aa964a4a92e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825341, "uuid": "60ff1e95-e6a2-4de8-83ec-0a95c7eacd37", "value": "T1CBC3AE32D8396DC4C1A45434F8B1EE711FA1A5C441A25EBB1AE5C97900C7DA8FA0EFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825341, "uuid": "65e1f994-3fa0-453d-96c0-d69540a2eeab", "value": "1536:qaZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKRZwMQaX4jnOsKigXIQSUwrVr1vw+:qf5Z5Z98XdmVMJaiaX7ziGSUGfIwEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825341, "uuid": "f4570180-7809-4b22-876a-574d50f61750", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825341, "uuid": "167fa4bb-6788-4de1-ac55-4ee53157402f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825341, "uuid": "e32be676-a9d7-44a3-a27e-6df7310c432b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e3fec1-2b78-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774793119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793119, "uuid": "3e9c30b5-e79e-49f4-add9-891a7a525e4e", "comment": "Malware payload (Mirai)", "value": "5b60644c5e866e2eb47ab001bc3c6c30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793119, "uuid": "ed928ca1-4324-4c5f-9989-830e6d026c24", "comment": "Malware payload (Mirai)", "value": "30caa75a64121dab20dcb1a757ac43f318e1d5657d829b00fe8b880ce56daa09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793119, "uuid": "5eb91e54-1eea-4f03-8765-5f40cefeb11c", "comment": "Malware payload (Mirai)", "value": "024a057005f6c353cac0b22daf0fe901687a939b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793119, "uuid": "dbcd5a9a-89e4-4987-80af-5dc218426ef3", "comment": "Malware payload (Mirai)", "value": "9f143267dacadcd075f8885a4d5241801d064f1b558540cfb4e62b74c1b16d681e52285b5ec064015103d6442bd98de4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793119, "uuid": "96af6fae-e926-4df8-854c-2e4f9a7d0184", "value": "T1D5B3E84E6F318F7DFBA8C23447B39A21975923D227E2C685D19CDA011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793119, "uuid": "aa0f5a0f-a635-445b-ba7a-07bb1f98047d", "value": "1536:SEkWiTLiZECcpHOWWJDmmn5Pd1Oe4uPrs9j4ZWn+E7+TeVedVPneQBZN01JX6n:gni50poFLP49j4+7+Te0dVPZ01R6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774793119, "uuid": "726123a6-1744-4c7c-816f-f61db5015138", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774793119, "uuid": "073f296a-53a7-49be-b989-ff7c3aa05e46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793119, "uuid": "22db5b9a-455a-4e1d-8515-cd2f0ef5ec3a", "value": "windy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f76d003-2b69-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774786619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774786619, "uuid": "7aa1c426-3a35-4d72-a4fb-01bf788b29ef", "comment": "Malware payload (ACRStealer)", "value": "fde52c2edf77895fed276329d4394ad4", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774786619, "uuid": "d5e1a406-ece7-43e4-9fcb-09e521f8af78", "comment": "Malware payload (ACRStealer)", "value": "31d63311ee4c9d8c7b198a85ba9ee0cb5af74c83621cbdf46c9e162a6595155c", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774786619, "uuid": "f950aeb2-2825-479f-a1a3-4efc4fca2d2e", "comment": "Malware payload (ACRStealer)", "value": "1cd1c3990b678526d7ba3f33b0fd18a276f3a428", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774786619, "uuid": "fd4ce7cb-5383-4d3f-8b76-84d8f654120f", "comment": "Malware payload (ACRStealer)", "value": "ca4cec40f6405c47e08f9be96a16e4d5c657743a070bdf07bf7ea5e4b4f8555b82f13cd49812a5753bf99b92fa2303f3", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774786619, "uuid": "5d557685-370d-4a2d-b8d6-f7c8202e8d25", "value": "T1EB363A0BBCB158E5C8E9A13485634716BA717C446F3523D72EB0F3A81F32BD05ABA758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774786619, "uuid": "bc8dd444-3bce-4c9e-a092-8dd18d002d49", "value": "534141bbeafb0cfa024f8b6830c176a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774786619, "uuid": "8423e003-261c-4232-890f-7ffc0d802add", "value": "49152:ZMAdyFf3ZVZZEtwvLNVXYQ312QtwMVmBKpcWn8Kjl0WySQcl4iTpc8:ZM9YSNVTRCKyXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774786619, "uuid": "df781cab-df42-47b1-a715-2980e3d88e6a", "value": 4986368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774786619, "uuid": "ac970e9e-d72e-4125-852d-908f6342c0dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774786619, "uuid": "b3dfdec9-6ac7-4b9b-a0b5-c2b53f515ada", "value": "SecuriteInfo.com.FileRepMalware.96918628", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bff1f82-2bc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774823926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823926, "uuid": "ea8aa0f8-e486-49da-8746-245742f0104f", "comment": "Malware payload (Mirai)", "value": "1bc3edebc116082cf5d40ed49c37794b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823926, "uuid": "4fd5ad28-3195-4b82-9193-437151d997be", "comment": "Malware payload (Mirai)", "value": "3269b21b563f8c4d4e9a15dd8afef34733c12060c1dee6787d8e785cc036f36a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823926, "uuid": "c2fd013e-b4bb-492d-8835-57c8acbba331", "comment": "Malware payload (Mirai)", "value": "34ee92ff52d71fe32cc5f0918ef75268b6a33ece", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823926, "uuid": "472d65e3-122f-430d-a501-247b7de55e48", "comment": "Malware payload (Mirai)", "value": "d181dac40075bb12214d12fe517bc1fd589ca94e7e67a100a3e979e5c666d968bce192441f30bced7220c8b39eb65b61", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823926, "uuid": "79ac21b5-c962-40d8-b3d4-4eeb3f1cbf94", "value": "T16BE48D2363518F94E364E3B102F74B249AA111A30BF355D69778E724FB4066C6C6FEE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823926, "uuid": "da0e5a18-ac9b-4589-98b7-09b8c5232afa", "value": "12288:r6DBr0fSk+hrqRmSvtAKUrUgNmWcIxTzrgv2tm5ICWEQalv7Q6rcTKHrG1XdjfBn:r6DBwfSk+h+cS/UrjmNETzrgv2tm5ICM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774823926, "uuid": "f11043d0-e26c-49ca-95b9-8ab7d5189f80", "value": 677668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774823926, "uuid": "9bb74a2f-16cc-4336-a9be-74b372efaaa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823926, "uuid": "ea28cfdd-05ac-43ce-b770-78164cc98f3c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4fe271-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825350, "uuid": "cdce7083-f686-4515-a624-f257c1003ce6", "comment": "Malware payload (Mirai)", "value": "6f09abdffc69ff553c41745b05298825", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825350, "uuid": "42b4976a-c398-4581-8c7f-19d8dbd53814", "comment": "Malware payload (Mirai)", "value": "3333f7d73320712fdcc424500069a312c0dd1fbabe770197a650854121647de4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825350, "uuid": "0f1bfec6-9e6b-4d35-8f09-da722aedf67d", "comment": "Malware payload (Mirai)", "value": "c8578c7bafb6d53561fa1f1c52818cad741062fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825350, "uuid": "e525e723-1d9f-4f68-933d-9ba9641f3cf8", "comment": "Malware payload (Mirai)", "value": "195f75f944fb7b6a2e06466b32d3227e1905a37cf6211dcf1ec86291cb2551b49d01f1f83062dea9dd3c481b7306ed25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825350, "uuid": "0682a0f8-9cf9-47c2-b263-e0030e9e69ca", "value": "T1DC03E15EEDF12DCFD0ADFCBF59E9BFD2568060C820926569A301C484578119EBD0CC9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825350, "uuid": "4be465e3-4883-450b-99a7-399ddc87a0ad", "value": "768:JBjST/vX+nzq45AWwAxe+Eve5C9bLIXqvLkQWTN1:JBWT/vX+zy+HInIuA9N1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825350, "uuid": "0a39b37d-5bc1-49aa-9de6-82adae9761b0", "value": 38104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825350, "uuid": "68029eb2-9c34-4b77-ad55-2f9e85ae4f7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825350, "uuid": "0f37bbb7-3aca-4de9-a4a9-48a4411c7a3d", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a98242-2ba1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774810810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774810810, "uuid": "71d9a08a-7ce2-4e93-bcf2-3d453316ae11", "comment": "Malware payload", "value": "9c521f97c23e24be4874cf1c381ec774", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774810810, "uuid": "76af7490-5643-4dd2-8800-45a0bd90f255", "comment": "Malware payload", "value": "37c46a92769ed3195fa6f75ec7783a170d7e8e98063cfc0307fcb03c17e1f652", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774810810, "uuid": "2f29d6de-b0da-4b27-8234-13d419391d1d", "comment": "Malware payload", "value": "2410aaa4befadc63a637c0d9d6675b4f1ae40b0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774810810, "uuid": "aa4edfaf-cc75-4093-86f4-e0b33ed784ca", "comment": "Malware payload", "value": "431f627893b106620a0765fc46e0110a217704a26990456d8d6838995bd9778743e4dbd080acd2ea4e713945cab710d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774810810, "uuid": "7ffa7a21-f275-44ab-b19d-0442a3140156", "value": "T15CB4F1C5BD20A95BE42D06760B23CBAFA5E4AC02DD12D2FF261DB7CF3E781419917294", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774810810, "uuid": "503c4f85-cf66-4a70-9ae8-8b0ba4e6df03", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774810810, "uuid": "de9f14a9-f57f-42be-9924-270be14a4dd9", "value": "6144:vMm4CCNDTT+/gxC1o5RgeocBA92lpeix8NpiZlgQ7EqZDR4djfksD9rlnsyB/rMJ:vMwW8XnczpSNUZFXK9kKlsyBz7JO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774810810, "uuid": "80401034-1f13-49bd-aec6-99b10f9db1ec", "value": 510099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774810810, "uuid": "2882e21e-fdf6-42ee-bbe5-8d52ec3bf91f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774810810, "uuid": "0e447e8d-12ef-4685-8ba3-6218336646a3", "value": "rpayment_slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8f5dbb-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825460, "uuid": "452719f0-c767-4b74-a423-79bf89a70a27", "comment": "Malware payload (Mirai)", "value": "c9bf4a23a858ab329aa862752b89759b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825460, "uuid": "fd461561-69a6-4abd-860e-842fed36c884", "comment": "Malware payload (Mirai)", "value": "37e0baf864ebc68b32d3d04e501a32f4c56e9942e0adb7aa00804e9512b184cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825460, "uuid": "edeed722-75be-4b06-bca2-85a469a1292f", "comment": "Malware payload (Mirai)", "value": "2f5ea0855c14a66fa7d8d7ee57381e5ce6f46ad2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825460, "uuid": "bacc6cbc-39b6-4145-97ac-be66f649087b", "comment": "Malware payload (Mirai)", "value": "53849f96689e2001730a8daf066a1ef98dd3b8dd8b772b8636b2d4b5f3898ccaf81ce848d8c43a2f6c8fa8eda50cdc06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825460, "uuid": "b29df04a-a130-4d55-90e9-30baa85a6625", "value": "T17DF3B50E6E198F7CF79987344BB79E32965833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825460, "uuid": "859f6082-0020-4762-bf91-075f83132ec0", "value": "3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiwx:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825460, "uuid": "0150a6ca-d4b4-4c34-b57c-5aca7b7f7929", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825460, "uuid": "aeb2d418-81ef-4934-bb11-c67dea6abb55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825460, "uuid": "7e95058d-ad7f-4bf8-9e9c-158866807d0c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9feadfa1-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825462, "uuid": "54914f8e-e7d0-47d8-bdad-6823d414d8db", "comment": "Malware payload (Mirai)", "value": "e06305187eedffc1e6190497ad5a67b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825462, "uuid": "9417509f-363e-473b-9929-3a8a1c4241c5", "comment": "Malware payload (Mirai)", "value": "37fd33e7050a41fd709e52fb96f879ed9d7ddaa0abe41a1471323e6f8ef89e3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825462, "uuid": "a8e03870-8a9d-428f-8534-292f0c89fb59", "comment": "Malware payload (Mirai)", "value": "230aaff989b209fa0ee50642f4f5c21fc80076dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825462, "uuid": "562a4087-cd4e-4f24-8d23-0a0b73869659", "comment": "Malware payload (Mirai)", "value": "d5a871ee8eda912d1a828ac413ff42a8e71601ee93a3adf5e36bcf19c3a0a6632f355fd172840ccceb70d35ff2e735fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825462, "uuid": "79011b25-f44e-4d7f-9763-f27e61c35981", "value": "T17E730A95B8818B22C5D512BFFA1E118E3313177CE3DE72229D20AF24778796B0E7B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825462, "uuid": "cb9bf80d-6e5f-41ad-b6e4-555f822e7c5c", "value": "1536:vDn7+uSlQstyEGi9oBJ+PsapkY8/Q/rMziI5B+7ry7WV5oYGs/g:GVllvG0oX+PsapRq5B+7ryiVuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825462, "uuid": "0604a22a-350d-40e6-9187-2c1587c5184c", "value": 80676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825462, "uuid": "0938187b-5c3a-440d-9e6f-38929d96e859", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825462, "uuid": "25303b62-030f-4d0a-86d8-ae82953dee66", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b88b91-2ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774813547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813547, "uuid": "05d72b95-f82a-4f46-8622-d7de4c633855", "comment": "Malware payload (SalatStealer)", "value": "02662630835398613d10451ffa54e595", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813547, "uuid": "28a0494c-0ceb-4a46-9e30-e7093722f493", "comment": "Malware payload (SalatStealer)", "value": "38fb1c66f6d0d2203d4ffcc24f978af5ceaec3c89acc82ac59c90456d88044a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813547, "uuid": "22f24577-9759-4b46-9f59-9a0869721b0b", "comment": "Malware payload (SalatStealer)", "value": "a18eeecd31f255214506d258db4480d73287b4a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813547, "uuid": "1ad7e377-6c9b-4569-8f78-8e64c41fb9b0", "comment": "Malware payload (SalatStealer)", "value": "1789627feb6f309a7f84e3d6fd07bfcba834a2686ad7e761f12e9a4d31ebf3c4154dd97540b79740b9aa954d4007974d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813547, "uuid": "51d279ea-2ae8-4dc8-910c-8fecd66c104f", "value": "T15CC64B11FACB54F6F9036831416BB27F23315D048B28DB9BEB587B2AF877691187A704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813547, "uuid": "74731efc-f881-40c2-8456-f68682774181", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813547, "uuid": "b04bb004-db1e-4944-8cfc-9b5494c69f00", "value": "49152:YRpK6fWxZHGQAulw19JRgfFC3b7HJFlwNwrH6PfLsdRyzVeAXH1SX8wRanDyBZOL:uKkWvw1rGtCfHur4EbRyc34pDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774813547, "uuid": "81cc012d-305e-4f80-8ee5-1d8fdfa3a2a7", "value": 12570112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774813547, "uuid": "9a331fae-b2f1-4502-a72f-100e12ae89e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813547, "uuid": "0dfd2344-afeb-4e2b-9a66-388624032145", "value": "02662630835398613d10451ffa54e595.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32204d2-2b98-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1774807133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774807133, "uuid": "4165dd76-f183-459c-8e49-3ed42a9d312e", "comment": "Malware payload (Gh0stRAT)", "value": "2e2ac362bdd5dcbb8e64948734f568e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Tinuke", "colour": "#CBAB16", "exportable": true, "hide_tag": false }, { "name": "Trojan:MSIL/Tinuke!rfn", "colour": "#7832B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774807133, "uuid": "0ffa1e12-49a4-4880-b50c-02e14b4b954e", "comment": "Malware payload (Gh0stRAT)", "value": "3940f7f953c71aedee15ca53e2a5aab82721cd3b7bb1d54bf4493036f5207343", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Tinuke", "colour": "#CBAB16", "exportable": true, "hide_tag": false }, { "name": "Trojan:MSIL/Tinuke!rfn", "colour": "#7832B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774807133, "uuid": "0c05810f-b315-48c7-b7cd-38194b14e05d", "comment": "Malware payload (Gh0stRAT)", "value": "938751fb97ba60e80c0dd105651742871cf64028", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Tinuke", "colour": "#CBAB16", "exportable": true, "hide_tag": false }, { "name": "Trojan:MSIL/Tinuke!rfn", "colour": "#7832B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774807133, "uuid": "8ef82210-4da4-4867-840b-456f137c2e94", "comment": "Malware payload (Gh0stRAT)", "value": "ff7508eadc5f0a7ec90d643da0c106446453de50d71da6f070f7ed8a9a879d1c7c78a75b0ce9487d3377088e613a4125", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Tinuke", "colour": "#CBAB16", "exportable": true, "hide_tag": false }, { "name": "Trojan:MSIL/Tinuke!rfn", "colour": "#7832B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774807133, "uuid": "f5481456-a766-4873-bd0d-5b576e3ca7bd", "value": "T10E74F60762ED3CE6D8368278AB7787C1D72EFC5502A1C62F02E042969E3F553792A7D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774807133, "uuid": "29f7ab8b-9f4e-4089-85ab-0ed79b015294", "value": "d50be5e341c3039df60a443c542d8ed0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774807133, "uuid": "04af883e-cffa-48c6-9c00-53cba909a076", "value": "6144:KhZDu3dyFUZ2VPcjrOdFysUNvV7arohEodB7N:KhZid8U+PiOFUNvBaro5B7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774807133, "uuid": "b22271e8-5477-4708-a374-1663013120f4", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774807133, "uuid": "b4c63298-a7c2-4c32-9914-fd99b1d84482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774807133, "uuid": "42131489-a22f-48af-9708-8a5b2cdff787", "value": "\u67ec\u57d4\u5be8\u8273\u9047\u53f2\u89c6\u9891\u6d41\u51fa\uff0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65692407-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825364, "uuid": "b7f042ac-3447-456c-8498-8d2b4d3f50c8", "comment": "Malware payload (Mirai)", "value": "d0e6e16ce426dbbfa910610fa95b91cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825364, "uuid": "573e02ff-6cc5-49c5-8e83-02b946768d9e", "comment": "Malware payload (Mirai)", "value": "3b604cb657086ad88b0b3b66ef86b9e49483a029b0ea778b388c88dd0f8a0ab7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825364, "uuid": "054d9da5-d5f8-4b1b-a2ec-4fd51b8fe982", "comment": "Malware payload (Mirai)", "value": "64604c2908b4eb727ae2f9a541170b11b63fdb24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825364, "uuid": "15a20941-08b8-4ad3-abef-df2e1f82bb5e", "comment": "Malware payload (Mirai)", "value": "7396e232fd12f5625c40ce76f8209ad90ebf6eb71364946917ffff882203a556a09bb2ca19f5c55a32aee6803251040a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825364, "uuid": "0af01438-c0f6-47ba-95d1-102a318c0c8b", "value": "T174E34D99F402DD7EFC0BE5BE44670E15F930A3A13143172A529BFDA3AC311A61D26DC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825364, "uuid": "9b5edbca-7a20-4fe8-8951-a5082fa787f5", "value": "3072:RmmyBVk2SJgvTcdV0+owYl10cvjvF9JrT7vyb+1:8S2SJgLmowXIvF9Fab+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825364, "uuid": "58ceb214-9f66-445d-bdc5-0eca61296282", "value": 146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825364, "uuid": "7290e8f3-a868-49f1-816b-1e39d76d4f41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825364, "uuid": "2b4adafd-3fcc-48bf-ac9e-ec0d4c00b9be", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9d9803-2b28-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774758645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774758645, "uuid": "271e4dbf-4ffd-4118-86f1-e34fe3aa1a11", "comment": "Malware payload", "value": "1a7523d92b573859df4cbe8e75509b9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774758645, "uuid": "13e59bdc-bddc-4105-b204-6a12e59a1a4f", "comment": "Malware payload", "value": "3c188e4651bcc07df2bdb06d69585158797b1bafb91557b09217621628cd5b23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774758645, "uuid": "b67612bc-0c00-43b7-bca9-e280656e8e6f", "comment": "Malware payload", "value": "65b0ccf1fe1f23c4a0557b8a30251cc7e70a1f73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774758645, "uuid": "f38727d0-9c11-4059-848d-1c6e838326cf", "comment": "Malware payload", "value": "395397ff36dc834e52dab264ae19681a07348683f523d60a9487c951b8e3a13ab7d4b306b9e88c69a10362ae83beae1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774758645, "uuid": "a2d0749a-dd6a-4478-b953-1f63ca4b72bd", "value": "T10E6733B51858C4B8E7E0B1F00807F5E1769AF9BCE9C5CC46B1F4BC99A19E4618FE612C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774758645, "uuid": "4706196b-b498-418d-9b4a-a0d40734683d", "value": "524711ec9c5a149fe3bf3479d0b505b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774758645, "uuid": "34aa628d-c212-4395-8ece-472c6f2053a2", "value": "786432:4JVdGL3z5NXeyQIwJtNYUJwif0nOJa9WEWRIOG5B7DVGLhYNBFv3cnZCa:gjOLXelIMjJwi0wMVW6n7ShYWCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774758645, "uuid": "aa34e9df-3c24-45e7-9ec3-b4c9170c7f48", "value": 31533074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774758645, "uuid": "a75e3e33-c23f-4d53-9be8-e925415eb584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774758645, "uuid": "a2c59b3d-7845-4d57-9122-a9f218bea718", "value": "2025-11-25_1a7523d92b573859df4cbe8e75509b9e_elex_wannacry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53dcf49a-2b78-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774793122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793122, "uuid": "0fb297e4-5bc0-4d61-a8a9-4ee7362c931b", "comment": "Malware payload (Mirai)", "value": "c265b154861cb13e1cc59c52f08e92d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793122, "uuid": "3798e35f-9a1c-46df-9b15-715853050f82", "comment": "Malware payload (Mirai)", "value": "3e5fd79dbeb79ad31241ad400ede9b9b19c377079e2ee5a1cc46ea68bb81aaef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793122, "uuid": "6e4d2e98-85f8-450f-b53c-c46675e8b287", "comment": "Malware payload (Mirai)", "value": "fdfdc747441011eab04f5e24772151bb37eeb457", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793122, "uuid": "d4161227-63cd-4b30-8487-e3c6744f98f4", "comment": "Malware payload (Mirai)", "value": "224d59f258ede0b8b41b06a480bbddf02a975e632a6dccdb9e86fd9f2cfb842df88095a64b56249fca3fc7ffce5bcd03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793122, "uuid": "b362246a-eefb-4062-96da-cbc9739eab13", "value": "T1B0737CC9E983D4F6EC130A350136BB379AB3E53E2169DB83C3A9A525DC125C2DA1735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793122, "uuid": "dcdada17-d195-4719-a311-66cfe49598f3", "value": "1536:Dbsv6XewvpXSGos1LNxVZW9Z3J8h3qaccSXJQ:DbsiJpiGokLNx+9zs3mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774793122, "uuid": "a86f33c1-80f7-4aad-a4c3-11bf84c48c11", "value": 79444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774793122, "uuid": "d18f7b0c-a112-4bb4-9cc9-c2e872276fbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793122, "uuid": "74ca701f-6d74-450a-a0b2-d00e5cccaf37", "value": "windy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30ffbb5-2b23-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774756748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774756748, "uuid": "c2876c55-71a0-4a41-a6ac-62eb371fecdd", "comment": "Malware payload (AsyncRAT)", "value": "f5e96f4d8d0b9a6f33db30e931b3441c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774756748, "uuid": "be0f24ef-ec6b-414e-a431-2e7a85aaf520", "comment": "Malware payload (AsyncRAT)", "value": "3f3ee3998fdb068cb54712483d156e29dd710493d4a5dbd95a296bc6d5fd550f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774756748, "uuid": "d67ced1b-d790-4cb2-a229-5d52b20459b8", "comment": "Malware payload (AsyncRAT)", "value": "c3ec6f94e0930658dc9ff6003d094bf1f4f27f01", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774756748, "uuid": "a5d4acd5-b8e3-4d45-9e37-8dd068095372", "comment": "Malware payload (AsyncRAT)", "value": "f67bd1180101234191046605aeb54d89768912f4b2bbf05f680287ed644b599c4448012209028bfdfbe1a627daf66ec9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774756748, "uuid": "dfdf581a-e59e-4f0d-ad4f-59fcab53067a", "value": "T130E23B4877E44712DAEEAFF12DF261065271D51BE813EFAE0CE485E62B67AC047403E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774756748, "uuid": "5e3d8d61-5096-4f2f-ab37-fe35eabb4eb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774756748, "uuid": "8b450cd0-e412-44d8-a95f-5a519cf21c9e", "value": "384:UlRmhGD91SluSWhnHHxzLmYV3Tm2eaFO4FzRApkFTBLTsOZwpGd2v99IkuisRVFg:gRPD9OQhx/BV3Tw49FzVFE9jAOjh9b9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774756748, "uuid": "ee48dafc-85fe-459e-a763-fd9172261809", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774756748, "uuid": "d3528081-e417-44c3-bff1-26e4454dca1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774756748, "uuid": "e2cb16a6-592e-4883-8ffd-b2ecc60f3ac2", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d4af70-2b9d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774808889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774808889, "uuid": "08087e82-e2a4-42d6-83f3-24bff1f1970a", "comment": "Malware payload", "value": "c9b13a4c396a013caaeec9d97d9d6116", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774808889, "uuid": "7b3dd3e2-f61f-495a-a7ac-397267b3afb2", "comment": "Malware payload", "value": "43c0c0319f07aecf86b35a3fb1712bf12030b6a494442d4dffaf34475eed86c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774808889, "uuid": "682ca5d3-6d55-4c2f-9ae0-74e09a3209d8", "comment": "Malware payload", "value": "04dbce52761c55ab1cac1a7fbab500e747e8ee99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774808889, "uuid": "8489c14b-86f4-4fe1-b2a9-1d725dccefc2", "comment": "Malware payload", "value": "50dbf3594891fbde74ea94b193d8270d42972efd23fc7585a57dd64b348af1da04576228b6ab54e5c28e6d80b808fc8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774808889, "uuid": "57b2e409-c17c-4acf-8651-7652d2f59837", "value": "T13AE62317B275C6B9D521C03AD0918EF4A73EBC28DB2780DB4152BE44F7358D81F3AA5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774808889, "uuid": "d27aae88-4e79-4272-826a-7eaedfbc4e06", "value": "81530254b85f34245257b4cb8cfcd6a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774808889, "uuid": "ff2807d2-176b-4473-99cf-12205afa180c", "value": "393216:UEJFsMXtGoOngfEkchhLbTJ9Qwv4zXO1Uc8vcBZ:x9GoOngLwhH1awwzEoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774808889, "uuid": "138ba6ec-1e31-486e-b581-8252b7764781", "value": 13972798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774808889, "uuid": "d2b8ce60-d671-4fe3-837c-c41268c81583", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774808889, "uuid": "6278ac5b-9298-4a3a-986e-170007364134", "value": "Pach_IDA.9.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6d9e25-2b2a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774759901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774759901, "uuid": "9e06764b-9faa-497b-a1ed-c11dfa72af51", "comment": "Malware payload (Mirai)", "value": "86e0ac10981f1ff60c24a23db304164d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774759901, "uuid": "5484c891-65c3-4649-b16d-8532aa562607", "comment": "Malware payload (Mirai)", "value": "455a2184eb7968578f8e89f00c4f5bb7ef8a526c0c3111a19bead76209153bc3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774759901, "uuid": "74be1c4b-32f6-4a1b-9ded-acd1d9e8175b", "comment": "Malware payload (Mirai)", "value": "1290ae31604028663c2ed8f180ece2a317610a2f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774759901, "uuid": "d63e748f-f3e2-467f-b57c-0c5a3bd35506", "comment": "Malware payload (Mirai)", "value": "40d762bf65909ad3bb4c9e66adecac30aebbb5d06fb7b45eed16186b3f26fea3cd4de00a8b37b4b2b5501db722508903", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774759901, "uuid": "8ac16982-da6c-46eb-81b7-c482b1eb55fd", "value": "T151A1C6E974B4936B2DB0ED7375D6CA52F14021A7E0C91C4EE6D6F0E8498CF61F494B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774759901, "uuid": "7628aeff-3cf3-4619-b4c4-b9091b67926c", "value": "48:vpK8KMV4kRWpKDK1V4NWpKrOKrWV44WpKQKoV4yWpKE0KEEV4E2WpKUKkV4WWpKd:v3CdjbmXKTGEpr7oF3j1fWjAtFrRjY/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774759901, "uuid": "53e1d8f0-423d-4fbe-a962-bc00ac5a6b5f", "value": 4807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774759901, "uuid": "cfd3b2c4-2318-40c5-8b0e-f28610842d46", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774759901, "uuid": "cc0d22b4-0991-4148-b5ec-d5bd8020de37", "value": "hnap", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e0988c-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825452, "uuid": "907d7f3c-b4b0-4e2d-b9bc-97cfe1ee4b3e", "comment": "Malware payload (Mirai)", "value": "8f2ab6653c2f4312a69f51fc7ab2c9ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825452, "uuid": "0c75026a-50e8-4110-8ae2-b5c22d600ef7", "comment": "Malware payload (Mirai)", "value": "4579abeba71267c2dbbfab620654685ace0bb161cf7c81b22d537ef5a9293833", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825452, "uuid": "3551156d-2789-438e-b7f6-4b465815cd11", "comment": "Malware payload (Mirai)", "value": "6a7f92039fd9f488144b071148bdb797928cf018", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825452, "uuid": "9b964bd4-5035-4600-9c18-52cedbf4a38e", "comment": "Malware payload (Mirai)", "value": "c994b0a209a7f0d67c8641ed2ce73b4af0ec0cf1d6cf2bc8c21d26942c6bf697c2269e96b372f3d6acfd706cd33819ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825452, "uuid": "1da0ca4b-0f18-42b3-af9f-03d8839560a0", "value": "T14493E706BB650FFBD86FCD3746A9070629CC551A22F53B3A3634C92CB54B64B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825452, "uuid": "212938eb-6096-435f-8968-61e9fc925bb6", "value": "1536:lm55Pq0N/wc34JTwK7VxpwNPmyF9AZQ2ZwOfFA9xwva2Bus1s/B:l25Pq0N/8MPmaaQ2HS4Es0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825452, "uuid": "2a7b411d-ffe7-4ea6-a467-14824e3bce37", "value": 97596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825452, "uuid": "8a54dcf6-e3c9-43c5-9b8b-42c22e2b9e90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825452, "uuid": "7c4b4f68-05ce-4515-9677-e97716882eff", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07e14d9-2b1d-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774754274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754274, "uuid": "416643f6-d523-4413-a524-3b4256c5b865", "comment": "Malware payload (ValleyRAT)", "value": "54a429080e06fd2b9d8e48ad362523de", "object_relation": "md5", "Tag": [ { "name": "Downloade", "colour": "#7F214F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754274, "uuid": "af6b97f4-73fa-413b-8c4d-650ba7806b18", "comment": "Malware payload (ValleyRAT)", "value": "47bf932521d49b5b44d5a6437aa7c558b1ab87f28d024c74545bdfecadda152b", "object_relation": "sha256", "Tag": [ { "name": "Downloade", "colour": "#7F214F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754274, "uuid": "ee41c904-c14a-463c-be7b-5f6e6d53be54", "comment": "Malware payload (ValleyRAT)", "value": "ce121d800a38db4849de9c7637a8343831e62409", "object_relation": "sha1", "Tag": [ { "name": "Downloade", "colour": "#7F214F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754274, "uuid": "9333ea4b-3be1-4ee1-9ed8-3295af652387", "comment": "Malware payload (ValleyRAT)", "value": "0b7f4b4d36d3ff6367bcd1beecb724411f57f06c49a5de24f4effaf1d3a3ecded3fbb892266377b3fa0d2e273d82a397", "object_relation": "sha3-384", "Tag": [ { "name": "Downloade", "colour": "#7F214F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754274, "uuid": "00faa2e7-d73a-40d9-b1f6-a30e4b51968b", "value": "T11AA27C99F85A48DEF0729578C82BAF9ED1F97A24632007DF53E1046E2F353C1A636742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754274, "uuid": "d7b96a38-a701-4cf9-ae7a-7247bb9d505e", "value": "564b6f17255f6c9f1282ea5e61b18c8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754274, "uuid": "3dfa038c-37e1-497e-a802-b0d8e04f75de", "value": "384:ybUGFrIVnOk/yidLkJHcCPLu3AOYWeQ3Ky6FL:fdmiViHDgAOt3Kp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774754274, "uuid": "f3aa9fdd-0540-4bfa-b64d-e94941550bb1", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774754274, "uuid": "24e1d185-1572-4bec-aab2-60800d181d6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754274, "uuid": "768e2110-9ba4-40e3-90ea-88557c7f35e4", "value": "avutil-56.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100f651d-2b1e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774754354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754354, "uuid": "e4f3ad5e-4c33-4f16-b0dc-ff1eb827c64c", "comment": "Malware payload", "value": "92346ae68111119bcd7af8da3bd8e230", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754354, "uuid": "5e930700-36e1-41e7-a72f-bc1f5748d070", "comment": "Malware payload", "value": "4b78e2f01354c29370600ff4845a2308003a9f218cc63721ec8a1fe331883b1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754354, "uuid": "b35d780c-453a-434f-8464-c3d47b991aa8", "comment": "Malware payload", "value": "4774ae94fdff4b850087033d30d0676a365b4025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754354, "uuid": "77f922f7-5795-45a8-b085-33020a768582", "comment": "Malware payload", "value": "126f041d75d1093f9e94a4880b13a904196e68e07c494e33e53fe4817b79bd000685a655648daef6c7fbbe58ceb0cbae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754354, "uuid": "73aeb910-241d-4296-a945-69b5b3600503", "value": "T11735B19C360B9530CF501E7E37EBD2E009A92941ED7DF1753BA0250E13EA99EDB61C62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754354, "uuid": "fcd6ff27-260f-4f29-a214-bc4b2a6c872e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754354, "uuid": "a3124729-7f35-4338-b250-254805b358b1", "value": "24576:Dw2nkacAuv0EkqjVnlqud+/2P+AoYOneL:DRnkr7nkqXfd+/9AoFne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774754354, "uuid": "70ec9d14-e957-4477-8998-90b9f027133d", "value": 1101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774754354, "uuid": "1d75ddf5-3c36-4efb-9699-20a613744fbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754354, "uuid": "b6ab10b0-5e4b-4b7a-bf6e-a2f680b09108", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f584ac0-2bc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774824039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824039, "uuid": "d8b32bcc-e9a4-4423-ab2d-542a409674a6", "comment": "Malware payload (Mirai)", "value": "36e134b9af4520f773ea0fbf8d59bd2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824039, "uuid": "6c27da60-3fd8-4998-814f-6072c0d6e5f4", "comment": "Malware payload (Mirai)", "value": "4bc506be35f69ca0d9269f2b34c28e01e924715cc9c6fb0b0218d45b6dda06c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824039, "uuid": "5275e997-3feb-446d-a413-316f0474bfbe", "comment": "Malware payload (Mirai)", "value": "012fbee1fbc9433870215bba2a5f86b7272d30bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824039, "uuid": "12416931-e968-4b59-ab5f-435d694caff7", "comment": "Malware payload (Mirai)", "value": "086381286ed86779fc90e45845a31859c67a85ef20c9f906a42297ca865a0368fd3b4b6f29fbec70d987582871d81105", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824039, "uuid": "49488597-8e35-4baa-93d8-b6ed88359c56", "value": "T1468329C1FA8BC0F1D91B89304067F63FCB31E9695061D75DEF9A9E36DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824039, "uuid": "2c5e3200-9847-42f5-ab42-105234d8ae64", "value": "1536:iXDwDhVtcU4xiUWaqH3FgqHeEMWximKjfTsv4gz9F7vrh:kDWKzQLH3FPjwmKjfTc4gN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774824039, "uuid": "e492b920-a9b8-462f-8ed3-6016afa5218d", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774824039, "uuid": "8dbe5c09-3ad1-4417-bd5a-e4fdeb0d2315", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824039, "uuid": "5353e7df-b858-4884-90c5-ff1226bd7d1f", "value": "windy.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d222c1-2bb8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774820766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774820766, "uuid": "47188cb6-788a-4db3-b3f6-83fcf574517d", "comment": "Malware payload (Mirai)", "value": "96f39086ac0598b71c735e44087393d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774820766, "uuid": "af3d9af1-0261-4370-92bf-5c5a18d389dd", "comment": "Malware payload (Mirai)", "value": "4d94abdaa66f3d76ea89d92f68314d2c560b7c67de10185046bfb940cd84f239", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774820766, "uuid": "c4ba3af8-36bf-4cce-aa81-505c26ab3da7", "comment": "Malware payload (Mirai)", "value": "c354362f471356bab11a558524104fbfbcccb13e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774820766, "uuid": "97183b08-7c79-4e4a-9795-d2124a81b97c", "comment": "Malware payload (Mirai)", "value": "bae03bb0063933febe95b4b38a6ca0f23035195d04450f86a3a6050cfa212217ada542444fc4e68ae97d2b173aa1e9f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774820766, "uuid": "8c01bd7a-4c7f-4a9f-b36f-03dd601a080a", "value": "T189265C46B5B318ADC15AC470876FD6236D31B89442727D7F2684AE343EB7E305B2EE21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774820766, "uuid": "c13d63c6-3635-4ffa-8777-d8730a9ea808", "value": "98304:puUAoFL0jWkTCBGOfQ2KTbETEY0Ly+eClb6sc:DGysl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774820766, "uuid": "a4709bd4-9daa-40b1-836d-fdb03397c41f", "value": 4547024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774820766, "uuid": "e5ac8378-13bc-4a4e-9fce-d82653c22509", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774820766, "uuid": "bef8de46-4c68-40e2-afbc-1fbd188b3ffc", "value": "wlan.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d185bc51-2b21-11f1-a769-42010a9c0008", "comment": "Malware payload (Zegost)", "timestamp": 1774755967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774755967, "uuid": "62215766-0add-41e6-9803-6989237ff1ba", "comment": "Malware payload (Zegost)", "value": "e22de83fa90cbcdf233b05c8cabc6624", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774755967, "uuid": "7d4443d6-4bf3-489c-ad6f-d3ec7b1c83b2", "comment": "Malware payload (Zegost)", "value": "523a3abe621406c1688e4baefdac6f8966af86363ae20e0dc901c674b3a2fa1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774755967, "uuid": "4bdcff36-7fd5-46b6-b3ce-70ec583ffcb9", "comment": "Malware payload (Zegost)", "value": "d590314936697591ff858ecbd2930bdd3c9351e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774755967, "uuid": "aa5500ca-3994-428d-add4-caecb6e49912", "comment": "Malware payload (Zegost)", "value": "e14cd7eafa85ae05eb33f24ad70fe3753e80fde356e07b136fda5431b9a375199d379c04c688ed6b515ba58d7eea5dc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774755967, "uuid": "ab6431fe-1674-4c2e-a792-0c340167a3a8", "value": "T13DC43B43A67F51AAC8C810318FB99276F9305EC070C6EE0AA7C1CE97D6BA3512D19777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774755967, "uuid": "0546080d-bdb9-4a1b-accf-874223c5115f", "value": "4f7a8aad56de9da5ad5543231a9c2656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774755967, "uuid": "c564c548-7f50-472c-82a5-89aa2ebf5edb", "value": "12288:EzQr+1kZVQQxfnr+TK7r79/JDXWE18qRzfG4M5NCT:UQKQVQQxfnr+TK7r79/JD71PRi4M5NCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774755967, "uuid": "2b32e42f-b93e-49fd-9158-524db4401fb4", "value": 578847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774755967, "uuid": "c854665a-06a8-4e7a-b104-5c915a3beb70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774755967, "uuid": "f7ad94da-5b70-4379-b255-8e2b363d7a46", "value": "523a3abe621406c1688e4baefdac6f8966af86363ae20e0dc901c674b3a2fa1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc0c50d-2bc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774824034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824034, "uuid": "22c5a73a-3484-43d7-b67e-a522f061894f", "comment": "Malware payload (Mirai)", "value": "36cff96dba763c6a0cff1edfd1b10c2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824034, "uuid": "53e3d0e7-123c-49fc-b8d2-6758ddc350ac", "comment": "Malware payload (Mirai)", "value": "5601f76b1fa047f46aa4db9b77e26aa3bc6f525333a5f3953f704c7352dac801", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824034, "uuid": "61802cd0-d766-492e-8803-67961a7e4a53", "comment": "Malware payload (Mirai)", "value": "fd4500763c6961db045c88c3c88b1d729b312658", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824034, "uuid": "224b5000-d0ef-4b12-91ec-8b67dc80397e", "comment": "Malware payload (Mirai)", "value": "30835dc8bb1d9da4630b506138f6a3d0170c05946ffd374bd239661cc06930de23a7836a910c7b7cf80da86b8240efc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824034, "uuid": "2648e01b-0741-4544-9631-15a083e56116", "value": "T109431780FCD2996EC6D4137AA73E358E33A1B3E4D1CA3613CD585B25338A68F5D66B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824034, "uuid": "d8ec80fd-6db9-4103-adea-4140e6fd6871", "value": "768:ncyi0+MnuAHIf/StW3GvQoyjEFMoRBN5cDqS8kTIM4cL/KIoNsit5ZMfgTBN1TWZ:n3nzHI36AGYDEFMWchcMLL/KBt5Z79C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774824034, "uuid": "1e16cfd4-22db-44cf-93b6-a9367fe338f5", "value": 55884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774824034, "uuid": "34cda7a6-3105-4d48-b217-ef7fc7ae33b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824034, "uuid": "63b844a1-9627-4d28-b28d-9090a4150970", "value": "windy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff31ebc1-2bbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774823904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823904, "uuid": "9f48359a-725a-4fc4-bd38-fe2ab26f02ee", "comment": "Malware payload (Mirai)", "value": "141e312df951666aba76957cb6c91f41", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823904, "uuid": "2ce8f9f2-7289-4086-8335-0e2c73610eeb", "comment": "Malware payload (Mirai)", "value": "58757065ea7cb595e5bbe9d479c0879e7be7cc6396e98f8b85457cfc297cd613", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823904, "uuid": "503008d8-3264-4051-8b55-f9c8ea26975c", "comment": "Malware payload (Mirai)", "value": "b3217669569429da669c942557d98227991f091d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823904, "uuid": "24d7dfd1-fa7b-4cd2-8b54-6a2d34f95a96", "comment": "Malware payload (Mirai)", "value": "13cc85035d8619aaba46530cfb3791362b26c6e97130a8679675f75bd4e41ad6a6799c52c811e95c65b31a1c596e633f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823904, "uuid": "85d3e64e-eb68-4338-87c0-cabe51d4b5dd", "value": "T155057C99E787E0E0F16300F1124FDBE35934B1365057EAF6FB452A6674327A22F1622B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823904, "uuid": "2d37d58a-b58b-4026-8cde-4a0c69705573", "value": "24576:Bnz946eGtf7o5h31heU0N8eZatK28jcdrS2yWlpFg4Z:BXfeh31hf0RZV28joZb+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774823904, "uuid": "8493d803-439e-47cc-b573-5a9955dc3ae6", "value": 858512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774823904, "uuid": "c20e33ab-8f77-4516-8625-4dd330e658c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823904, "uuid": "05ed0e30-5f5f-4127-a0bb-39a1904b2023", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a76d9d-2b56-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774778730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774778730, "uuid": "83bc4009-04c1-4084-bec4-17c4f1cdd443", "comment": "Malware payload (Mirai)", "value": "6d90168d0c9bdb896f649fa282eebb20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774778730, "uuid": "7f1c351e-a228-4a15-b8f3-17f292f8cfc5", "comment": "Malware payload (Mirai)", "value": "588c4aa1500c17a75a830c65032215767969a015d18e7adf467090f4be5cbc10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774778730, "uuid": "48c7f659-f679-4070-81ca-ddaa83d6d605", "comment": "Malware payload (Mirai)", "value": "8759d234397981b53544bfc22bc63d9a0a49bdce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774778730, "uuid": "851bd519-33db-444c-af4e-9eca971cb50a", "comment": "Malware payload (Mirai)", "value": "abd792da7501a63d2360829105a70d9eec1908e83b4002b275e827a0f78cc58726723b347120cdef4637dbd62be39bd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774778730, "uuid": "99d58c40-e6f4-4945-80e6-3be4155132ab", "value": "T100B4CF8377097726F4B8587ACED18F15BB29A7E605C35B2FA00CF2A059356B43F05E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774778730, "uuid": "b8e91a03-f385-4055-9583-9c5261737d3a", "value": "12288:0DVHPNWNRpvMNACOeAgW2zemn2UaebNGiKLhVH2HxVVo:yi5COeAgW2zzXHKlVWHxVVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774778730, "uuid": "ae26395b-c7bc-4e82-9cb8-bfff8f168d98", "value": 537568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774778730, "uuid": "1aa0bcbe-4ae4-46fd-b6d4-db8920fd8cf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774778730, "uuid": "fa81f1b2-0aed-4fe4-870f-7ae6e22e0cfc", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e34866-2b1e-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774754706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754706, "uuid": "cb19310f-93ad-4948-842c-2db445578fda", "comment": "Malware payload (QuasarRAT)", "value": "b6c327ecd634048616a94ed051fb4cd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754706, "uuid": "e5fcc47c-e976-427e-9c0a-574bd153b2bf", "comment": "Malware payload (QuasarRAT)", "value": "58c0f6f8f34d79ea67065761fd2bfc32101c1611cb7d16f5c15f8c19f8572e65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754706, "uuid": "0b125285-29eb-4f1d-b24f-9ea0d73ff7f9", "comment": "Malware payload (QuasarRAT)", "value": "9fe0ab54fbfd04d634da4c5828aa572d4e15745a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754706, "uuid": "8fd3ad32-e550-456e-8e94-f3e0d5f5a10c", "comment": "Malware payload (QuasarRAT)", "value": "cb0bf8ffdff32e5d83e02edcf1712544b41a37abe299c2dd8b31c591988e5c63164aa45849eb835008e8c7cecc8a1a86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754706, "uuid": "9e027f1f-1b53-41a3-a8f7-1407b48363eb", "value": "T181F5F1838FA21F96DD7116FA1658B08187CD60AD22A4DFC7E171E2936F1BF172D39908", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754706, "uuid": "ad4ec44a-d4ff-4f49-a64a-fc014d71f8f5", "value": "75f14bd3d4365d0894065c02d34d471a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754706, "uuid": "a34269ab-2a2b-49b8-bb55-911be9e5fe42", "value": "98304:nFB4syHalDOo2ZNAVkZnffwQP9v9C7TmYVRKX:ngsTlCo2YVkLN9C7hVRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774754706, "uuid": "b2111965-ddde-4c23-9cbd-28428b1e2421", "value": 3368448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774754706, "uuid": "5b298afd-b911-4852-a91e-b7a4bfa51770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754706, "uuid": "02d8ac51-d960-4596-a26c-f4fd1e2f1271", "value": "x58c0f6f8f34d79ea67065761fd2bfc32101c1611cb7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c7e816-2bb2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774818010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774818010, "uuid": "2f1a3755-4eda-4907-a829-ac4f9c9d8405", "comment": "Malware payload", "value": "84f67531335fc5329dd9b409851d6754", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774818010, "uuid": "f74d1716-fde0-4bb5-aff8-f4cfc07d2987", "comment": "Malware payload", "value": "5a29d662e1c3f2ebf77086eb10068bf3184434da5cd1de2ca0b921be701bde88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774818010, "uuid": "db4259d7-5226-4c7a-b2c5-148daffed53c", "comment": "Malware payload", "value": "1f592263abbb0c1128c9ea44c71e37520f833641", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774818010, "uuid": "e6674c54-0c5a-4e4c-8256-fea09797eb38", "comment": "Malware payload", "value": "fa4d11190c59e3dddd7351bdc6780b0d4e5f7a35c082583aa393c2b1c9535830e8dfa353af4075de5e9a3ca43a4445f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774818010, "uuid": "56e3dd31-aac2-4865-ae26-4edb2219a922", "value": "T1C7A4F1D47E14A55BE06D06360B278B9F59E0AC12EC12D2FF2718BBCF3D7C2429917299", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774818010, "uuid": "d4defc3e-5f7b-4aa4-a0f2-4359897b8471", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774818010, "uuid": "9d7a3e68-a2cd-4b2f-80ca-23f9a6f8657a", "value": "6144:vMm4CCNDTT+/gxC1o5Rgeo9CBALBKNJeEDlfdRx4REFqXePV8CD9rlnsyB/rMym4:vMwW8Xn9CgKrdlf9qceglsyBz7Jb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774818010, "uuid": "7d6e6e62-c399-4092-a19e-e50c3f280053", "value": 486840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774818010, "uuid": "087b20bd-c489-4f9b-92b0-255d4873abb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774818010, "uuid": "70759f37-b127-4424-8157-9e2ea0d76d22", "value": "rpayment_slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ed046c-2b73-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774791158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774791158, "uuid": "e0428bd7-0be1-43c4-9a77-4747545f74d6", "comment": "Malware payload (LummaStealer)", "value": "bef152aa33b2a968b5655f5730fc646e", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774791158, "uuid": "733b44b9-21aa-4b54-a947-4236b7700234", "comment": "Malware payload (LummaStealer)", "value": "5accd6688104348dae56f451d14d0f107b138dd5a793259fa14ce722e18d20a3", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774791158, "uuid": "10694515-31f3-43fe-bbf4-1aedf0834fff", "comment": "Malware payload (LummaStealer)", "value": "8139a93950905fb31135ab02219266bc05401f41", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774791158, "uuid": "79dc3219-804a-4948-bb17-07a5f01414b0", "comment": "Malware payload (LummaStealer)", "value": "b6cea7ab4df75a5518cedb2e249a02e0e599f7daed9b65d14fcab7eb86e1e96cf95299da8182ad659b4e5180ce239189", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774791158, "uuid": "abe3cccd-376d-43f8-b8d3-0c3cbed9b606", "value": "T187654A45EDC709B6E112133259BB62EF3335AC090F329AD7EA44763AF9776D21832316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774791158, "uuid": "ae8e9269-1737-4b4d-a588-415b914ad8cd", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774791158, "uuid": "f4428f51-1897-4e01-af11-8b9cfa7ab246", "value": "24576:0yQ+bIGSlwVIg/LetD9eKKTiWuOqHmHAA8Rz2aNLlK21i7GDYEIJIT+Vqb3cuVtG:0DCPAgKKu15K21aGYEIJTkbsuab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774791158, "uuid": "2b4814d8-a233-40a9-a033-c1fcb8fe57c3", "value": 1530880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774791158, "uuid": "112fa358-50c9-45b7-88db-955b184c8196", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774791158, "uuid": "74ce14e5-a189-4117-8318-d22794dcd9a7", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5894ddbd-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774825342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825342, "uuid": "37a316f5-b296-4e1f-ae05-67918f1417be", "comment": "Malware payload (Gafgyt)", "value": "135a0c25d260a1e76a66173d0a7a0a01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825342, "uuid": "bb057e0d-f329-4d3b-a47c-d2ff6dddb460", "comment": "Malware payload (Gafgyt)", "value": "5b44583dc55181a7da206710553122310b4bd1f9139dba774c7b584b22f4b1d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825342, "uuid": "b1a070dc-b92c-4ff4-b4de-1013fbfe24ba", "comment": "Malware payload (Gafgyt)", "value": "7534724c3afcbdef268fefafd7f8239bdfbf69f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825342, "uuid": "caf73fc5-88e7-4d15-a283-48e89c7f69f3", "comment": "Malware payload (Gafgyt)", "value": "0ad3cac00e8d27a800f944d3acc1ec66e84f79860d5c8cdb53d506ed495ae15e61cd1e4100bb5ff3e395af7594832d97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825342, "uuid": "daa6137e-08c8-4ba0-a094-6737ac460cb2", "value": "T1BC931A41F9448B27C2D227BBE78F439D37366A5497D733026A257EB42BC279C2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825342, "uuid": "5abdea6f-7981-43a6-8064-bc69e21f20a2", "value": "1536:EIkg9VQPAWeMTEb82Mm3xDKMsF0rOLcvLNPzRxQMZLiBhCGTtLmCVrQAFW9OXkYe:dQaMTDWWFGLNPXL6CGJmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825342, "uuid": "ad834bf6-bd07-4daf-91ef-97c18a2a7a20", "value": 97534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825342, "uuid": "21b9ccda-1257-409d-ae06-3a4530ff7ca0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825342, "uuid": "5e6965bd-645d-490c-94ac-3c6bb2673869", "value": "p-p.c-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5178ff-2b93-11f1-a769-42010a9c0008", "comment": "Malware payload (Triada)", "timestamp": 1774805006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774805006, "uuid": "ed896fc4-64a2-4eef-bc46-791e932e05e0", "comment": "Malware payload (Triada)", "value": "3300ce9a2f47ba4a6ead9bed168b06d6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774805006, "uuid": "dbf27a8b-0e55-4bf9-9908-7d190c1aac53", "comment": "Malware payload (Triada)", "value": "5c9f3c404d5ea7405a236c01b8b598b3f794b246ec0c7e52450844518ebaf9f0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774805006, "uuid": "af94d035-961d-4210-99b0-fd5915898b0b", "comment": "Malware payload (Triada)", "value": "5de33e21965d1e956c29095966d85244fac7996b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774805006, "uuid": "3ae441fc-56ec-44c9-b38e-0c7c8c0dad7a", "comment": "Malware payload (Triada)", "value": "9bf31f19871a74a220967f33c89d9e2a355de9f7b8de07e15b85ebc2eae5568342be90400a4c1afbe957578d14ff4e7d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774805006, "uuid": "1c00c2eb-961d-460d-aa4d-ea0f5a8f44d7", "value": "T11A28128AFB8DDC1DC9F759319B4A5BE6560D5E244A12E7DB2B00720D1C73AE84B0EDC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774805006, "uuid": "c0b2e27b-29d0-4a70-9ad0-1d3ef3ece176", "value": "1572864:KMuKALSX9ZlRLG+/tmqRdQgDtP18E3Qsz0HqOxj98CYSGQcabbCT1VbgzBKu0B:fuKALmlLmqDF6E9OD8CYStDfCSKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774805006, "uuid": "6506ed3d-83e4-44df-980d-9b6891fd9dd4", "value": 99599513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774805006, "uuid": "41c60cb8-2a05-4911-9d23-5a4ba7ad8f27", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774805006, "uuid": "1006e12c-6ce0-4fa4-94e7-b12f78f8daa3", "value": "GBWhatsApp-58745668.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4f2f25-2b46-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774771828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774771828, "uuid": "20f72086-118b-461e-b69e-58cb172695e9", "comment": "Malware payload (RustyStealer)", "value": "3fbd77906ce82362de067125f72999bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774771828, "uuid": "fed74c91-a24d-4ddb-8623-67a107d6e682", "comment": "Malware payload (RustyStealer)", "value": "5e9c2eb567afbac69325a43a5dc04e04341c00b3ee53f130151b23b82a71d5db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774771828, "uuid": "74009b6c-e647-451f-84f1-5d4a743bde16", "comment": "Malware payload (RustyStealer)", "value": "24bf3f6ea7fb2b2461296762d213f7945b3968be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774771828, "uuid": "b484a1e9-c914-404f-be5c-4c1eb4fa0ad2", "comment": "Malware payload (RustyStealer)", "value": "75eb1a52e022b7c82921a14ac996223a5329962a4efd609a6461173403987badf04ff3ea1638c9b232ece9bf4d2c5b22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774771828, "uuid": "8fee9b51-a94d-41a3-896d-5175696b57f6", "value": "T14FE57C43F2D785E8C06EC470A359A537FB36788A053476FB9BE057102E2AF905E6D329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774771828, "uuid": "4ebda5aa-1d46-4a0a-9359-f33722e77788", "value": "49152:8VHE1a2gvE4w1lNCU0X7YOqNpV5hg0Hluo9/+MRZNuE4:aHEtgCSXDqr3hd9n4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774771828, "uuid": "f04ca7a8-0edb-4801-a6f2-38b4b4c9bc92", "value": 3215616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774771828, "uuid": "914a9e45-2786-4ccf-b92e-426de5c75e2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774771828, "uuid": "8caf25b5-d35d-484b-a1c0-59f56e728f09", "value": "hello-world-v2-signed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15777d29-2b8b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774801178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774801178, "uuid": "e41c63c4-9508-4f92-bdcc-d64e2ecf99c5", "comment": "Malware payload (AsyncRAT)", "value": "7500daffd770dd604da0a00f64b351e6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774801178, "uuid": "20ba4f69-d6f8-4944-8f53-0ecfaec9aaad", "comment": "Malware payload (AsyncRAT)", "value": "65434c758e946eb000d1cad6d9f1e8ada1a76cd846ea64da27408f2309cd18c5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774801178, "uuid": "91e0e65b-235c-4458-be62-d54085d89871", "comment": "Malware payload (AsyncRAT)", "value": "135c9aabd694d03b49a0f6468dfeb8c30b9e84ff", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774801178, "uuid": "feb6558b-ac96-464b-bf94-12538b4156c0", "comment": "Malware payload (AsyncRAT)", "value": "5f5a733cea8d87ea66b6229638081a142a46630c80da53b759c29086ab73031e143697d6cf91c5c9463a4a78c6596747", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774801178, "uuid": "76fda2d4-6817-4f4d-9752-649d7513e3c6", "value": "T171F7331F21670250EAD92766C36DB3DE3B50493FB8AD64CF52C920EC9AA4C4DD9AC70D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774801178, "uuid": "a63f0c9d-c9ef-48e3-9af3-d6488140331c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774801178, "uuid": "47dece74-3726-47d8-bd9b-9eece70dd7e8", "value": "1572864:9kSZEq4v0PE18qoLEFSW2REMj7SlFGZ0L3x9jUea0Rl:4Iw8LqSW2eMjejQCBZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774801178, "uuid": "167ebf48-f5a2-4861-a6b7-25bf1f517c67", "value": 75289600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774801178, "uuid": "e40ff061-ceb5-4a8b-a698-3a7358f185ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774801178, "uuid": "a3f1e9ae-236f-4112-99dc-9f40399553c7", "value": "AssetRipper Auto Updater V8.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5f172b-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825349, "uuid": "f39579c4-aec9-41d6-9eca-994f19d11e7a", "comment": "Malware payload (Mirai)", "value": "0e9191852f844d90d2be34b2754c3946", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825349, "uuid": "84c5abb7-e627-44af-bb3e-9bd50196a46c", "comment": "Malware payload (Mirai)", "value": "678f6ec55b7c3ad2bb2dbc78b8b09507a858c269b3ec702c4de4c0b43cbfc971", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825349, "uuid": "30f157df-8ada-4b89-b067-0079e7962e79", "comment": "Malware payload (Mirai)", "value": "7a2344e937efbf524b6721b891c67522b7cb1bfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825349, "uuid": "6313a348-9d63-47f8-918a-6a476a67b04a", "comment": "Malware payload (Mirai)", "value": "c10a7bc1cf456b4cb6daae5720348d9d5fe8f38cc9767c8379b0627365fb22b53d2775b793c951184b384a58f18e7314", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825349, "uuid": "03d6503b-f810-44bf-899a-7d211562ce4c", "value": "T12E430111AE8801ACDD52683CEDF79453F4EF2FB8C9546181006A4FB136927DE26F2B5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825349, "uuid": "26e80ff9-8d76-4351-9755-7216abe5819f", "value": "768:BxvkP751jdIEJryhSw1PrtqUbeULD+Y0ywd4DT1zHpmq3UiripWXm3ULdXxQzACs:BxopWh3zoArMyEArXd71qCYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825349, "uuid": "dd378904-04e7-457b-99d6-71fc00faff87", "value": 59928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825349, "uuid": "2ddc1c5d-6b48-453c-9cd0-e84938f71515", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825349, "uuid": "7bbf4d1a-f747-4f0c-b2cb-aade29d3f97e", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c785e2-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825366, "uuid": "8303cb3b-18e3-48c3-8c3d-d7ea1b1469c3", "comment": "Malware payload (Mirai)", "value": "d073823042272a9fd140650a3dc7524b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825366, "uuid": "a87a25c1-7ac3-4841-877f-d1c01cac54a3", "comment": "Malware payload (Mirai)", "value": "67b2b10afd1e6980ffd3af7cfcbc5248ab104ed40c6233339e6f676ec0d286d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825366, "uuid": "a70329dd-562a-4953-8a05-dfa438456109", "comment": "Malware payload (Mirai)", "value": "684eb457f2a60cd2149ca372d3ee0ab3009e05dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825366, "uuid": "c4057167-65a3-420d-b5c0-75783d36aa40", "comment": "Malware payload (Mirai)", "value": "9f1dd3ed814f35ac4cbb14b63b5650caf0374f97f3be29a4e7f9c5f266fb4d47eb63d3d7ce3636e1be0fa104e98c682d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825366, "uuid": "fd1680d7-e62a-4581-863e-c93161cceb4e", "value": "T102D35C0677180E57D5A34AB0263F1BE083FED5D121F4BA89291F9B6A4672E3B5481FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825366, "uuid": "1d82a188-1a3a-487a-a198-635cd7e39083", "value": "3072:JUFczWKNZhc3JiwmS7ZHr2Um/u4SM89tkkb:DvNo2kdr2Um24SM8Pkkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825366, "uuid": "de7053b1-9d2d-4f26-8e68-14ea996313bf", "value": 134328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825366, "uuid": "01f15b1f-e4b9-49e8-9586-037b510212bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825366, "uuid": "2127acd1-c0cb-4025-aef9-6b13995f5dcf", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c05d50-2bbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774823838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823838, "uuid": "27cb1c60-b90c-4270-8b9c-dc1a1e901f8a", "comment": "Malware payload (Mirai)", "value": "f8cfbe53f9a6da654fb7fb7476688bc2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823838, "uuid": "ab5f5d93-3bca-4f8c-af79-226d796095b2", "comment": "Malware payload (Mirai)", "value": "67b74b68c81d7f317e1f7a206a1d6e83a3029dc1cb9905f0610516b59102c0d4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823838, "uuid": "96ae76af-f8f6-422b-9eff-6a29c132c843", "comment": "Malware payload (Mirai)", "value": "340a510a3b2e0e5f4f879ef5934f3cae2f0ce057", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823838, "uuid": "c70f4736-9b50-4d28-b886-0d6dcec670cb", "comment": "Malware payload (Mirai)", "value": "f1da950d169289a81440fad6a6e47105569fd5ff46e6566aea2b378c4fb752f1a16a9139c4f7d01834a7b8b56f32bf2f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823838, "uuid": "f4ebaa3e-9e41-467a-b185-39c9fe5cd82a", "value": "T1FF02532BA3546898D06D8374826F12D7EBF7FA744AB2372F3D4824302C839254DA2E05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823838, "uuid": "245618f1-6e67-4341-b59f-9e3718da9520", "value": "24:GtIVsosEhX/AD1snix3slMQ7g+M6tUP+cbsVC:GtItpoDOiRs3gpWUGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774823838, "uuid": "7f4ad33b-8ab5-4cb0-abea-c8f83c204b9e", "value": 8792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774823838, "uuid": "94accb85-5531-4a0f-af30-d7c35361d670", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823838, "uuid": "4f226ec5-05ec-4c8d-9909-23123b38a90c", "value": "dlr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d425d1-2bc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774824026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824026, "uuid": "cdbd6bf0-0a68-4da3-a843-1353fb88ad33", "comment": "Malware payload (Mirai)", "value": "5fd7d7ec9ce17549ac1d31133e5c3e92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824026, "uuid": "10bedb6e-520a-463b-8900-0d6c899c953d", "comment": "Malware payload (Mirai)", "value": "69d2875340d6634857fb689b2f4ceb51baeb3e1b58d322df30140be89f9c520a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824026, "uuid": "968a0fda-42dd-4c71-b954-1f596ad1d90f", "comment": "Malware payload (Mirai)", "value": "3d7489516522febb25effcbcd0216bcbb87a9fab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824026, "uuid": "a8a37e19-e810-4a1e-9355-169cb3ede8d5", "comment": "Malware payload (Mirai)", "value": "077f274fd96712b67ffb06128848cd8a55cf8b07adf3727d6c08809da8f643640c5b5743a2643a8144b045ef455539ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824026, "uuid": "8ba72c54-00fc-4cf6-8d2d-73fa1d9a652e", "value": "T1DCA32946F8814A21C5D512BEFA1E318E331357BCE2DE73129E14AF2173865EB0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824026, "uuid": "634b41d3-a90f-4a6e-970e-6f7e0906e481", "value": "1536:wAnTSlO27kf5J7ZLBpqpp8GBgcQxEE3k7uaRrtOXrD0Rilp2x/F0v7Xh5GYWcO6:ilRbpp8nuik7uaRgp2x/F8ThULD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774824026, "uuid": "fa678132-3f8a-4e41-a073-b0ac604cb0d2", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774824026, "uuid": "8604ad21-aeba-4e97-b10b-bf4c80ff9333", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824026, "uuid": "3ff3f2a6-b776-4400-b0cb-2e136efc2664", "value": "windy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e777d8ce-2ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774813556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813556, "uuid": "8ecf38b2-db53-4b7c-844d-db66e862c6e2", "comment": "Malware payload (SalatStealer)", "value": "e728c9763c3fc2f9b4278106ad9d6eec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813556, "uuid": "ed22615c-eeaa-4fc5-bdbd-cf1ae8662f50", "comment": "Malware payload (SalatStealer)", "value": "6bb3897eee87674c14a9ce7034bb63532b83c30e2546caadfeb50beeb7d4f43d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813556, "uuid": "c7a41c97-7351-401e-a1c5-664abf19facc", "comment": "Malware payload (SalatStealer)", "value": "878c55898951ec6b5d31d4e588da08af8168abd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813556, "uuid": "cdd12079-2370-4dbc-9615-85c3a25422cb", "comment": "Malware payload (SalatStealer)", "value": "2e735a0804e7edcc0fe2078ca0babce9b0ffb5cc703149d4132633219f433803c49c968be9054b17468fb848e1ab8a08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813556, "uuid": "73d842de-43df-4ca5-9b92-529393022d13", "value": "T1BE563343BFF160F5F9A207B37824E52447F0BB3A45B53B42F4BC219AA93270AE615356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813556, "uuid": "95374653-ed30-40b3-8f57-0dffe146154e", "value": "6766c89b00794786728faa9481f76444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813556, "uuid": "d3d92c63-354c-467c-b22c-23986972c070", "value": "98304:XL+K2yMtp8q4bRwGYfliV7PVdg0rK0R0I6wIxbExt:aK2PB4bRwGvVdg0rVeyIxgxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774813556, "uuid": "24ec8a0e-5a89-4fd5-a680-8fa7d44d709d", "value": 5900464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774813556, "uuid": "d2586e0f-bd9f-4094-ace3-90bf5917d0c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813556, "uuid": "3d2cb2dd-a518-4964-a1fa-2933e50aa1eb", "value": "HawkClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5d9774-2b91-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1774803820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774803820, "uuid": "37c2b4eb-fb46-46c8-b3e8-81644091ce1a", "comment": "Malware payload (DonutLoader)", "value": "b15ccbdd24dd09f8b9b78203f2e2d294", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774803820, "uuid": "54b80eb3-1c8e-488d-bc41-757a58f18dc6", "comment": "Malware payload (DonutLoader)", "value": "6e077e8b2d9fc9a2e9ea4f10a541d43835a0db3951061b32975ffa0ef064554f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774803820, "uuid": "638413c2-527b-4b45-9775-4c028e5f3d61", "comment": "Malware payload (DonutLoader)", "value": "287eebb1b8b352232b7305b5c60412477e343bbb", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774803820, "uuid": "227b6cbe-d68e-4d42-81e2-395e61182a64", "comment": "Malware payload (DonutLoader)", "value": "765d84b15aa9ffcb6277f8db3a54f5ca2955432c19fff3c8ae3e7af5f253530f0890d3922dd2c999730a2688db07e2e5", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774803820, "uuid": "a3963820-ae48-433c-b6e9-0b8ee4649e76", "value": "T1303502114AC82FB9CEAC5A1890FE161F63F0568E9556708AFF63BE0ABFF754442070D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774803820, "uuid": "83ccb094-8c96-4408-9bdd-a753d319ecba", "value": "24576:bp7BB9Fr6ArFrDlaXro6UFPlhP9UBUcQY3+:9xrD/LTYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774803820, "uuid": "fc6b2da6-3190-41f1-94ac-04bc61861bc4", "value": 1146138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774803820, "uuid": "7daeedb8-752b-4943-a866-cb17578722e3", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774803820, "uuid": "ed04d18c-fced-473a-b02d-55fdf9f44d1d", "value": "Enquiry for Alpentech-ACHV-0045RFQ26.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d8c3f9-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825368, "uuid": "26d92d40-0a15-4865-8b49-017cd7aec867", "comment": "Malware payload (Mirai)", "value": "1ecdf763fbaa08dfa8ed5ace93826152", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825368, "uuid": "63172ae4-73e7-4337-959e-1a1857169fac", "comment": "Malware payload (Mirai)", "value": "6ea7f03131b3c7fc38d92b671c02a07e40ea5c7b0e08d2766d1ce975fca58a14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825368, "uuid": "04e02166-a9e0-410d-ac71-a2040b8b34d9", "comment": "Malware payload (Mirai)", "value": "f1ac70195e21f768567c59ec09534f9cfa65b94a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825368, "uuid": "1806826e-cd19-4e98-956f-f295f5e0c1f1", "comment": "Malware payload (Mirai)", "value": "c220b7663b70467b5e6f20ad91c6b5c921be04ac5a2a98cdea9c79d7d3a5bae3f24065eb589ecf6bd6975e8745122a04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825368, "uuid": "7c3677a8-6920-488c-8c9d-25776e085e6a", "value": "T18DE34B55B8828A22C9D513BEF92D018E331327A8E2DF7213DD105F2577C7A6B0DB7A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825368, "uuid": "d212ac45-2fe8-4d36-b645-029b9f014afb", "value": "3072:ENcMOvrpToDzK7rMeQzlue1k6aU9zL6EiueCo2k4:AOhoDzKnMereS6a4Iueck4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825368, "uuid": "81d23357-a1fe-4229-96e4-2576b5d5cdb5", "value": 145536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825368, "uuid": "0e788f55-ce3d-4da9-b9f6-ce4ada4e7b5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825368, "uuid": "ffc51742-6b10-4c77-91d5-e1e915c0d5f9", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4619b9-2b7f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774796411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774796411, "uuid": "63667ebb-4583-4979-96f8-59f616b50f60", "comment": "Malware payload", "value": "5d893fe7c16a8ae3cdd069004ff0bbec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774796411, "uuid": "e30c6b76-edde-4225-a969-4e263eda977c", "comment": "Malware payload", "value": "7867bfe587f444654a9c9d4693ca6f1987dcc7f4cbf4942b45449156496febb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774796411, "uuid": "fedde81e-b026-488f-8e6e-c412f431fb97", "comment": "Malware payload", "value": "af00b12f31b5755e06731983a7e3a220984aee36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774796411, "uuid": "effd4539-18ff-4d9a-9ee0-e33a8d6c4217", "comment": "Malware payload", "value": "b7150cbbc3ca58b6163e5027804db6eea0be766da88be2af1795e426babf338d5d30e32b242b4e0dfcba9c37324d97be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774796411, "uuid": "badb0167-fae7-43ac-b573-699e7350a85c", "value": "T1D855DFA6E3509897CAD40AB5DD09FF700B743EFCEA1BC261B5E53C8F74B97A11841262", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774796411, "uuid": "9221b7e4-f3f1-4d5c-83a4-a9cfec2a38e9", "value": "24576:zjZEAWwwqiQkHsCT47xOlOzHGmnAr4EkcMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMo:zjakwqWsYgOlkGiEkcMMMMMMMMMMMMMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774796411, "uuid": "bbf2be94-6981-4536-bbf5-a1c776e67f80", "value": 1353216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774796411, "uuid": "5becdc54-b500-4161-b6db-726d3909c2b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774796411, "uuid": "380f7b6c-bdf0-4b31-a847-85bf3e0d8985", "value": "z1ItemsNeeded.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc1f3a9-2bc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774823928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823928, "uuid": "31b0d79d-1ccf-4d55-ae90-3d61c8b8e7ba", "comment": "Malware payload (Mirai)", "value": "521764a4e0edd958143d38618d293180", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823928, "uuid": "1cc2683d-bd66-458f-955e-7f4e05a04815", "comment": "Malware payload (Mirai)", "value": "78cca939729b78dea94d79359fbb437b745b2a9a463d8ca37f4b0e8d4b0e1ffb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823928, "uuid": "8dfa79f9-3520-4873-ad5a-448db361251f", "comment": "Malware payload (Mirai)", "value": "47d0256cbb1e2285b854077d27287ddd7bd673c1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823928, "uuid": "1acbfd69-14b6-40be-9dbf-d9e9656deb88", "comment": "Malware payload (Mirai)", "value": "9b4886341bf267dd436b94ae51c7d6eb78c1b9540ce559a59737fbacc4419cffc9a4121559c4aeef273ee12193cfd474", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823928, "uuid": "c593eba9-b49f-4cc2-878f-a5e79ffc23e1", "value": "T110155C51FF0C2826DA4909F4A57F47B4F7A2389381F8D1213B052AB724527795CEBE8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823928, "uuid": "5ee68a30-ec79-44cb-8db5-3cbc9980af4d", "value": "24576:J0+lcl3CjY9bTMYBAbxNxzSdgffzPJAHinmg6Sdk3aOBJIXwRA:Jflcl3CjY9bTMYBAbxNxOdgffzPEimgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774823928, "uuid": "d5c15178-5fbb-4f7a-97d5-bcead5382199", "value": 928544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774823928, "uuid": "ba6d8400-0b11-4388-af1a-19d1bcbb15fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823928, "uuid": "cb0f55cb-af87-4f7b-b4f1-8e12bdca111e", "value": "powerpc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7727223e-2bc2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774824964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824964, "uuid": "c98b701c-30fe-4d9c-ad88-01e66a2bfb42", "comment": "Malware payload", "value": "0ab9f020fc8f7843864b1639216b18f9", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824964, "uuid": "187cc2b6-eddb-4551-9897-b24cb26864f1", "comment": "Malware payload", "value": "79384f45ade51cbc9e49b060a532de92c8b57f02333e0429f6f5aa58d2cc27f6", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824964, "uuid": "be3c9a33-47c1-4ecf-b1d0-06050495ab62", "comment": "Malware payload", "value": "96a83824b23416a2be736c85f27e952ed1921e07", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824964, "uuid": "b63856a8-ef5e-4968-b988-8055236a255b", "comment": "Malware payload", "value": "9ccabf1909f33fccff874eef214ff0648d4bed04a15a75a93897f0272b316a2cdce752e770ec0b45d22338348f2fd341", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824964, "uuid": "b5ee6ef0-b3cb-4fc8-bf94-117ad329d273", "value": "T16115330802B55E3AEFC1D1E96075B745DD2BA1F3775B9EFCEA6D0FA98E4F1A81081120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824964, "uuid": "ce317799-a95b-416d-8616-77622f1ec97b", "value": "24576:58vdqbNUI28y9eA/u1qYU7mNqgv5+0mPa0q9owMWK9:evdKNUgy9eA/u1qV6NqC5+085q9own2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774824964, "uuid": "dcec5a0f-6c40-4ca6-bfbe-5e42782181f8", "value": 946178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774824964, "uuid": "1d13432f-6a3c-47a6-b1cd-9e46a7553419", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824964, "uuid": "c7f02f52-8928-4527-aed4-f8850d8f8761", "value": "dateas_shoko_fullinformation2026.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59fc1864-2bbc-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774822338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774822338, "uuid": "3d4d24a7-271a-4ac2-a97c-08b341389b5e", "comment": "Malware payload (njrat)", "value": "82199d6679aeec51cebde9dc55db2303", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774822338, "uuid": "aee5479e-7774-410f-98a2-5541b7beb7a5", "comment": "Malware payload (njrat)", "value": "7bd313add125c26c87e12f2c32c36b1a6c69f9c12e9158bb8f2db2865aab9c08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774822338, "uuid": "341dcaed-dcc7-4aea-bb7c-dbac8c776ae3", "comment": "Malware payload (njrat)", "value": "81f9fdba0682f4f08f409f89f7300397f3d2bce3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774822338, "uuid": "b1a82043-df69-49b3-a12f-929d82307023", "comment": "Malware payload (njrat)", "value": "f709167be5e913d7a34929b274483a9182bd4411df56dafb39943603f2f914d57436f4ad55dea158533ca195a96b0f5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774822338, "uuid": "2b44efd6-aaaf-44fb-a4c3-3172c47cd3f6", "value": "T1E125C09173F4850AE1FF1B75F4B249594BB7F9529A36DB4F0888A0AD1EB37408E103A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774822338, "uuid": "d8986ef1-2e7b-43e3-b10e-7f53f3185e28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774822338, "uuid": "1aa5da68-3469-4f2d-ab02-d873dbe84481", "value": "24576:8F/pFxJzck+uGW/yFoBkkAQXbSTNXqNzgY:8F/pFTYjqqanTXwNXqJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774822338, "uuid": "ce2a46fd-18ab-4f7b-bc36-a97f248f6f9c", "value": 977920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774822338, "uuid": "9b363fd8-29d6-46ea-bc81-4642caefffc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774822338, "uuid": "c72f1bcd-ece3-4dc0-8b2d-c210ea5f12b0", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f662dad-2b27-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774758460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774758460, "uuid": "d3e622cc-8f2b-4119-aa4f-d3018babb079", "comment": "Malware payload", "value": "3d737cd7f968b846a4102a0395819096", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774758460, "uuid": "d14206dd-e63f-4317-8d1d-71295707fb63", "comment": "Malware payload", "value": "7cb3fe26ce9f4845870a8bcfbbe00d41ae0232573c1c625e2bef06ec3ed18c7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774758460, "uuid": "d468f53e-0bbe-432a-b5ff-bd8596fa9f70", "comment": "Malware payload", "value": "868bea3108b07fd0e5fd32d6a2550e92a9f0068a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774758460, "uuid": "8563bb84-309f-444a-891a-704d77bcdd9a", "comment": "Malware payload", "value": "a3bfd1ef8d21312bef7098c05a1dda48e978b4abc3e1e3f36c1ae9542a282067f422724ca56110a10e7b25db5ff1e313", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774758460, "uuid": "0aae0957-7614-47e2-936b-5afa434f3cce", "value": "T1BAA5D00573E442DDFEABE1768A13C50BD7B278450773865F06A06A766F33B712A2E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774758460, "uuid": "651004b4-3b64-4139-bfb4-8d04cbd59622", "value": "638af1c562ad8f76992023c9692ec222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774758460, "uuid": "ea8f5ee2-abee-40ab-82ca-e3e50e5d1da3", "value": "49152:/1H4jR2TYrQbDTrJHeqtaDma7YqrU4u6tBvALfuGv:OUJtwTcqrUF6tBvAju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774758460, "uuid": "42bfb0dd-2967-4034-88b4-8556aa54834c", "value": 2144768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774758460, "uuid": "cabdf510-dc79-4999-8230-70bbdecbc284", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774758460, "uuid": "46371aee-aca1-4df2-8b27-9fb3c3c90e47", "value": "GenP-v3.7.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f85056-2b21-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1774755677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774755677, "uuid": "a425225f-6894-4cbd-9b46-5c37cb8fc806", "comment": "Malware payload (GCleaner)", "value": "44ff6d581df349f24e3c2c23e1b2bd6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774755677, "uuid": "8f4083c5-1425-48ec-b4b1-5968b314eac2", "comment": "Malware payload (GCleaner)", "value": "80a741131bec7b3fc74b4cec678fa45e61760914a9e87c4434cb12f8266df426", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774755677, "uuid": "134c4b20-cb14-4f1d-95bf-a90030961621", "comment": "Malware payload (GCleaner)", "value": "9c07dd55011a767ab1857a7f76ffbae289064238", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774755677, "uuid": "e1ec814a-e8ec-4936-a076-16a5c041da16", "comment": "Malware payload (GCleaner)", "value": "7ddf09f82fdb15357a18a16b8426fdd8d1a949d8fca532fcf4fc0cbc8c6cf4690cd0ac13c14c432bdcddad5611c92091", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774755677, "uuid": "473a3c61-5a48-4efe-adf8-841232b6892c", "value": "T1E9F5E16560D888B7DC5E0B748D6B9D8FBEA5DB863B2F361112D9F8401EA43D1C8DB813", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774755677, "uuid": "d243c71e-ead9-48f1-916f-0efd3918ffda", "value": "006b9a72956f31105c5e9311f7262b56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774755677, "uuid": "7f990a63-41df-4536-a90f-f2c21a7e4129", "value": "98304:lvyQklHTcTCx5AvEjwAPOR24V+M8ZXplGGzirR/Dn:0VlHTHSpg4yhzpirR/Dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774755677, "uuid": "1cfce2a2-c7c2-4106-ac27-575030e02b31", "value": 3648800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774755677, "uuid": "d8c11495-740a-4185-90e9-6ac97cf9d1ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774755677, "uuid": "bbefc097-a5fe-440c-a1b4-f22fa5f321ae", "value": "80a741131bec7b3fc74b4cec678fa45e61760914a9e87c4434cb12f8266df426.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15dff84-2b70-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1774789843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774789843, "uuid": "264533fd-5bd2-466f-9e5e-73d848b0a048", "comment": "Malware payload (CoinMiner)", "value": "84943754a3b1cfebd43dee2110906cec", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774789843, "uuid": "a9004751-c2ac-40c0-a257-c4a871f291e0", "comment": "Malware payload (CoinMiner)", "value": "80ee95aaf9d4791c2bcbed88ade8043924ae6d64e8371eef421a69de760c6468", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774789843, "uuid": "eb52d7e8-b0a8-4174-aca8-61d2a0c01da8", "comment": "Malware payload (CoinMiner)", "value": "fa59de3ed0aca779feaf62382fafca8a0b58419f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774789843, "uuid": "c80bf17b-3eb3-4ea5-b9c8-670d25c9e825", "comment": "Malware payload (CoinMiner)", "value": "7907a1621ccbb0e51283e0123f56b8aa4df7556d1075a37ae1f9783fe807beed848d9eef4ceba1a0d3fb7fd806a9c89a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774789843, "uuid": "f2100575-42dd-4abb-9f1d-0981fe3fcdf1", "value": "T179E46D3AF79801F9E0B7D17AC9464512FBB1784A136166DF03E04BA61F2B6E44E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774789843, "uuid": "a461dec0-0fb0-4094-97d5-f9f1c2736da4", "value": "ecc899d7f94c0fc3c74a361f44f1bb9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774789843, "uuid": "bfe67c9e-6ee9-4cfb-b6a7-88ff9c90ea3c", "value": "12288:L0lWp+G10ml0rR9+b+nZUczd3o7yV3+JGoqq15PU:L0l4durRWq3DVO4o11G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774789843, "uuid": "0e84658c-1c2c-4bfc-bda5-3c4f9e18c3eb", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774789843, "uuid": "b3c7fec8-7662-4ab1-9841-bfc0c8c79ffc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774789843, "uuid": "7f6d56d3-0554-4f3f-bf91-2a58be2b741a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01384804-2bc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774823907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823907, "uuid": "8dc736f5-476c-4d9b-a61e-20c36b917b7d", "comment": "Malware payload (Mirai)", "value": "ef1f17085868841bf1f1a3f22586f483", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823907, "uuid": "3dcd23a7-21ae-404c-8a73-3d0f9e0dff62", "comment": "Malware payload (Mirai)", "value": "83786c8083274eede487fe35fffef5fc0904a894a842ea96ec77185c2e940933", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823907, "uuid": "162247a0-326e-4830-81a7-12509d7d96a2", "comment": "Malware payload (Mirai)", "value": "7fb25007f920340d831b44d08b31319cc4f96567", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823907, "uuid": "7aed4a6c-0e38-401d-a577-da40a00e5421", "comment": "Malware payload (Mirai)", "value": "3413a0a19a074901fc3c7958a136e5bbb3247685fd3d8a2fa86299f7688912f54dc1ee310a6e8dfae2d3ff8eec33b49a", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823907, "uuid": "b5111853-0b64-4d02-91d0-408180cc9f5f", "value": "T113155B5AB2B370FCC567C031839BDBA2A83AF47901122E7B61C4D6353D66DA01B19F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823907, "uuid": "df55e1e2-e896-4f0e-be9b-3f378058d797", "value": "12288:H4La85qRQNOMyD/rZz2IyVtrwbM7syJUkPNyy205+zGbVY:Yt5POMyD/rZzEvrwbMoyJszEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774823907, "uuid": "128aadfd-f351-4887-bcaa-d3e47152df12", "value": 949152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774823907, "uuid": "c5a8a754-bafc-4c0a-929d-68a6329e9ff5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823907, "uuid": "e097a1fd-4209-421d-91ea-c685e6384ffb", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5e8d14-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825372, "uuid": "96da354d-cca2-487a-ba72-dff1e6f368cf", "comment": "Malware payload (Mirai)", "value": "c71498540da7fd6f42238a73d42f6514", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825372, "uuid": "cc130410-d4c8-458c-8fa9-cdbcbbbf62f4", "comment": "Malware payload (Mirai)", "value": "858dcf90b61ee3e555cbfbd10a21dfc7880da31e3b39c0cdea447fc621efe4d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825372, "uuid": "e56acc86-5dd9-45f6-ab12-f5e7bffde1a0", "comment": "Malware payload (Mirai)", "value": "f591d9e3c990e50dd08b7e1385ee8a899abd8574", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825372, "uuid": "36a14d9e-8bbc-45a8-b465-8a94c06589a9", "comment": "Malware payload (Mirai)", "value": "255cf14934f00371f5b45b53583ff06a698dab4364cdb79e019114c9105b325d4a0104f980c99cb27930e62b03e5260e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825372, "uuid": "09fd57f9-f37b-4fee-a4f9-dfab177b778e", "value": "T1C2343B45EA418A13C4D117BAF5AF418A3332A794D3DF730699286FB43B877AF0D67602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825372, "uuid": "35d6d4af-49ed-42d9-a040-4d0a2c5e922d", "value": "6144:LYoHI9SHOBzabKacEK1dAnJd7MHf9ihM/9hAU:LbESuBzabKacE62JqYG/rJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825372, "uuid": "a2e5e6bc-ae87-47e8-b8d5-ee329f28c1b1", "value": 230960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825372, "uuid": "b88bd530-d54c-43d5-867a-fe869daca0c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825372, "uuid": "e7d393d6-9a66-4e4f-b582-3c7f63662dcc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b764a82-2bc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774824032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824032, "uuid": "ddf23ef0-f7d2-4c78-84e0-e1408948cf60", "comment": "Malware payload (Mirai)", "value": "01fb51e7015693d75557cbbe92a74d95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824032, "uuid": "b36936dc-0556-4663-898a-0df6e1b70ed0", "comment": "Malware payload (Mirai)", "value": "8681d2e941a76ae6c671b29cdc1d8a9f58ba8155ef9b4ae0a6b55f8249a88bc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824032, "uuid": "b7187c4a-534d-497d-b300-475eb68d2cd4", "comment": "Malware payload (Mirai)", "value": "760951f5252031444d1600021057ba2558e17608", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824032, "uuid": "58b3dd5f-8192-467e-bc44-1fb4a152de4f", "comment": "Malware payload (Mirai)", "value": "c42a0fd3caf06e5ef157bbd7dc1a5967f53715c0ca35e166ef3fa40467d780c241afe4cfc5d5a97d8120bd543dbec5e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824032, "uuid": "60b22e70-d071-4703-bcac-483974aa1ad8", "value": "T1F4933B45FC919A12C6D5137BFB2E228E372663A4E2DE3203DE156F22338659B0D7B741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824032, "uuid": "53b02f2b-50e9-42c1-bd8d-b5d15eef030d", "value": "1536:lOV4HFG59DYFVayhw8b8pPRLQ0YeKXffd6bqmv1vV:lOV4HO9E/V0pPVQ0+Pk1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774824032, "uuid": "d2000d81-2a27-485f-b156-e9a844827c55", "value": 92248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774824032, "uuid": "a074ffe5-9c7e-4ad7-b4e1-d9951b90b5fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824032, "uuid": "e9f9988a-ec9d-4440-a211-1b7e084e596e", "value": "windy.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c36ee6f-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825429, "uuid": "f658c23c-4ece-4e91-8c9a-78f4b6e93065", "comment": "Malware payload (Mirai)", "value": "86c41bcd34508cb33f4692c5743b78af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825429, "uuid": "dbe7ed9e-50c8-44d4-a335-ecef1aa82f72", "comment": "Malware payload (Mirai)", "value": "8a93aa4165f06d5f61ef4c9d98610692b5170c4ec78bb52eb6c157aab33d0e62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825429, "uuid": "cac0e6b6-1394-46c6-beb6-2b53617461bd", "comment": "Malware payload (Mirai)", "value": "ef0247e2923911d7c3d9a3ed8e53066bcf019c6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825429, "uuid": "9a7bf316-0450-46c4-99f5-e5b6e2189714", "comment": "Malware payload (Mirai)", "value": "7e212d402cfb5930eae4ec965fb3e06e699eb00b856b959072daf876be3d87a972fd0ac129bae4d3a071eaeb4ad7ee79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825429, "uuid": "ec2b6574-c164-46ba-9912-f4194f8aed7d", "value": "T1136339C1F64BC4F6D95708704063F33FCA32E4294071DAAEDF5A9E36DA7B5019A1A29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825429, "uuid": "a5b601f9-59f0-491a-b923-08e45e767fff", "value": "1536:d72BVIVsyIjvBYeu1rYnDhlDAjWg+auMeKClwzlRdAJX5Q:12BaVsRjHu1rYnHfghuMeK8wSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825429, "uuid": "6e0253d4-8c6e-493e-9a50-405989ce1c69", "value": 67024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825429, "uuid": "812f9061-d8a6-4c6a-be4d-d89ef70cbbeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825429, "uuid": "c416afef-9f6c-4959-bde5-5f168b64bd95", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320ecdd8-2b24-11f1-a769-42010a9c0008", "comment": "Malware payload (CastleRAT)", "timestamp": 1774756988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774756988, "uuid": "cb1a47d3-736e-4ae6-8304-9eda5a822405", "comment": "Malware payload (CastleRAT)", "value": "d9266e1046dcb50d7888f0123937e1c2", "object_relation": "md5", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774756988, "uuid": "e67a6814-3717-474f-ae0a-20d857e9f159", "comment": "Malware payload (CastleRAT)", "value": "8d2e77912e2e1d9d8cafb76d4562686cfaad556ca1df1919bfba304b31193402", "object_relation": "sha256", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774756988, "uuid": "2c30c2fb-5afc-4397-8be7-252ec8876669", "comment": "Malware payload (CastleRAT)", "value": "1c7eaeb3540f98854bf25caf8d3486bbd0e1788f", "object_relation": "sha1", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774756988, "uuid": "c9460fbe-3488-402f-b90a-35fc36d40c57", "comment": "Malware payload (CastleRAT)", "value": "e7311288c689c2b2e589f382323e94ca801b9c5b5e9ea76271e4c2208b1b8030e5f2b8c5bd7dd731d93a5b464c366f01", "object_relation": "sha3-384", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774756988, "uuid": "793d1f04-a782-4fd3-bd95-21ddbbc99fdd", "value": "T13F75D507EBB651E4D8FAC1399666722BBC71385983349BD797408A474B62FF0E93E340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774756988, "uuid": "37171338-5690-43a3-802c-5ecf813cceda", "value": "feb81294efff63737bcc7d08a56f0729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774756988, "uuid": "404a2c40-af8f-4667-8ca9-02fe1ae69f7c", "value": "24576:2Rf0IUYY0AAh6t19jAexbIV6KpBPPq0Adou3hLBCUQq1q5zWjUGn6xIsKxLT:/NaSRFjU5en", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774756988, "uuid": "a66b082b-9662-4b4f-9ac9-fbb838b55f2a", "value": 1649152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774756988, "uuid": "4e0d2e94-d79e-4365-97d7-ddf76f22d2a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774756988, "uuid": "ab2b5162-0357-47ff-8937-e2647829581f", "value": "2026-01-21_d9266e1046dcb50d7888f0123937e1c2_glassworm_icedid_luca-stealer_njrat_stealc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569c2a3b-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774825339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825339, "uuid": "e55b7633-e77b-45c5-80e9-d121c309088e", "comment": "Malware payload (Gafgyt)", "value": "b4cead9bb051a8edfeddf5e55fd8d431", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825339, "uuid": "ef39a8ee-2ab6-4647-94a1-7ca7e1d38d3b", "comment": "Malware payload (Gafgyt)", "value": "90f119b97617ad837c0e454bbda21ba9e59db89d79d74ac798783334a892f764", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825339, "uuid": "d40856db-42a2-4c3b-8724-9de1c1ec62d0", "comment": "Malware payload (Gafgyt)", "value": "4be3633c4dbd5127bd05c1c66383965aba3f7176", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825339, "uuid": "d12e6556-1787-48b6-94e1-4bd3baf64ef3", "comment": "Malware payload (Gafgyt)", "value": "d2b7489817d769de096079060ce54a38e2d480537f1a388b352cfcd7efbb4c65110dc03cf49c95994f03bb5ac7fc4361", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825339, "uuid": "3435fa57-17cc-4728-b448-b34e0e60c945", "value": "T1F7B3B517AB618FB7C85FCE3306AA850120CDA15612E97B6FB2B4D92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825339, "uuid": "cd0216e7-f858-421c-b79b-f521cff52090", "value": "1536:ZLeTikthhSMOCMQS+ZjN4pjuIxreg2OtNWIrKn2UmkiSFxfC7xbXe:ZhHC3S+dUre8N8n2UmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825339, "uuid": "43e99be2-4cac-4702-aaa8-06c6e56f053b", "value": 113271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825339, "uuid": "00343809-ea12-4219-8e24-f4bba5548f54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825339, "uuid": "861fb5a3-55b2-4166-9beb-38e7ee22d1ae", "value": "m-p.s-l.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6045a1f8-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774825355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825355, "uuid": "108cbfc6-2bd5-41cc-8ae9-62b5aff92a5d", "comment": "Malware payload (Gafgyt)", "value": "577b9d7e494a2d2045c6590ed592d4b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825355, "uuid": "0d543bbb-5ce5-4eaf-9460-e963414e037f", "comment": "Malware payload (Gafgyt)", "value": "93858d7740e79ef1196d640f90543e40ee8b3ebfde18f2d0c67331bd46cadf38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825355, "uuid": "e5edcba3-e7a8-4370-947d-667f8c29e62f", "comment": "Malware payload (Gafgyt)", "value": "af362d985cfb8e4af37804f7c33c3e8d5658b3d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825355, "uuid": "8134dcec-e153-462b-8a3b-a1cb5c8504e9", "comment": "Malware payload (Gafgyt)", "value": "799530462c75f87bfca7a29477ef7e8504b628e44611ab0eb3409dac74888a58feaa79df81163af215e371ad2b14ee9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825355, "uuid": "1cfe7193-c2fc-4133-a00e-e3c7ffb9916e", "value": "T12FE33B09EA808B57C1E2277AF7CB424933339B64B7DB33095528ABF43FC27995E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825355, "uuid": "e513310f-4319-466e-8543-37b79d0c7fc0", "value": "3072:fuNaNpF4uVN++dkhnxkQennF4M/9iD4b05cY+AmpwfvRQfZn:mNaNpF4+NChnWQennCM/98mpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825355, "uuid": "e159ec6c-adcd-4af9-a85f-28d070224fd1", "value": 150381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825355, "uuid": "c54f62bf-ea19-484e-a096-ceac958bf0dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825355, "uuid": "8e87a73c-8c6b-48b9-9694-df1503a4e204", "value": "m-6.8-k.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6336bfa9-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825360, "uuid": "389804d2-4bcf-450e-8fc2-b2f6fbf8f2a1", "comment": "Malware payload (Mirai)", "value": "7834d6c208ad4ddf0d3b7a9712cff4ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825360, "uuid": "5b93ad5b-d8e7-4aec-834d-6c9068b76f3a", "comment": "Malware payload (Mirai)", "value": "9716bb7fc134da915ca80b5032fb38b87b992934b6a629c80f62df6d9ecc1f85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825360, "uuid": "693587da-a4de-48a9-9dc6-669078d2995d", "comment": "Malware payload (Mirai)", "value": "eccb172f7d1edadd5b049a10281530dd90c74be6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825360, "uuid": "b92be44f-f2ed-4c91-a15f-85d3fa423420", "comment": "Malware payload (Mirai)", "value": "f8cf69e710c78b6d041563e66a512f939b4b4237d93cb4a4b683d5b69201dec176c12ca800a649d0046480e4fca73572", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825360, "uuid": "d6451700-f6a4-4d3f-9677-bd2ef0f4c54f", "value": "T1FB93E551BC82562BC6E423BAF6BE668D336577E4D2CF722BC8214B117B8551F0D63B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825360, "uuid": "0d9c6a3c-bfd1-4681-8eca-c48052c6d790", "value": "1536:pd+dGSq/lv/d7rMbIG4WetuLadxi0cbrT9KM5cZiw+bY4d:f+dY/lub6Y0WcZi9dd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825360, "uuid": "72fc4fb3-871d-4b18-b67d-d2594cba0e58", "value": 93792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825360, "uuid": "1729136e-afe2-40a9-9403-43ac69899057", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825360, "uuid": "23e2fc3c-c41f-4ff1-a696-24af586ae90a", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64596f12-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825362, "uuid": "e455f639-ecb7-4fea-ae42-913156c72b9e", "comment": "Malware payload (Mirai)", "value": "9c95f048cd2dc953d67478aade5a5a6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825362, "uuid": "8b536683-af7c-4b0a-a1cb-bd52fc7c67a0", "comment": "Malware payload (Mirai)", "value": "984b5c89994a04ac8050c3158eb4919a15b9e4fa4c0fef4cb7d4113159cf8291", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825362, "uuid": "7edfaac1-1531-4427-9901-90130f738b09", "comment": "Malware payload (Mirai)", "value": "86e8201d62b6d16b692080413a62840e7a4f08e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825362, "uuid": "600f2bfa-e8ce-431f-affe-05da22769c28", "comment": "Malware payload (Mirai)", "value": "96e246f17226bcfe1c95fc5b82285475585c9b91d1f92e7c2a722f90d57e20c6fd394b2f874b9e8a25cd438579010cf5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825362, "uuid": "f5028e31-dd58-4ece-aba2-37fefc7258bc", "value": "T1ADB339C1BA43D4F5EC1641306177F73B9A32F0791239DA87E7A89E327C92A419D0A39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825362, "uuid": "f5963d96-98c7-4465-aade-fb1a4ad8d8a0", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2wVzSr9bMFfld:Pbj4doYGFB0/45gdR9uld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825362, "uuid": "59bf0850-7fcd-47f8-8af0-b844221f6d10", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825362, "uuid": "3cc53029-6dc4-455d-9904-6caa3cf47381", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825362, "uuid": "d77fda1b-ede1-4f76-ba0d-fc4f479d8e0b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce1a99bc-2b7b-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774794616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774794616, "uuid": "1e9057f7-a6df-4394-8083-3b16879745a8", "comment": "Malware payload (QuasarRAT)", "value": "534791f805019a19137ced8ff8fef98b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774794616, "uuid": "a52dbb2d-f9b4-4b6c-97c9-c4ceca0d4e0b", "comment": "Malware payload (QuasarRAT)", "value": "99994c18d34425aabf7316fd762be99dadc589eaf0801f8390beccff4db960aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774794616, "uuid": "7fd765b2-e9c2-4c5f-aab7-b6d5546f2275", "comment": "Malware payload (QuasarRAT)", "value": "863210737a298ff483bff0bdc9893ea5c2be334f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774794616, "uuid": "19db1c16-ec22-4fc8-9f45-462cabb80fd3", "comment": "Malware payload (QuasarRAT)", "value": "abf86ec325ff961815e15db3f694a061318193c4ff71de07703795127c275a7df58dab9b916dd360ae376651eaf66ed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774794616, "uuid": "cf8b4b77-d53f-4e58-a89d-50528a9a3956", "value": "T11DE56B1473F89E33D46E927396B1042263F1F86EF363EB2B648167B92D93B5048017A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774794616, "uuid": "0e46cf56-6b81-4c14-a813-674b1b9823fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774794616, "uuid": "075a026d-1836-45e2-a473-6753465767d9", "value": "49152:rRTprRYzL/ipxVi/TMeJRkLDUo1iKknTHHB72eh2NT:rRTx6/ipxVidh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774794616, "uuid": "1cf8968c-80f1-49f8-bd6b-61777990b84e", "value": 3270144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774794616, "uuid": "10dfde3e-204f-4039-a5b6-29a7b590f5c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774794616, "uuid": "065e52b2-9ddc-4863-8eac-a1ba2a73a1fa", "value": "webview2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2df92eb-2ba9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774814408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814408, "uuid": "beee22a6-b0c4-48c2-97ba-8534abf70d91", "comment": "Malware payload", "value": "3163ee7174cc6769c2e9a0fa57fdaf99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814408, "uuid": "e9407e9d-ab9b-4d46-8b78-79a99fa07e16", "comment": "Malware payload", "value": "99ab4dbd22769964a0225d73daf97e6fec1160afc268de1d4295359701356d35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814408, "uuid": "75ae08f4-9d48-40c0-b337-5cf8766ec661", "comment": "Malware payload", "value": "7813e867cec1eb7081c975011645fbb09112a217", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814408, "uuid": "c6cd024a-ca47-4d81-8f1a-4bebcb4183c2", "comment": "Malware payload", "value": "192a179a6314578d7a81a93bf281310f36e5f31cca8ab8c55b650e0ba6977c664f1685b5e50116b26dde9aa470665d1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814408, "uuid": "516911bb-30fa-4087-aa9e-f1989fdc9963", "value": "T148F55B81B8021EA6D6653632C8B946F03370AC499F62CB0F3518F77DBC736996787789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814408, "uuid": "c4d2c990-5e2e-4a12-a038-8294f811a205", "value": "49152:GLIrssG8I0syi4tJD5B2s4kQOiIH8uhmN45ED:G4pZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774814408, "uuid": "2f382829-ed8d-4393-b771-ea59294570d0", "value": 3586048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774814408, "uuid": "66a26aa7-5eaf-43dd-a613-eefd2465d262", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814408, "uuid": "91d1b555-7b35-4230-a302-7aa50a534b13", "value": "ryeuxho64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e279bb-2bc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774823964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823964, "uuid": "8d6fb00b-5392-4bd9-8251-0a0037438e9c", "comment": "Malware payload (Mirai)", "value": "51a7b3bd05b9837be37275621643231b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823964, "uuid": "83df2b3e-9ba9-4c70-9a16-bee78b129931", "comment": "Malware payload (Mirai)", "value": "9b242e1e6a96aeef2b4ffc578df24274b2b8a4e8ffadf8246b20f3c3235cad1a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823964, "uuid": "9ef2d2b0-6490-460d-99ed-ff28cb0ca12b", "comment": "Malware payload (Mirai)", "value": "6c5fa7bbdd258c2fc212097db04b63472f4abe08", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823964, "uuid": "fbdf8b7b-a425-498b-be4f-40cdf10e1ffa", "comment": "Malware payload (Mirai)", "value": "a2f111583e804f1ac999f8e2edc12a850207548ac4a249e7303986b66c691f475a780566af034477bcf5d6014fd1398a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823964, "uuid": "673d867e-35b1-4df8-9b07-1b9b7de31fad", "value": "T13A03E128F124AE75C6B77FB2B8A7B2E577F5CB5E5E36C882A217A742300111CA5C19C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823964, "uuid": "e25568ac-7aca-4d3b-befb-bdbcb0e09e0d", "value": "768:Gj7Jzmzi7ygo5RGtG50aUScuPeHRg19xsiwiPxLq4uVcqgw09d:Rm7y9rG4v7c619xsjiZLq4u+qgw09d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774823964, "uuid": "33bb9782-1ca2-45e9-952e-f83eec99e0b8", "value": 40156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774823964, "uuid": "58a6b60b-5961-43f4-a5d3-c491f775d4fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823964, "uuid": "818fa7b8-a09c-41ba-8259-d81da76b958e", "value": "windy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34510a29-2b93-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774804666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774804666, "uuid": "d200e608-29fe-46fc-8d71-fbb4757ad589", "comment": "Malware payload", "value": "1f0d873c5869b7880d3b79cdd7ad7479", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774804666, "uuid": "75226df0-f8cb-4901-a61f-61da3ca5a64f", "comment": "Malware payload", "value": "9eb8fadaf8c766972a690ac705d6a4af32db75d84d290aa8a8584885e59204dd", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774804666, "uuid": "eca948af-f277-41e7-a2ed-047023fe1fb2", "comment": "Malware payload", "value": "4b7b60aa5c4ca6fc5bd45e1ce6119b754ca3a115", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774804666, "uuid": "6585ae23-8402-48f5-8951-5d8d8a8f0237", "comment": "Malware payload", "value": "eacf5ea409a72768089944b5368bbe7b91e529485e664510930afc0477cef4bf59eb6b0a225703f38ed84c47ddb07db8", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774804666, "uuid": "153fd203-5d8c-4238-a794-3e0d24448486", "value": "T145D59D11B697C136C97E45712A79EB2E10BE7FA51F7444EB27E85A7F0AB14C20231F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774804666, "uuid": "e8344272-bb45-440d-809d-6b52c8871441", "value": "49152:7b8Y+9MftgkKAWVqVZ9Rw4YP/BD/vTaPduTRUhfwEAB6zDojOwfFl4pqLOSGRvv5:kYE5A6qVPdKBqwMpqLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774804666, "uuid": "83708058-0093-4706-b3d1-7902f45a0e06", "value": 2821120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774804666, "uuid": "59b91b23-ea37-4993-a132-a06174a6021f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774804666, "uuid": "85a17071-f3a9-4577-8eab-6b65f7ac9ba5", "value": "aief491.tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b83f3d-2b78-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774793078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793078, "uuid": "bd676df4-14eb-4e59-8d7e-c5b4f9b78c72", "comment": "Malware payload (Mirai)", "value": "05298d9e9e1233cdb01c816d9275ee74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793078, "uuid": "e0e92c4c-eb83-49af-9645-08ddb1d8e23f", "comment": "Malware payload (Mirai)", "value": "a02a0f252be3169d001a06edf82cbef1e42eb8563ce008c6494a86802600598c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793078, "uuid": "3b02d019-1c32-4da3-8063-344833e85a65", "comment": "Malware payload (Mirai)", "value": "1d9486e311b49064f91d353d5394d32aa0d6193b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793078, "uuid": "be04a693-d338-4729-8e80-7d77a3e66ae9", "comment": "Malware payload (Mirai)", "value": "49035aee95d36f2ae6591d87883c55a7d2cc0b99e6f6dd39c6d8db038627ccb6269413741e9ee0d76464e6d2c6bebeed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793078, "uuid": "38fcb977-34bb-4fa5-8909-3d03b6da2f38", "value": "T10B03E14061478749F15AB33C427B72CB08A1E6234EC6B97D638071FF99867B215BD6CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793078, "uuid": "e47c8d1d-ae95-47a9-a733-6639a7a44309", "value": "768:ZAW+GkX7xgBSxKLgTcSw7SShpFPmq+YudKMjOF72pYfOnkZfHnC1nbcuyD7UHQRU:Z9sGBSxKcTc3eiwD/OF72pHnuHn8nouR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774793078, "uuid": "b2a2e7ef-e041-4cc6-a599-d65e40c25d06", "value": 39692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774793078, "uuid": "a51b38c3-4939-42c9-9cb4-15eef7168fad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793078, "uuid": "a757e3c7-8f91-4c8e-b62d-2559854842f2", "value": "windy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f10eceae-2bb8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774820874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774820874, "uuid": "13b5da36-068c-4e23-8611-ec15385de3eb", "comment": "Malware payload", "value": "63fc314c5ccf178ac3d8f01d27122e9e", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774820874, "uuid": "259b1274-7d35-407a-b681-1630af82fa0d", "comment": "Malware payload", "value": "a09c14786f522bbe8c570c3be61641a6dd06a73d869e4a2ce140a18b637deb96", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774820874, "uuid": "3cc1dcfe-609f-45d9-a4cf-fc8554015943", "comment": "Malware payload", "value": "59597eec85f6b4002303a76caf74d66e8d0b52d0", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774820874, "uuid": "7355e27e-0155-4c36-a717-b533d37c3344", "comment": "Malware payload", "value": "ad29dc3f80d7defaa7efa2fc2264ebfd13edefc2f9237edd142dba38ab4287fa4a9213b31b608711555d42f640cb0aaf", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774820874, "uuid": "99c608a5-dc3c-46c2-8ca9-d2c4206e32b8", "value": "T155D3F3C95A8E88A65B5F24384A5F5D069A8DE123065EC5C0BADEBF843F12DB0357FCD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774820874, "uuid": "e3320583-3bfa-4a31-b990-7900f373fafa", "value": "768:UfzNoeyRbwUPknXcI7rpBobJFzoOTp6p6N6R6H6ocDO2336gMh5dil96KMVYwwzG:Uhod+PhzIILmy0Sj0Y79ID+Yvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774820874, "uuid": "3f552e5b-909b-4f8b-8b25-337f8063549a", "value": 137540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774820874, "uuid": "a92a2885-a1cb-4cdf-9e48-94928ca76929", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774820874, "uuid": "c22682b2-3360-4d68-b535-08bbbccce7ee", "value": "User_Logs_Beta_1674.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe711ec-2bc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774823986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823986, "uuid": "44343b48-8629-4a3a-88ca-55841c30e063", "comment": "Malware payload (Mirai)", "value": "0385ebf04dc6ba87228647cbf3b17a36", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823986, "uuid": "c5c248bb-dedb-4118-8853-f7e82bd9a462", "comment": "Malware payload (Mirai)", "value": "a1efbb09a1ef1007d73f90184be00d30307f83c107d3038bf24c9ffe9179859a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823986, "uuid": "c3b5bcee-610d-42f6-a95a-e1cc40773f98", "comment": "Malware payload (Mirai)", "value": "98c6f7263b2451ecf761eaf1b1e65a805395e29d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823986, "uuid": "b85c834c-6b39-4048-b96b-7fc6d64847ce", "comment": "Malware payload (Mirai)", "value": "36e1179205eb16b3a1bc7fa2ea9aac7e06b30c1fd11586a69f7da3ff682676495cdb33576fdb7401f114caab2860d5ee", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823986, "uuid": "c25f2b59-34c6-434b-8dea-7015e61a7040", "value": "T164739E23C87658ACD25842B8B170FE3653B3E51056572FFB069ACA7A9047EDCF5493B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823986, "uuid": "dd0b0c2b-d3d6-4071-be56-9516febc3c97", "value": "1536:0/Zd1XEc589P/9E++KrpgE7YgJMiCYKkN3skgc:0hd10L9aIrbhJMiS68k9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774823986, "uuid": "abcfd5e4-aaa2-4126-a8ce-62124a01d935", "value": 80408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774823986, "uuid": "8405ac1e-65d1-4af1-a89a-c3769653e0ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823986, "uuid": "0c718e89-d58e-4cde-b9d7-537068081467", "value": "windy.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4e1c1c-2ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774813564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813564, "uuid": "2315721c-f48e-4c24-bb45-9da9b9a7f3bd", "comment": "Malware payload (QuasarRAT)", "value": "ea9124607fd71d6ed66f06b74a03285d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813564, "uuid": "4ccd278c-110d-4bab-a438-357b716c0e5f", "comment": "Malware payload (QuasarRAT)", "value": "a379a924dcd9b5df70fd7678d748cbfb81ca83e7e1d7a2381d7927748469caca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813564, "uuid": "17443d3b-a5a7-42da-a11a-6990a6431d4f", "comment": "Malware payload (QuasarRAT)", "value": "a288f5d15e7896913b2ae3eed6641cbeeb8ec3e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813564, "uuid": "b6c9e02e-40e1-4594-940d-5ef7a36fc6bf", "comment": "Malware payload (QuasarRAT)", "value": "60608b7a2e4c322376be9695c92b020a84d4f6b6a7028e784537f9be5c359e90e1513c6c0cc03bcd673bb1336bed5a25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813564, "uuid": "8ee1bde4-c849-47dc-852f-871bffe0d392", "value": "T1F6E56C1577F86E23E16EE2B2D2B1041267F0F81EB3A3EB2B224257786C53B505C517A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813564, "uuid": "d722892b-d3b9-4f85-944d-3bbc3be247d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813564, "uuid": "732a883d-f257-4e16-9dc4-552c2d96678e", "value": "49152:0yhJJHPNCC7J98vBgJh99oG4znXy4xUuxGUTHHB72eh2NT:0yhrHPh7J98vGJh99tEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774813564, "uuid": "36c20d42-5ce9-48d7-98e2-9d934f3a66dc", "value": 3299328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774813564, "uuid": "22be0fa9-2fdd-482a-b7f9-74396d9894a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813564, "uuid": "11be55f5-adf9-497a-9e9b-35e13874f6d0", "value": "messenger_update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0119acb3-2b8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774801144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774801144, "uuid": "bd819be3-2027-42ba-832b-0bab30fa8088", "comment": "Malware payload", "value": "a53a0f0558f6f1a2a6e7361536189af4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774801144, "uuid": "5324e5e3-e504-4ef6-b2c2-c7584dc416a4", "comment": "Malware payload", "value": "a4d04c978ba2280ffc802f7c4f72c0dfab025fcec59bcc73c3d611e8f9c91bd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774801144, "uuid": "4d9efb0a-433a-4971-bb22-4994447855ba", "comment": "Malware payload", "value": "f5c7675fb6a3406cebf38e83ee93581fe9731ccf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774801144, "uuid": "585a5c58-530b-40b2-9d54-e78f74c95945", "comment": "Malware payload", "value": "9ba1c4d7d8353919e83effb7ff49121b8ead4406376dfe72f8e87bb030bc9c96113fd7efa107263e31fadac37db6023f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774801144, "uuid": "43a4303e-e2c7-4f56-b254-8c0c294f6232", "value": "T1A3A3BF877AE9C436EAE20E712AB0D6B39A76F9746D31C61F23109DCD7C709909E24707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774801144, "uuid": "9ea0e533-70a1-4af4-ae27-47bf28ccf64c", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774801144, "uuid": "884e744e-9e2c-4e4b-93ac-b8a830635ca2", "value": "1536:qGarUa6LowvuhdNYh2Gf9rg6hzGPnf4g1dra44sOjBZj5sQhYTJfmq2e:05BuYAVrgUCPnfk7fdZqtd2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774801144, "uuid": "2209dd1c-ddcb-4dcd-a9d3-ac6807d52632", "value": 106456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774801144, "uuid": "163c7bf8-52cd-44d7-ac3a-09caa87fffc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774801144, "uuid": "35fbba4c-17e7-48c0-925f-d73618ea64b7", "value": "indir.com-sebrans-abc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5436b1d3-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825335, "uuid": "2ac77cab-0ecf-46a8-918c-3e7088b09662", "comment": "Malware payload (Mirai)", "value": "226a21b23afd364f6dfff1019b1803fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825335, "uuid": "b0fdeae1-9e4a-412a-b3bb-8d6a644ff890", "comment": "Malware payload (Mirai)", "value": "a6fec99985b893d978812d4da3994ed5a0c40562daf01b5f7760030c3a9a988e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825335, "uuid": "fd11a6b9-3ca2-4bb2-a1b6-95b0b9e39d74", "comment": "Malware payload (Mirai)", "value": "e937d1edda1a229f9074fb940a964ae70ea024fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825335, "uuid": "4352ad0b-5fa1-4a0f-b579-6470bcb7d191", "comment": "Malware payload (Mirai)", "value": "c81186b7f931bf572815a9fde3d127edb07ed5b29ffab34e3fff0bf8aad11a76b2125564412f0653928c3f1e5f2b6636", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825335, "uuid": "d93c9104-59bb-4b3c-926d-f86cd9345162", "value": "T11DF2E121B385D823C5A41472E9115AC53A2E2CB8A6EFF293A707956CDCE51067F3D8C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825335, "uuid": "7892e525-455a-4484-bc86-064773da65fc", "value": "768:rO3D+g1CatjaDzclAxBBFyfgawMWuOXEc5IL91zF2+3U6:iR1BtmDzcl4jYxwmLjQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825335, "uuid": "ba89e345-c4e2-4580-8ef4-c94febe3693c", "value": 35524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825335, "uuid": "2e05f90c-560b-4f0a-947b-f8e3cbb63b1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825335, "uuid": "5d55421b-8634-4e7e-a361-eda78c982882", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8392e98-2b8b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774801532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774801532, "uuid": "ce1b9117-f8b8-4e2f-864d-fb987b7fadf5", "comment": "Malware payload (AsyncRAT)", "value": "a91ba7650c9653445bb23e2767c1f3d1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774801532, "uuid": "6f09af81-b55b-4032-967c-8a153a8491b5", "comment": "Malware payload (AsyncRAT)", "value": "a92e1a37fd4bed6004440854b2d6e182f6740aa94b498ad2dd7b26410efeeed1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774801532, "uuid": "ac514728-2875-4e5b-bb31-a92198ede013", "comment": "Malware payload (AsyncRAT)", "value": "60f7684c5d9f707c6a495d11b252edb582161305", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774801532, "uuid": "1937a27f-1525-4a7b-b646-0f70777bf1ed", "comment": "Malware payload (AsyncRAT)", "value": "5d6a849f50057758b0c7ca3f8ec35d096131f59c323d56e79a836a43b3acdddb70a378f1f8406ddafc9aaef8d479a816", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774801532, "uuid": "2ef36e8c-0381-4627-b2bf-cac8b4f169e2", "value": "T177033B4877E44211DAFE6FF12EB2B1154276F9579813EB1E08D489DA2F336828A017F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774801532, "uuid": "063f70db-7229-4d89-b337-bb49e880acc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774801532, "uuid": "4a51a60e-ac49-4d0d-b1d5-a3232f03f6ae", "value": "768:ZVM475b9iNnxQjoE3C9NiAvizFN9psOphF6vt:ZT75b9Ny9NiAv2FN9psOp2vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774801532, "uuid": "4ffa02fa-81a9-483f-8328-ee5224f7933d", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774801532, "uuid": "0a30e189-a03b-4fea-852c-76a36f10c436", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774801532, "uuid": "1cc17046-8098-491c-b650-b288009afb7e", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3cea32-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825354, "uuid": "710a6945-0f75-4d5a-84fb-59b9b2a2b972", "comment": "Malware payload (Mirai)", "value": "5c7fbaea9ca75eb11bffaf55833563d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825354, "uuid": "35a811e1-f780-4613-86c7-152110e7065f", "comment": "Malware payload (Mirai)", "value": "a9e3c0ef7d74eb5558fdc174f8a93deeae9f8269a927b2982d9ff8e548b87769", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825354, "uuid": "4a0e1621-91fb-4b28-b4fa-e6bb9a3a61dd", "comment": "Malware payload (Mirai)", "value": "af29e3d1e02fc9f53f94b97ed55703ffc6b47ebc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825354, "uuid": "a0e0af23-8883-4b64-8403-a41b4d36111c", "comment": "Malware payload (Mirai)", "value": "c4c7a06bb9f5d04a028c2b5f57733dac6cba81483d24877a1aedcbed45e7e32130d1c86a6f760e6fcce4f14e33809207", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825354, "uuid": "6cec50c6-85f2-49de-9280-1f8030967437", "value": "T1D503F1A7F2EEBCE0F5E51C75535C071F7E1A26FD609A72922C988FA0DA52C0909F5403", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825354, "uuid": "c9fb5087-1778-4bd5-af93-ea13d33d6361", "value": "768:V9JMgrROIYX3nKOcQLXNLj7eZ/7GGzqKKSSRiIoK0ASDxwq3Uir5m:3hrgHKOz7NL3eZTV2KKKIoK09lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825354, "uuid": "33553af0-aba6-41f5-967c-4098d94789d5", "value": 38052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825354, "uuid": "2b48d6cd-8ffd-4062-b887-8d350b920036", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825354, "uuid": "0951ffd1-1c86-4458-aceb-b284be1f8205", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4efb592-2ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774813525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813525, "uuid": "bbe7ea42-cc1f-49dd-91c5-3fff04a73c5f", "comment": "Malware payload (ValleyRAT)", "value": "78ee28c317cbb4d98085c53a621c6e19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813525, "uuid": "18637ab8-238e-45d2-81a4-8817e8f6f615", "comment": "Malware payload (ValleyRAT)", "value": "aac041508f5dee54e08ce9eafeb78b07116209e41dca1ae579fa3720716fc974", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813525, "uuid": "b15f5a5f-2dfd-4120-b30a-82fa4e927905", "comment": "Malware payload (ValleyRAT)", "value": "a1d21731456c37e0f8f287c0371812a8f5c10ad6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813525, "uuid": "83f4fb0f-d5b2-4318-8e7e-fc64a61b0a55", "comment": "Malware payload (ValleyRAT)", "value": "020704f55680348feed8877c1647c474bfa55ad6e6b6b31aaaf67b17b13eeab76cd2dce9c464e0e6252227241994e6bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813525, "uuid": "e18a0cf6-7a5b-46b8-bfe6-2dd2a734e17a", "value": "T10CD53319F76976E9F07F413A84926506E37778260BB0838E035846B71F276E49D3EB32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813525, "uuid": "2041c0f6-2c80-486f-b3ce-9a3d4821f794", "value": "0f59368482b958d676b8ac3640747b69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813525, "uuid": "3863930a-6078-48a9-9cf7-410eac11ae7a", "value": "49152:UrnS7XgF/L4vNq6b7sP38iH6YKfBIxucrQQsyKlZDDeZ1X3zwjrSGnz+uC+Mh0eu:iS7XsWy3p6YKfBTc0QsLDeZkKQMhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774813525, "uuid": "63550f92-612a-470b-948e-4bb379b89d54", "value": 2944512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774813525, "uuid": "0bbb7c8c-3b1f-45bd-a131-f9d8b5b22f02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813525, "uuid": "02e8ee9d-962e-4551-ba76-b1da4f7799e0", "value": "7728dff2_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5507b555-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774825337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825337, "uuid": "ee395f56-73c0-4faa-839f-55c2d2b277c0", "comment": "Malware payload (Gafgyt)", "value": "213b46426141d0e3706e68a345877802", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825337, "uuid": "ca99dd7b-4b48-46df-bbef-5e257593d671", "comment": "Malware payload (Gafgyt)", "value": "ab70622e1386e2a04fb7c691e765d331b32620a298fbdc2ee6653f577dac76ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825337, "uuid": "c28be133-8535-447c-a134-e99d76687fd5", "comment": "Malware payload (Gafgyt)", "value": "41d7f2add6ceefcc9d39d5c3ec75eddf9549f944", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825337, "uuid": "7e6fb73b-3960-47f6-96df-27f8c3e2b08d", "comment": "Malware payload (Gafgyt)", "value": "949b97fb9ea8a5bace0bbfa9059ac56eb281cd3aa16fe11e6907fbf48e86d2b4cb45f7fd2fa3af9e2456d632ce1aae2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825337, "uuid": "cf7c0500-dc05-4c23-b74f-76663912bcbe", "value": "T1A4831943B72D0B43C49B6AF12DF72BF08769B96117A76180A10EFFC45772AB02522F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825337, "uuid": "3791c9a6-add6-4062-b98b-8a8b04f6bf09", "value": "1536:BQOc40ozMPjej5qckA39ikRFarXlMP+EmQ9VqXjtWf2Xe:Bl+3y4ckA3B6XuP+EmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825337, "uuid": "b87f83e3-be13-49f6-b0cd-19dec9451e20", "value": 84792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825337, "uuid": "196b4303-c595-4d32-b91d-7a2b1e4325af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825337, "uuid": "00462c36-19fa-4d61-9049-0fc56b113d35", "value": "a-r.m-7.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6142190a-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774825357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825357, "uuid": "9a5f79e4-528b-40b1-8ae6-bf02058013a7", "comment": "Malware payload (Gafgyt)", "value": "f7fe73b8f8a1d306e6d61b9826a66faf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825357, "uuid": "6a4e1901-a96b-4585-9aed-0d0f4295a53d", "comment": "Malware payload (Gafgyt)", "value": "ac71bff9f7a03dcb5433406bd9a885952a950e9b7be3cc657a72044944e22984", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825357, "uuid": "90275f5d-10f9-41c5-af64-c96817ca8c38", "comment": "Malware payload (Gafgyt)", "value": "6c1d8f57066e29261d0ddc6ad9b289b4eb13a2f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825357, "uuid": "fe6e0aee-d870-4260-a88b-3a394978c3ea", "comment": "Malware payload (Gafgyt)", "value": "250785e0089aaf7814930f21fa246ece4775e4015ae54a7b21750c2563db9d00870677bae7505ce0dcfb695329a14030", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825357, "uuid": "9c588dfe-42ee-45a5-afd9-a50520177d60", "value": "T1D8B3952A7E22FFFEE568863107F35F7087D521A226919385F26CE6181E7128C1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825357, "uuid": "2c945974-cb9b-45d3-97f1-23482bca9953", "value": "1536:27ju1TRpq+XvYS2rKCXeI5TF9U4WeeoIo3KwWdNUmkiSFxfC7xbXe:R/4tNF9U4vv3KwWdNUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825357, "uuid": "bb43f217-94a2-4f86-98a2-7d2aafc8e92e", "value": 113271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825357, "uuid": "e16e0818-f289-492d-8ac8-82f33c6527b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825357, "uuid": "2143241a-69ad-4a67-86e3-e554baae0cf9", "value": "m-i.p-s.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5984d8ac-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825344, "uuid": "25f58810-fff0-4599-bb3d-fd660d215875", "comment": "Malware payload (Mirai)", "value": "d5abd5234a29f745840a45f466020cbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825344, "uuid": "b77baa40-2400-4fc5-98f4-a7705f73e6ec", "comment": "Malware payload (Mirai)", "value": "ad0b010e3395653904864b774d54bba32aef1394e9ac32b6c0a1ca632f68d59c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825344, "uuid": "0c7161a9-f2af-4c46-a163-cab6558f1177", "comment": "Malware payload (Mirai)", "value": "6f3f681f9d14286947aeae6d598dc2b234f69b4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825344, "uuid": "41e54244-af9b-480d-be5b-967a45da44b2", "comment": "Malware payload (Mirai)", "value": "4dd147d68e29276e9ee5bc3390afe8c031753e343ba1c086da7dc0034591d7c45406d2e3927284918a632fe5d5c3c54b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825344, "uuid": "016b1477-f250-491c-8bf0-a87040bc089d", "value": "T10BF2F12E17274AFDE964D9F707E503F2531315E8A04A5C0BFBA0C592DE026AAF4931F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825344, "uuid": "cec31826-9a74-435b-84ea-54d661282ed0", "value": "768:puDUdzYG7tibWzyNvzGMr6Gz4Q+U6akSfZcM1JgGlzDpuWI:wDjG74bXYMv+/PcVEWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825344, "uuid": "0009baa9-0b67-4b3a-87ae-c682b41fd527", "value": 37056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825344, "uuid": "e23c4ca1-7eaa-48ab-9314-953c636f2fb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825344, "uuid": "59e25f0c-d7af-4667-993a-b4093a8ae8e4", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7412cd-2bbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774823903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823903, "uuid": "cacbb12b-fde5-4e97-9f7f-85b83966ed4b", "comment": "Malware payload (Mirai)", "value": "61582dfb7f8a9dd0955e41e86e3b6f4b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823903, "uuid": "46176b41-f46a-4868-89c8-17755363561b", "comment": "Malware payload (Mirai)", "value": "ad4d2f31de77131178e8735aefe4d01b9aff9372069b7232e5394c5b0c7e4269", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823903, "uuid": "162128d4-9c20-414e-b90a-60bd5b3e44c2", "comment": "Malware payload (Mirai)", "value": "c637b3109d3ba20154141b20efb39871552c2670", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823903, "uuid": "64f066fb-bb19-4e79-888a-999450feb281", "comment": "Malware payload (Mirai)", "value": "fbf27261065a71ed5b465041abaff20c71f010a24524b76b8171632b0f09bb059ef22ff020cdc2272456c32b47131e3e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823903, "uuid": "15da0626-38b6-466d-aaaa-d9c1ba969fc1", "value": "T1D0D48D69FF4E3C42E3DBE33C9B4983E1632B75E4D22392A27941431CD5D6AD8CEA0552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823903, "uuid": "6918cecf-df75-4c8b-9fc3-91f0a4e2475b", "value": "12288:bRv42IWlMf1HDP10Wnu8x56uAsDwMTxtBn5x2MPRonQh2:uES1nnpYu0CqMZon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774823903, "uuid": "0803185e-0953-4851-8776-c084f6af8814", "value": 641264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774823903, "uuid": "bab92ed9-4592-41eb-9c77-05df2fedcca5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823903, "uuid": "91352af9-681a-482c-9e29-99126da26be5", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b172a94-2b59-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774779740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774779740, "uuid": "3bdcc5f5-411b-40fc-beea-1c5365c3cffe", "comment": "Malware payload (ACRStealer)", "value": "192c05e2f214255b2c1f63e5f9959cd8", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774779740, "uuid": "0b46580b-3925-4e0c-903c-4a43c26fc9de", "comment": "Malware payload (ACRStealer)", "value": "aecd2bc39bd3a65ac4f2c9c4092efc1bb03b13d29704d23ede06446478b84816", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774779740, "uuid": "f6152b53-2a50-4d46-a151-c174a8915faf", "comment": "Malware payload (ACRStealer)", "value": "942a86788072eab9a75c89d2c1d06b8cd33d42f0", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774779740, "uuid": "5659be9a-0945-4160-bb5a-9eb716c553e3", "comment": "Malware payload (ACRStealer)", "value": "3ceb4e8d5d90a09ea38babbbc3d573e48944173f9a1598a4fe4786c3c098f67b71ebe67abc938c264a5d80da4ece8f12", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774779740, "uuid": "10a9ce48-8a23-4b35-9f19-5e97e431a991", "value": "T1A3366C07FCB159E9C8A9813485674616FA717C851F3623D72AA0F3B81F327E01EB6768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774779740, "uuid": "cba24b5a-b470-4643-9611-472daf9e07cf", "value": "534141bbeafb0cfa024f8b6830c176a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774779740, "uuid": "32506a91-e3c7-4f45-8e1b-f49679981a98", "value": "49152:MwyhPKRBkyXoQGHzC6JJ1in4I88BMH7I5k4IjpSbLLe0QclfDNzpcy:Mw/zovCMqVM8US61wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774779740, "uuid": "d21aa9e3-3287-4085-a18b-7be3df1cc8ad", "value": 5142016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774779740, "uuid": "acfb4ab6-1507-461d-a5fd-0eb1dce07cd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774779740, "uuid": "bfa53124-ed69-4ca1-89b6-1c012e180864", "value": "SecuriteInfo.com.Win64.MalwareX-gen.51586554", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8a49a7-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774825347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825347, "uuid": "43c69fee-128e-4c1a-974f-4e95e17161c2", "comment": "Malware payload (Gafgyt)", "value": "c064924ca002066c26ee00b7f5da5b43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825347, "uuid": "bde61778-6abe-4363-b9ec-8905524decf8", "comment": "Malware payload (Gafgyt)", "value": "af5fcce04c3955e705f132a7a9b384a0f4abe2d7f92aaec3330abb18ab70c6b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825347, "uuid": "4979381d-6211-4ad4-9f4f-0db08da2ec92", "comment": "Malware payload (Gafgyt)", "value": "84610f566c286ea86c1e11bd22d3e2b95876086a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825347, "uuid": "1afcee0d-afd3-4479-aaac-ca41dd331891", "comment": "Malware payload (Gafgyt)", "value": "c39b00da5d0a4912cb1838750c30bf04cf3649c93523cb12d192532cc3ef9c24a0307372ef89888816fd92afae65d20d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825347, "uuid": "57c28048-a5d7-49d2-bd7b-e6717441d25d", "value": "T1AC931941FD418B27C2D237BAE78F435D37366A5467DB33116A396EB42BC27982E39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825347, "uuid": "308ffdd7-8c37-420b-9b2a-48d49f653650", "value": "1536:LBkF9VQPAGaHYyEfgcqpq1innPTxHOxaePELSItUmREqQ4b/X7XSee:OQ2HYBv1WTnePELcmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825347, "uuid": "3ae5dbf3-0485-4797-9010-e1bd85e844ad", "value": 92444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825347, "uuid": "873796fe-daba-46cc-9d9b-b0158360644e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825347, "uuid": "4b81f044-ed23-47af-916e-7df6830804f2", "value": "a-r.m-4.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25fd4a72-2bc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774823969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823969, "uuid": "9e94a216-e146-48ce-8f76-27fb393afbb7", "comment": "Malware payload (Mirai)", "value": "985245896b388ca4cf1b895bd925f1d5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823969, "uuid": "45464e58-d679-4841-b6b3-93493212e773", "comment": "Malware payload (Mirai)", "value": "af689caa39289c1827889bad8f45b62b1fbbdfc8ef1dff5d3425eee3bbbf6334", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823969, "uuid": "81a7e02e-f90d-4719-b67a-421f47a996ae", "comment": "Malware payload (Mirai)", "value": "bee393c5a3d8727a45d2deebfb44306c3a3362d6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823969, "uuid": "440eaa2d-528e-4a02-b594-cf75aa91117f", "comment": "Malware payload (Mirai)", "value": "ba0cb56fb768d0aee782404f110720cb9d62598144ad1f0b5f3515c01017ea960288d8196d23e9be3024b8554cf0ad70", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823969, "uuid": "f4db99c6-04c6-4899-80da-2abeba2f117b", "value": "T14913E2B395BEBD75C47E7E7819096088E8616E8FF6833B6BC0D452BC9CD80486A16DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823969, "uuid": "8143c4cb-6e20-494c-a71c-dc46bd902bb8", "value": "768:xhIfHyA8J99JgD00/1kx+TKbtEe5aNeT5qcfxQBDTvpBx05a:xhIvyJ7gq+TXeYbPZ3Aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774823969, "uuid": "29a2a3ca-d1ca-42df-817f-2eef790d53a3", "value": 42028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774823969, "uuid": "d060db22-8424-425b-afbc-5ae243b38da1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823969, "uuid": "32b872cd-b7b5-401b-89b2-662490c19fe4", "value": "windy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab039919-2b67-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774785967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774785967, "uuid": "0cebfe59-5572-4798-a8f2-bba7111845ff", "comment": "Malware payload (AsyncRAT)", "value": "04183c5597db9308d16e494222e09c2d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774785967, "uuid": "0093a614-0a3b-4bd3-a23b-826bed230be8", "comment": "Malware payload (AsyncRAT)", "value": "af7235b3c06b02cef6b072b7a50b9bb0c59304881ed1964d574b4a73783a6993", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774785967, "uuid": "0360ccfd-e98d-443e-872f-88149eea06c9", "comment": "Malware payload (AsyncRAT)", "value": "451526e03f1553fdfb453cac4541032c82b762fd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774785967, "uuid": "42c054c4-8591-40f4-9efb-fa5b99eb7d37", "comment": "Malware payload (AsyncRAT)", "value": "4c73eb5ebbfb6b8f47d2dd8d57d48d4d91c0d1ee5b693cdf12c994cfe704bebd53ff2dadf6b7ca33efaf5520f51be5a5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774785967, "uuid": "638b5451-fa9d-475a-9b8c-37b34d9e8691", "value": "T19E533A5433E50A15E1FFAF70ACB272024636B96B6A13D60E08C1559A1F37AD0CD63BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774785967, "uuid": "6e37f2ca-3ce0-431b-8b35-0072453e3f2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774785967, "uuid": "b9556405-39ac-4c87-a5ec-832511082d6d", "value": "1536:CpWgsHXMJQkwtT/IbNbvsTu3iAeOukN5xd0bL:+WgaMkIbNA1ObfeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774785967, "uuid": "fdee9bed-b633-46ed-a41b-917112173e60", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774785967, "uuid": "2fceb2e3-9b93-496c-aedd-d8ca67dbc6fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774785967, "uuid": "c836c3a3-c0af-49f3-ab48-5887f24e3f7b", "value": "xuesos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdbe1e17-2bbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774823902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823902, "uuid": "6b2e89f0-18ee-4bd9-a88d-50d233fda91d", "comment": "Malware payload (Mirai)", "value": "e8be4174bc2202dcfd3fca067c1da3cc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823902, "uuid": "12cf0291-a4d1-4a95-97bb-cac2c63cbde7", "comment": "Malware payload (Mirai)", "value": "af8845844851200649e5b26eb5ef18f880c659ccd97429414522a756f9861381", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823902, "uuid": "55a5a92e-af37-42a2-81dc-8756f0c6eeec", "comment": "Malware payload (Mirai)", "value": "3ad360719653e2b30bf4b5f5f7ea74ac0a63ddec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823902, "uuid": "7448abb2-983f-4cf3-a626-7faca6e4096c", "comment": "Malware payload (Mirai)", "value": "b6caa23acc4bf2043ad1fab8a48e82c39230b71255c9ceebae339e154e880f6d3d43efddd0bba786d8889ba1a9062201", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823902, "uuid": "bcf548a6-9625-4d3a-9ccd-bf580f1e0cb6", "value": "T14494D043F3422FA7C84E92799C8D4548A754EE62B3E243026FD665FD787E0394F29706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823902, "uuid": "07586e91-6ff0-4de1-8f36-cfdfd237e58d", "value": "6144:0hHFG7QVl9TDOA8B5ScQ8ER1J55Rh6ESyWrIBBsrNXkHpMhRNNy:h7QdeER1L5uVrJXkHpMhjNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774823902, "uuid": "5d74d9a3-c36b-4f63-9a1d-55ce0e7b836a", "value": 419008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774823902, "uuid": "1f539b86-77a5-49fe-a3e2-8527739ffd58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823902, "uuid": "e306ae48-6bef-4825-ad89-18ea0a5cabc6", "value": "armhf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f7dc79-2b4c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774774181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774774181, "uuid": "8095bac9-b3ea-4f4c-88a0-83938353f8c3", "comment": "Malware payload", "value": "46d2319f68eace21fe28d3032ebb2c16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774774181, "uuid": "0917b807-6f0b-4381-9f10-dfce279ce385", "comment": "Malware payload", "value": "b34ad2bcea2f7e3459975747fa3e44fe958cad413bc5e45768bcbf86cf505fa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774774181, "uuid": "697864fb-7ac8-4f27-b91c-db5f2ba2b7d5", "comment": "Malware payload", "value": "92f16182eee9af6abdff28e794c114809bb4f7bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774774181, "uuid": "5726c70c-2ec4-4d9c-9df5-4dfced05cbe6", "comment": "Malware payload", "value": "fef8a2b42d9c3eef868e1239518fb79945ef072e1fae220b37b98fb4749ee98e2ae17d6f38ae2d16099754e1bd4b11c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774774181, "uuid": "32e1cbf1-a85a-44c3-89a0-505e80b8c982", "value": "T148E5F13FB28B653EE06E1A363AB2E110593B7661A5174C16D6E4C48CCF264B11E3F787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774774181, "uuid": "9c30d4ec-96bf-4275-a2cf-29a680ca8678", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774774181, "uuid": "57b868ec-393a-403f-8a34-49c099dcf67c", "value": "49152:OuI2heFP+d+KKLnKwXCU7UkHurC9MBbwcOoqBHQBCSio/e:O5OeFP+dOnFXCGUIMBU56wzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774774181, "uuid": "a5d819ab-4449-4acd-a6db-36dc380dcbcf", "value": 3263928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774774181, "uuid": "b93cb720-9dfc-44e7-9e77-f164ef86109e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774774181, "uuid": "5acac94e-8e4f-43c1-ba7e-0fd53aa1f24c", "value": "smile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66572523-2b8f-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkSideRAT)", "timestamp": 1774803032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774803032, "uuid": "e8f2269f-8bd3-443b-a0da-d2ebaf07cfc7", "comment": "Malware payload (DarkSideRAT)", "value": "bc98833f33547426623dd81b675f8517", "object_relation": "md5", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774803032, "uuid": "a72bcecb-21af-46b4-82f9-bff345a86433", "comment": "Malware payload (DarkSideRAT)", "value": "b58feae5380a19b70a67c6885f567ca82104fd5567cc0e6088ec3000f681172c", "object_relation": "sha256", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774803032, "uuid": "a0db308d-346b-4cae-a823-79096004e172", "comment": "Malware payload (DarkSideRAT)", "value": "bb0be59f2b46f3bac569ae0989668235642e0301", "object_relation": "sha1", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774803032, "uuid": "4adddba7-9925-4207-9e8c-2c3a7c70f579", "comment": "Malware payload (DarkSideRAT)", "value": "14cbe45f46f163a76067c2e176512e3dc99bb2536caaf79a10fc7f63c4ade899da850a557cd114f1bca38bd9f6d4ac0d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774803032, "uuid": "beeee074-457c-422e-8774-e5bd1ec08657", "value": "T17375F146B3F445F8C17FD13C91ABA90BE675384807204BDF23E446A92BA77E059BA371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774803032, "uuid": "83447007-f7c3-4e82-97c7-e22960abff36", "value": "5c0fa8408fe69ad934cf868fc7754287", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774803032, "uuid": "f7a56a76-ae45-42ce-9929-d56a59f457b4", "value": "49152:MaSDBJRAELIq8RFk/bGHHtpb9nIEbd52Xn:M4RFkwHbJI2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774803032, "uuid": "3a3d548a-b1e7-40d9-9292-a0843f34b2f6", "value": 1644032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774803032, "uuid": "6e849bdc-97a3-4512-bae3-544a89b38b03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774803032, "uuid": "fa86885a-47b5-4168-81ef-ed8bf92e933d", "value": "nano-lol.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f8597cf-2b68-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774786216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774786216, "uuid": "bc65ccbd-d592-4d72-b145-b20819477c34", "comment": "Malware payload (ValleyRAT)", "value": "d75c4cafed426167338cd1bc85a3c924", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774786216, "uuid": "a4bc6bd9-e0e8-4994-8a02-9daae2fc35d5", "comment": "Malware payload (ValleyRAT)", "value": "b73a44b3e686b95807d1dd9cc109cb7fb2618e882a7d9ea162bb6ae2832fbe34", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774786216, "uuid": "3c63639e-0166-44ac-8d60-d090f70884e0", "comment": "Malware payload (ValleyRAT)", "value": "cf50d96f9fc6701a62aa6f93213ca021dbb92974", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774786216, "uuid": "607a2b68-0b75-413c-afed-86ea3c13b017", "comment": "Malware payload (ValleyRAT)", "value": "c2dfe4e297bdae8a96c36593d3ba699cc4e5a1c9aa2fc1627624b032ce93af99812e66d2f39507ba909b8bc732c22990", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774786216, "uuid": "49f9576a-de17-4570-bc51-25209426b178", "value": "T1D0A633971832A114F8D2D87399B9187490975627F9F98E2BFE96333466FB8F7C10E210", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774786216, "uuid": "028064a6-c6ed-4416-b4b7-3bfae2027b0a", "value": "196608:yN5TVdtNrugDEnsaHu5KIhJ+q8H+rd7AfP0fn3v+mvVolzZAa8b:yN5XtN6gDYsaULUhsd7Af63DAeaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774786216, "uuid": "8c7f4a1e-6f89-4689-9fa9-4df4e22f4dcf", "value": 9804937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774786216, "uuid": "3ae27d74-174b-4597-ac6a-89eaabab745a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774786216, "uuid": "ce16b611-7f29-4327-a259-5948ceb5bed8", "value": "\u4e09\u89d2\u6d32\u89e3\u9664\u51bb\u7ed3\u9ad8\u5371\u5de5\u5177.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f8e528-2bc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774824028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824028, "uuid": "ba692917-94ff-4cce-b4b7-2d061da816ec", "comment": "Malware payload (Mirai)", "value": "7c7e342269c5e478945fc8ade647da9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824028, "uuid": "b758006c-a97b-4df6-b51c-86a1c5c3ac66", "comment": "Malware payload (Mirai)", "value": "bbc7a396a4597ecc8c9b00b655d5a1d8099a47b4354741aaf8dcb0b2020927c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824028, "uuid": "d42e1422-ccac-4bcb-88d0-5ffcc256525e", "comment": "Malware payload (Mirai)", "value": "4c03baeb3fb9ec6d18cec5019b04060150586631", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824028, "uuid": "e4b56eea-6560-49de-9372-c075f903373b", "comment": "Malware payload (Mirai)", "value": "146f5216b4e59e04bd5129101a4f2d717f6cc25716f1d7ea2de15e336239cc3f9f4a4df731d0fdfead5b702a9a520a79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824028, "uuid": "86e5b0e7-ceb0-43d7-b4d3-193c182cb7b1", "value": "T18EB3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824028, "uuid": "fd800fa5-7e9e-496e-aed7-f319d861492b", "value": "3072:Ddub7djS5HECEfBjmThRhFczcmVRh865xa:Ddo7djS5ECtTozcmVRba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774824028, "uuid": "808507d4-8563-4e9b-b5a6-25aa1f08d16c", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774824028, "uuid": "9e26bd80-22a2-4bbd-99e6-37b043dc935d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824028, "uuid": "df53d4bd-954b-47d4-a633-6a5063ec2222", "value": "windy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadee8d0-2b04-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774743554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774743554, "uuid": "fe1e28eb-f77e-4629-b7cb-4c7e7f5ffa16", "comment": "Malware payload", "value": "4d7bb7fb9d7d91c7412aca8cc05fcb49", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774743554, "uuid": "f52d77a1-7654-4c3b-ba1e-1421e41cda95", "comment": "Malware payload", "value": "bc34abe585f6b04c90b55e4b1361d7c2d05b30977f6a67611d3d7f94fa7b2210", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774743554, "uuid": "b8424a42-e90a-4d06-872a-d82f4cdff0c4", "comment": "Malware payload", "value": "a2128d935d7524e3aeba40c66023eae0ce5619ca", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774743554, "uuid": "2b1ab547-4ee2-47fa-ba70-dfaea434ae4a", "comment": "Malware payload", "value": "5471c868562d783c33d84ff53b569f96960af5cd227e441cba9c60694fbc3158580085dd23bef6177a708d62092efc79", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774743554, "uuid": "c1fb4d1d-5c99-4658-9c5a-efe4a48787c2", "value": "T106267C00F3D505E5D327DA34CB6E973ADA717C576B35D24F2099E21A2F33A908E6A720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774743554, "uuid": "0378e3a0-7082-4226-80c8-efed1dfa613d", "value": "b64b44e42ebf74b754b2f805ca8c9bad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774743554, "uuid": "3bed62a5-69a7-42f9-9b61-00782ca9fe2c", "value": "49152:GWWi43MZkrDGmGzLi8Ng8T1zGiRwwZ83J2m1z9lIN+LB5LsKRgW3Q5aVBsKokviy:Yvr+i8NRV7EC6Fok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774743554, "uuid": "31ec7360-d051-498f-8fbe-9f2d28a14aed", "value": 4524032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774743554, "uuid": "8cbfa41b-c070-4d40-a3b7-23f398c2c9ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774743554, "uuid": "b759050c-c1e8-40b0-ac9c-3808e9e184db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc88d025-2ba9-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774814397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814397, "uuid": "66b07506-b780-4e32-835d-9e172deb8d34", "comment": "Malware payload (SalatStealer)", "value": "7009b7be52e2053d2affa9468dd0a2b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814397, "uuid": "22d58524-d9ef-4ca9-a3e0-b3b7440049c7", "comment": "Malware payload (SalatStealer)", "value": "bccee279636c758ade0e26bb83b27560068953081b894a7d78000c868f45ead0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814397, "uuid": "86c33148-4c65-40da-8adb-4b68e4926485", "comment": "Malware payload (SalatStealer)", "value": "b9acb15bc0cbe321a476a55b06d551854afcaf60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814397, "uuid": "1be37bc5-91f1-42f7-9841-d6a3fe00fc6c", "comment": "Malware payload (SalatStealer)", "value": "d139ed9376cb57f50b166e8657a2cc7705e073c65a4bd42ad1b927d41a50a37134bb1fadcea3939d0ba33caeab676ed3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814397, "uuid": "bd13cb1a-7c4b-4e30-91e1-34ecda3b9cc5", "value": "T1B5C65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6AF877691187A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814397, "uuid": "28f60f45-7a30-42d0-a064-78d5a1e93d97", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814397, "uuid": "ac41621d-3a22-41f9-9e75-bf4b61369f39", "value": "49152:dRpK6fWxZHGQAulw19JRgfFC3b7HJFlwNwrH6PfLsdRyzVeAXH1SX8wRanDyBZO4:tKkWvw1rGtCfHur4EbRye34pDEpO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774814397, "uuid": "064b0aae-d6a6-4f3a-a064-20d64caf43ae", "value": 12570112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774814397, "uuid": "52a6ba38-ec47-4b3c-9e29-42a982f2a0b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814397, "uuid": "d664eae3-d7e9-4b24-a507-882136b44ef5", "value": "riktp7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f36d01-2ba9-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774814383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814383, "uuid": "de743713-5ffb-48f9-9913-d9d22fc2c70a", "comment": "Malware payload (SalatStealer)", "value": "6462175e66c77aae832815adfd36025f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814383, "uuid": "250df9c6-ba3e-42cd-bd8d-695c2e1e316c", "comment": "Malware payload (SalatStealer)", "value": "bce52ae49f0b49957d0a14ac45500b482147ba7aeac8cfc20f78d0d5cf8f3d2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814383, "uuid": "3c7d126b-3565-4414-a2d6-e9cc9377d28f", "comment": "Malware payload (SalatStealer)", "value": "a8d5e44aaa591c0252096390cb9a8e3eb16dab2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814383, "uuid": "554befd8-dbf2-46b4-b1c2-9b69de56170a", "comment": "Malware payload (SalatStealer)", "value": "c24cb23ccdc3938b0985761a1df2fb65316e0b0949be9ddcb9b6738f50565beadbfbe30710ec5b7ca60aea0097000dcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814383, "uuid": "10912a5d-9fb3-46c9-a385-28e8a6646e64", "value": "T1CBE533706F5AED81F903A17EFD77C070E4B66696DB8ADB209B010C522EA974764C3EC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814383, "uuid": "85f72ae0-ee79-4e1c-aa50-16c5447df1e6", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814383, "uuid": "9c370beb-925c-4d94-abcb-7b49cbee6190", "value": "98304:dyMSnU0D64KTwwfPnlRVNx1ZVVNkzLwr/Ol:d/dlZpFgLw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774814383, "uuid": "83ca51d2-7420-472a-a4f2-a2cf9ce46c01", "value": 3317248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774814383, "uuid": "c070e5e5-500c-4419-827d-4e28784d703e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814383, "uuid": "03d4a834-c528-468b-acd9-50d20ee2ff00", "value": "Injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a7c704c-2b17-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774751580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774751580, "uuid": "4dcd0d2d-597e-4cf1-ac4d-39ebb6d9922a", "comment": "Malware payload", "value": "ddaa1d0c318e3a28cb89918c3fd6e914", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774751580, "uuid": "bf6fbb7c-2b02-4da0-96a2-38c7d18249e2", "comment": "Malware payload", "value": "be1762627070078722cff01af73a388017283b0aa87f4c34e86fa0ceb8012b2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774751580, "uuid": "94c54018-ac74-4d11-a4a6-c1d836122529", "comment": "Malware payload", "value": "ede1028d7dd961fe2bd7521979743f65c198aa9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774751580, "uuid": "e39f44b7-3b7f-4763-985f-307398c23bd9", "comment": "Malware payload", "value": "3befd558ff187bc9904677bbd21e1abcef0bbc316a0ca40a130a352aad9844c3a48334aaa6ebaf0846bfb708864b7148", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774751580, "uuid": "957e4268-959a-4cf2-9b6f-9ff975a9f880", "value": "T1DCF7334862510017EB35EBF9235C2CD2C1E79A3B334610EF1DD6A9B50EE3E413B7999A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774751580, "uuid": "dbfbaba6-e148-4c84-bd12-209636a74143", "value": "7a5e2524b66da5177b4ec46d305a3dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774751580, "uuid": "2f846029-4d8e-4059-a024-e33b2226d218", "value": "1572864:BswyBODeteUIznenQA+ZOZ7HuQw8w6Pp4sAPiTMPkOi2N8bBhOVnCM:B/yBCseLn3zOrwoP2ssCk8bBkVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774751580, "uuid": "283eb9e3-c6d7-4f17-8504-be426d91e710", "value": 74581773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774751580, "uuid": "043d5afa-68aa-4f6b-b4b3-ac3e6c7901ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774751580, "uuid": "1af9e719-b041-462d-a39a-e87f460f03c5", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223d7b3d-2bc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774823963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823963, "uuid": "0e8ed87c-9b18-4ff2-b6b9-463dc6662624", "comment": "Malware payload (Mirai)", "value": "346d0fc8a9bc62229b501f102ea53578", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823963, "uuid": "1c9090c2-513b-433b-bd6e-bdffa71b4a70", "comment": "Malware payload (Mirai)", "value": "c30bcc118910fa1fec7ea7a058513ec4f8346ca24636a6d754e76c3c941f694e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823963, "uuid": "e2709a8d-aaef-4861-87fe-d1f46e84bd18", "comment": "Malware payload (Mirai)", "value": "c78f6a9be1ae690d3f0fb9a55d27574edbb28ccc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823963, "uuid": "cec6bf9f-8d18-4934-ada1-c16efbfad587", "comment": "Malware payload (Mirai)", "value": "ddaf204c406cc0d7487ccfb4ff2a7047380a266ff5f304a41625e212abbb30bdaa7ecd30e06e6772df421dd9df6c3aaf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823963, "uuid": "01492aa8-2dc4-4bf8-b632-be0e1ee698e7", "value": "T17213E18E7AAA6E9BCE3A8C3C95BD15B6190CF09371CD824E576B89D01DEAC47F405039", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823963, "uuid": "bb32eece-d1fc-49f8-8dbe-e99fd7774d32", "value": "768:bUx4mYFF++yYR7GkHOKv3BhUrRXkbA96tNvWbbVMm5Wqj54ufCx7DS8WHg:bUxhYLDyS7OK/UabY6tNWHVMmYqOuKx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774823963, "uuid": "9c3519bb-3ed7-4c50-a6b5-21baefc05eb4", "value": 44572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774823963, "uuid": "89e369a9-d069-4533-b6fa-1d17024c0714", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823963, "uuid": "ce690e68-65b5-463e-849b-4da674098e50", "value": "windy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb01372-2ba9-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774814374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814374, "uuid": "348fa0d4-33bd-40a8-992b-ad7c18df461a", "comment": "Malware payload (SalatStealer)", "value": "42c6f5e8bb85f6ac61445d0da0949752", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814374, "uuid": "6581c251-9afb-4542-8af4-4726bc739b6f", "comment": "Malware payload (SalatStealer)", "value": "c3f8d924cde39b8c5480043003db6ee256b6c07d6e6b3dbbeb03a7644f1397ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814374, "uuid": "f8ba5d47-e0c8-4535-814b-2c8fac33cce1", "comment": "Malware payload (SalatStealer)", "value": "169636c6fb44f82e0c22ee1d17d6574503ffc1b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814374, "uuid": "7a276bdc-f793-456b-a36d-9152b1fcc311", "comment": "Malware payload (SalatStealer)", "value": "4b2ee198cf8b6d202b7b22904faf401659019e9519847e73f70be4aaa9bd6eab23bfb91b6df1626820ed444a719669ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814374, "uuid": "98fc04b4-6f34-4cf0-90e2-4330ab9b9ee3", "value": "T10EC65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6AF877691187A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814374, "uuid": "62400dce-b3c8-4d1b-b1ee-4f6d19d06faf", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814374, "uuid": "f8cff6c9-e27d-4378-9af2-e7fdb7974771", "value": "49152:oRpK6fWxZHGQAulw19JRgfFC3b7HJFlwNwrH6PfLsdRyzVeAXH1SX8wRanDyBZOH:eKkWvw1rGtCfHur4EbRyp34pDEpO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774814374, "uuid": "d9110d3d-cf60-4b3d-b3d5-9d21d7f89872", "value": 12570112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774814374, "uuid": "e28094de-17ae-4ae5-8fd9-25f67a99fa2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814374, "uuid": "f7bf3709-3c22-4f40-9ae7-010680d472ed", "value": "dk36y.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6f813c-2b78-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774793081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793081, "uuid": "8a2dbd89-3225-4818-aa63-50e6938b8d5e", "comment": "Malware payload (Mirai)", "value": "c0f80bd274a8f9c4f5d95550cb433123", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793081, "uuid": "37ab7abf-d9bc-4715-8df1-8e88fdf388dc", "comment": "Malware payload (Mirai)", "value": "c78e6c73ac9a847b19d1015375ab4a3ee54ea4fffcb51acf07551cffb4b55698", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793081, "uuid": "65411d80-0d3b-494a-afb0-aec7bc9e7801", "comment": "Malware payload (Mirai)", "value": "65ce571164d2ecf05e684c6cacda4f73cb80bceb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774793081, "uuid": "fdac977b-95cc-46c3-8a89-9bd53116fcd4", "comment": "Malware payload (Mirai)", "value": "8b2117b2a8860c6159a4b3bbbe7b4b040b5a9d84f075fd96e8c2396d3ea01c98fad37946668dc447b8ad5e9d9b70ee71", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793081, "uuid": "ccd7c13f-1c72-4419-9511-cb3b05bf4a48", "value": "T11A6172A6204212B46D7A8FA7227EC6143283C9A61CDF3F19D5EE38EC80DCD5EF551742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793081, "uuid": "081b5578-fb3b-4ca3-9a80-20b12668f972", "value": "48:irI7rbJr+XrDprNFrVVrpwpJr07rNJLrQJJrfBr7F3r6bLrOTrn1Y:ioBCxLLKEXLQt93yLmBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774793081, "uuid": "872ab52d-f380-47bb-bf0a-1b9e65462b55", "value": 3254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774793081, "uuid": "82832148-10ef-4226-b274-65dfbe67e24c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774793081, "uuid": "3a909a85-3b56-49cf-b252-10c8bf7f65c8", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffea0d9-2bbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774823905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823905, "uuid": "3b40039e-0890-4e29-bb14-614f4011b717", "comment": "Malware payload (Mirai)", "value": "e83949dde79ca59a2cc3bfe614fdb8e7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823905, "uuid": "7a4cee90-b791-4790-a4bb-e0ba6f1d0ad5", "comment": "Malware payload (Mirai)", "value": "cc9d3fe45aec8e3289856233b024177c0b95ec2b77b185850c5c464da928c8b7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823905, "uuid": "2ef52a17-d82c-42e0-b8cd-aaa7a85be2b4", "comment": "Malware payload (Mirai)", "value": "3fe612c50b7d16efc8e07e75d6f71e8454d475a7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823905, "uuid": "eb2441ab-fedb-4dfd-8d5a-06fd9bd5590b", "comment": "Malware payload (Mirai)", "value": "d8e3c46d3c4e3c5c8f889b7fceded8b1a85017f9465bcaecef9b97b0655d1443ec45c8df86b7278ef30a756608e0fbb2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823905, "uuid": "af22cc05-a60e-4c7b-b37f-600fbd95856d", "value": "T177B4CFA3F6705ED6C0260AB428FDD234874DB6A313937191FBBD82403C67666BD69B34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823905, "uuid": "c8e36925-a2df-49ab-8dc0-f54b823319ec", "value": "12288:ia67n3cbkjk9s5PRh42xH29K9FTzxApVq9YfhZpuateQtW2yl:iac3cbsk09xH3j/kteQtW2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774823905, "uuid": "5aa40295-fcbb-432b-a124-6a71dcb10e25", "value": 529320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774823905, "uuid": "a36c82e2-eea8-4854-9df4-ef8599ee0aeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823905, "uuid": "a7ec7645-48d7-4a67-82be-2a344c89f9b3", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15b7779-2b9f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774810056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774810056, "uuid": "39d1e494-f6e8-4972-8a6c-baa0071de729", "comment": "Malware payload", "value": "2c2f2c3a89f3f99f039b4ea03c4fb519", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774810056, "uuid": "a4484d60-3f6b-4f19-9d33-0be8c0523218", "comment": "Malware payload", "value": "ccb3513f16ba27669b0ea1efc9a9ab80181e526353305cb330a6316e9651ce98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774810056, "uuid": "e2a612dc-4710-4503-9b6c-f6ba3ef476e5", "comment": "Malware payload", "value": "dec8be88648c66106e627fc6bef9a361e617966a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774810056, "uuid": "ca7287a8-edbb-44bc-a462-8d44d82944e0", "comment": "Malware payload", "value": "54523be85cd8097c478fec37dba7ff2c90746d3338778784d1c36c36801e2a94a25590b367bad8ef6ab24b8d121e19aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774810056, "uuid": "23d2ec37-f17a-462c-9579-c56ef6afd9bd", "value": "T1F8961206B28AFD47D7322C345945E32D8A627E34EEE5930B31BC79AC453B76D8848B47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774810056, "uuid": "2f25277d-9860-4141-a97a-98794affb1dc", "value": "196608:BFU5JffPNSfxfuNqXaqtkSIVWH+lY1iP9a5NcINgqK2rICJs:3IPNSfMGPkSEoOY139nHts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774810056, "uuid": "e36ccc82-6ea8-49b1-81c2-39ceba47746b", "value": 8670472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774810056, "uuid": "710e6a3c-e05e-406e-a30f-1eec4eae4f30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774810056, "uuid": "b40b4166-d03f-4fc2-b9f8-a4e6c88ba109", "value": "BootstrapperNew.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59dd731b-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825345, "uuid": "8c3c9936-2330-4d13-b1d9-bddac815d5ae", "comment": "Malware payload (Mirai)", "value": "9216c3ef4ab0864a550db18da74c80a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825345, "uuid": "61a50fb3-4dc0-4803-b0d4-49df94737509", "comment": "Malware payload (Mirai)", "value": "cda0a13ecafc0b7c2dc125552d018dfcd2053128ddc8303a4756ef64d3e0668a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825345, "uuid": "3f5f3332-2bfc-4c31-ad68-847fdebdc3f5", "comment": "Malware payload (Mirai)", "value": "4303a81bdd3f61b74295fe41f4484153ada500d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825345, "uuid": "85d95c81-9418-45dc-8d00-59c9483b55db", "comment": "Malware payload (Mirai)", "value": "c6b2625cf413c9fb0eda5d6c6b65a3cc8bb1fed024b7351ff25dd95c26833299f7ead375ab8e992ce80efa7fb6e18baa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825345, "uuid": "4716222e-6989-4308-a650-e20a590b0eb9", "value": "T19F632B81BD815613C1D122BBFB6E428E372663A8E3EF72079D256F11378786B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825345, "uuid": "ff078c39-0e7e-40a4-be4d-ff5bb200c383", "value": "1536:iDV4I0mzwMhjj9ffMv1+aLOLATREXKW8Mvks/F:iDVumffMvQUGKlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825345, "uuid": "9686a47e-0198-4072-82ae-4fe57c777b44", "value": 71304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825345, "uuid": "cf80d8fb-d19d-45fd-bfe4-19d7327443d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825345, "uuid": "e54c495c-ddd0-43c2-8578-efbc5cf51f31", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8f5099-2bbc-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774822344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774822344, "uuid": "9430119f-4899-462b-b02a-d0818bd0de7f", "comment": "Malware payload (njrat)", "value": "d145598bbcad7945cbca7fb3dad4795e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774822344, "uuid": "4e591be8-7307-4248-9713-12c6f647e778", "comment": "Malware payload (njrat)", "value": "ced4cf149946549676495a9bf47b97225ec9f69243439ab2531729f1e9586381", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774822344, "uuid": "c886b87f-8c6c-412c-ba53-32e7f83c0a4a", "comment": "Malware payload (njrat)", "value": "d7e6e390432516dbeb710d42645baa17a8f8c118", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774822344, "uuid": "298908ea-c05c-45b6-b685-21a8f54be451", "comment": "Malware payload (njrat)", "value": "d74b538644479fc40b9f54ea273e46534decee397321204c5ed01aaa0a2fa609155c83c0966cbf6333ec422df33a6185", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774822344, "uuid": "da409fd9-7036-4315-8ca1-2d5aef2e3327", "value": "T16F25CF9073F4850AE1FF1B75E4B148494BB7B9529A36DB8F0988E0AD1EB3741CE503A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774822344, "uuid": "19499e48-627f-48a8-9bdd-26c7b880de49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774822344, "uuid": "fbcc2699-ab9b-421e-bd34-cb4c653a1d2d", "value": "24576:GF/p8xJzck+uGW/yFoBkkAQcsS9uXKhP1Lo14bRbPSlGpMs:GF/p8TYjqqanTcsWc14VSlkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774822344, "uuid": "4aaf9e53-1263-466a-ad3f-4d5120bd59f1", "value": 977920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774822344, "uuid": "76031f51-26b2-4d81-9bf6-9f57dc8707e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774822344, "uuid": "3b84f48a-cd88-4e3e-bebe-602f61ac5a09", "value": "Pulsar-Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1ba693-2ba9-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774814425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814425, "uuid": "62cf6e47-f1e1-4edd-a78e-d21a4d20356f", "comment": "Malware payload (SalatStealer)", "value": "4ebdeaabbb766a9b917706e73a132471", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814425, "uuid": "b19cbc37-8e99-4700-a1ac-4595b78ea67d", "comment": "Malware payload (SalatStealer)", "value": "d3195bab22428e3831da08cae29e667f118c8b6d47debc2d13e42b96d7543093", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814425, "uuid": "e2bdb31e-0fda-489f-ab48-dece8fc1cb58", "comment": "Malware payload (SalatStealer)", "value": "c404edcbacf9d2d209ac21158e5659aa95896901", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814425, "uuid": "8b2ae1ea-3554-4100-bfb3-74d6f8364d52", "comment": "Malware payload (SalatStealer)", "value": "73eadbed8a3c07d719f9e0f4111c5fb8c99821d96eded4126e4131b28cb9044e3936488fb73f1c86a314589c963bab13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814425, "uuid": "d501d04e-3951-4723-b136-6c238e794f66", "value": "T1DCC66B11FACB58F1E903583140ABB27F63315D048B38DBDBEB143B6AF87B6A11966705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814425, "uuid": "a48e1e2e-28db-4fa6-98c1-b548fc247b8a", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814425, "uuid": "d48a39f2-1a36-480c-83ea-9854bbce3f64", "value": "98304:GJtQfO03IbL8invwOYWb3H32jfjEwG4kG20CdEdf:80qdvpYWb2jfgdkXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774814425, "uuid": "0e88a8d4-3f5c-44ea-b4f6-d0749469816c", "value": 12571136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774814425, "uuid": "f9d9d267-c86b-48f9-ab59-a53a1efec2f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814425, "uuid": "73d0e093-b359-406e-bed9-607fa6a123d9", "value": "SalatStealer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2390da20-2bc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774823965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823965, "uuid": "7562f201-ddc2-4de1-affe-1ce310616854", "comment": "Malware payload (Mirai)", "value": "4aff749ce6a6d5e94f6394bd69b0d711", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823965, "uuid": "5e4cf675-fcc1-44e5-8d9e-517781964d27", "comment": "Malware payload (Mirai)", "value": "d3861728e4d3ed72609d89115b6aacc26582fa57bdfec332ac24a984d19706a5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823965, "uuid": "4eab6a11-d1c6-4cc8-abb1-cf47156d99d6", "comment": "Malware payload (Mirai)", "value": "8189876ccca9e4411bf2fa854ed6bb09970eac6d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823965, "uuid": "1d2ad31c-dc0d-4de1-8a78-fb2f680b5d29", "comment": "Malware payload (Mirai)", "value": "fbf8565c3ee77aa0b95fb20b8f1be85ee702a3d349d064e18baf9fd46d16bf8d208c97d7bf65172b0afa203951731af8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823965, "uuid": "72198597-ad92-4db4-98b2-9a852fc470a7", "value": "T10D13F22C71439C7243243176DA7EC189BAD779E9D0BEE017F616466C488EE66F233836", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823965, "uuid": "4985e49a-befb-4925-83d2-a5d0d12f37a3", "value": "768:cC+f+A0quhSTpjZASbL2wIpvy87nVuG323lFWj1rfdc9/TLs3Uozn:m8ATpjZAC6wIptkGm3lwhrfdc92zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774823965, "uuid": "ed0267a7-5d79-4580-aaf4-408a19f2bb78", "value": 41628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774823965, "uuid": "3a6e469b-16b6-4a15-be34-0c608e093bf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823965, "uuid": "757bc9fe-6530-4565-80a6-2e0be7d22a2d", "value": "windy.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a401fa-2ba9-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774814444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814444, "uuid": "06f172cd-3a9e-45d7-8b81-f8be79a08e11", "comment": "Malware payload (SalatStealer)", "value": "d2267816b632058828cb9788d0b59766", "object_relation": "md5", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814444, "uuid": "74f08ca4-e9cf-460b-ac51-8a7ff5812c8b", "comment": "Malware payload (SalatStealer)", "value": "d58831e450b1caff2578a0e1736abfa95dd11001bf6b115cfb26a17e4f70eb8c", "object_relation": "sha256", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814444, "uuid": "1e3999c8-8eb4-4700-8d8b-0245ad48684f", "comment": "Malware payload (SalatStealer)", "value": "753fb727e22d3cd39416a5f4d8978a1d2b17c7a8", "object_relation": "sha1", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814444, "uuid": "b979b1cb-5b25-4a97-bc4d-11b3f4e975e7", "comment": "Malware payload (SalatStealer)", "value": "e26990bfa2f956d91ab7698cf6d9d64519f5d5ef7096d97f97daa61ba48b21deb98a7fa9bae792860054d00adea642b5", "object_relation": "sha3-384", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814444, "uuid": "08702c1e-09a6-4333-8661-2617b8c4ba67", "value": "T15C07337C47704C5A620BB37AFA775BF4B1BB245AA7A9C76072480B01CA833D790E7179", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814444, "uuid": "7dcfcaa3-115c-4901-a406-2dd39a63b5fd", "value": "393216:sjIKn4eMhCVlNNHUCoynqTn4YDPHbMwzMv9CQi:un4bUVlNNHUSgnxAwz2Pi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774814444, "uuid": "d8bf62a2-d1e7-431c-bbf2-fe23c5b7b2bd", "value": 17149992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774814444, "uuid": "cb8be1c0-8f7f-417a-a2e1-52298daa7125", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814444, "uuid": "99b34e59-c2ab-40ee-801e-3a4af6fb055a", "value": "vape.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae335a9-2b56-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1774778719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774778719, "uuid": "8844846a-df5b-40a8-a072-b47027f2004e", "comment": "Malware payload (DattoRMM)", "value": "ab514330bddea25304ecb6a50d6c1d16", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774778719, "uuid": "8efdacfa-73fc-4114-9762-905ed3a29efe", "comment": "Malware payload (DattoRMM)", "value": "d7d9990082d80af780af8e83c69f668321776f0d8ea0ae9708915879a25803cd", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774778719, "uuid": "086c0946-f4c6-410d-90bf-a58aecd8dbd0", "comment": "Malware payload (DattoRMM)", "value": "4a9a2f88008a3fa0c280f80a5e5d3b54d1223df1", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774778719, "uuid": "74fa13a5-ba54-4411-8faa-f56daa110cac", "comment": "Malware payload (DattoRMM)", "value": "8c9e06755f7544d6209e29b38725125054d991c81841625e693c057e8ed0915854d17f9b70193ad12b61bd7bf7b6d7f2", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774778719, "uuid": "351b18db-1889-4cec-9944-6112e251dc9a", "value": "T134B63347D9778DF0CA330B3890D2196B3305980E485BF4C9F609277ADAF35AA9D2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774778719, "uuid": "2b8aefc5-4a1a-4a1c-bb83-1cc6af2cb3d3", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774778719, "uuid": "e601ba02-dd1d-445b-9152-54af5795a092", "value": "196608:VaZk+wwP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2z:RnHmzZFw5S9pE7Asjp29qIT0jarlZr87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774778719, "uuid": "014b389d-57df-4579-becb-330a04f819d4", "value": 11056104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774778719, "uuid": "8358db18-6e41-4aa1-9ba8-493a9ee9548a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774778719, "uuid": "6a3d557c-9f5a-4e59-b882-f062efb07309", "value": "COUTURE_LOGISTICS_ONLINE_PACKET_PORTAL_2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276b8acc-2bc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774823972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823972, "uuid": "0df0c2fd-30c6-424c-9c0f-a864d9eaf5d2", "comment": "Malware payload (Mirai)", "value": "1a5faef73abb68d3591b27ac7e8f4b40", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823972, "uuid": "cb87579d-afec-4000-8881-cf9b29885460", "comment": "Malware payload (Mirai)", "value": "d89279b2a603316f12664964ab8eca5363ddcc8b3c8ee4cbe85ad654e98f8d2c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823972, "uuid": "73c92bef-8f77-4b4a-be58-1d0a8022d97b", "comment": "Malware payload (Mirai)", "value": "8f432569f820bcd0ef8a02e65b580af3b97cfd49", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823972, "uuid": "1bd452e4-e8f0-456f-a5aa-83996ab17d5b", "comment": "Malware payload (Mirai)", "value": "fd4944604bac3f592ef761199faeacfe889ee40e6bed66db7ff74c180c67a367edfb79f6c99ceabaa086be709c4197d1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823972, "uuid": "bdfe4c4b-fcc5-4d13-9d59-7e1f47d13e43", "value": "T1389318C6B401DC7DF80FDABB4463290EB630E36156835B26675BBE53AD721E05923F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823972, "uuid": "4a0ba05c-c9d9-4ba4-bcd9-a44908f544b9", "value": "1536:psdLEbXJld35is6pRA7O6X7FJXee9FW2edNP/8b47e1ov5TaCkg0zjX9JK1Cm1kf:pDiPpAO6X7Nw2ed1nqeTadgqGCm1Hqzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774823972, "uuid": "e0deb380-222f-4553-b7cc-e5abd10f029b", "value": 96736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774823972, "uuid": "9682d0b2-c112-46e0-a024-746357c163fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823972, "uuid": "29310f69-5bcf-41a7-8c5f-201f44f0647d", "value": "windy.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce848c1a-2b56-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1774778725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774778725, "uuid": "a3683eb0-f672-40f1-b9f8-43122951f08d", "comment": "Malware payload (DattoRMM)", "value": "17bf3544457abb0e0bf4629cdf7ba399", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774778725, "uuid": "5e0bc41d-f4e4-4350-82eb-433c1d993c03", "comment": "Malware payload (DattoRMM)", "value": "d90b1ac4f8e356320ea14ff997d51ee251cdd158aa3f5e36c819be2adb155f13", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774778725, "uuid": "2f1968a3-381e-4996-9811-33bbc8e31215", "comment": "Malware payload (DattoRMM)", "value": "1701f7de49ce03c6aad186435f16ef697f91d4cf", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774778725, "uuid": "eb981602-1328-466b-9fab-bee3ee85312e", "comment": "Malware payload (DattoRMM)", "value": "d9083e6b843abee38b800bb6390e6f8cafe6e5a70cd78f7ea8d53c9801c7eeacedcae5bab5c4d1aa4f4e14fa262c25bb", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774778725, "uuid": "0b1c7985-6dc7-4e43-8829-c65d9bc9073c", "value": "T126B63347D9778DF0CA330B3890D2196B3205980E485BF4C9F609277ADAF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774778725, "uuid": "f3efb712-6d8b-44c7-b5d4-f4cf5822bf6d", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774778725, "uuid": "9f22a7bc-355a-4aff-9054-a504ccfa8440", "value": "196608:IaZk+w0P+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2z:inrmzZFw5S9pE7Asjp29qIT0jarlZr87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774778725, "uuid": "d96e4e53-1dfe-45f2-8def-7a5ef7f356d3", "value": 11056112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774778725, "uuid": "465a6bc4-e319-40e4-8fb9-7d9f1fde6b27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774778725, "uuid": "91752503-3cf8-4918-94d9-bb1cf569627c", "value": "SOCIAL-SECURITY_DOCUMENT_2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6193c9c1-2b8f-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkSideRAT)", "timestamp": 1774803024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774803024, "uuid": "6d606173-4a0f-4ce9-ae23-c357aba4b9d4", "comment": "Malware payload (DarkSideRAT)", "value": "f298c32d56d2560a1a7bd95430a8ee87", "object_relation": "md5", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774803024, "uuid": "94b220fd-931d-45c2-8f30-61ae146e7bc4", "comment": "Malware payload (DarkSideRAT)", "value": "e0cf76bcd1e71192d54e72c229616e5d0fc2ac20451272e317608b37d89582a8", "object_relation": "sha256", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774803024, "uuid": "11199642-129c-461d-86dc-d472c5b6e934", "comment": "Malware payload (DarkSideRAT)", "value": "3ed9abbddfd645593b8f2bddce4209fff0be72c8", "object_relation": "sha1", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774803024, "uuid": "620cf860-d2d8-4942-b640-cf9c557e9437", "comment": "Malware payload (DarkSideRAT)", "value": "40d58c394a56e6949204e49549e03921762e75c1c7ca1f9bbf468f46ab7606e04d043cf7eea79632cd9faaf300edeacf", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774803024, "uuid": "e7c86601-706d-4718-9f77-c702635df12f", "value": "T13B75F146B3F445F8C16FD13C91ABA90BE679384807104BDF63E442A92BA77E059BB371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774803024, "uuid": "d4c82b77-dc2a-4941-b716-38a201f0c0e9", "value": "96c916b627dc2c74f42ba79c374fb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774803024, "uuid": "1d22b6e2-0970-458c-a55d-b56b21f6ff1d", "value": "49152:kpSTr9Ur2q8RFk/bGHHtpb9nIEbd5lJn:kMRFkwHbJI2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774803024, "uuid": "83b4ebe7-3fee-4bb5-a006-2d8ce098dce8", "value": 1641984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774803024, "uuid": "88ad4fa6-e206-477b-8598-ae04cc1120d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774803024, "uuid": "610ede41-a288-44e3-8763-15b61e8514b9", "value": "NanoLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68f1180-2ba8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774813931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813931, "uuid": "01682de4-664b-44c6-8532-b36b3891b4fe", "comment": "Malware payload", "value": "edd9e8018701279169c47ba509817a19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813931, "uuid": "7f0560d3-00ad-4118-b774-23e6280f8812", "comment": "Malware payload", "value": "e11a71c65ab4eb2c2ca0d780cefa239d9f939755e010b144fd27e1e20470bfca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813931, "uuid": "aa3aa163-f00f-4457-8abb-81ac38678688", "comment": "Malware payload", "value": "c8ce9c79c2fe827be09a9eb06701a2c7aa3ecf7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774813931, "uuid": "93867d2e-3be8-4bf1-b565-d1f65a0ac1be", "comment": "Malware payload", "value": "b4079193794a1ebd6e67f43239f8ba5c17da723b057ae4d4c896f371ffdcc94c75fcfe2e96a2620cf8c309ff8e6bf0cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813931, "uuid": "41ddcb61-5fcf-4a48-8d93-6f309d380e25", "value": "T12866BE00AFB56C55FC286A785DC723774534AD34F3A204EB8203FA1E56126EA1F3B75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813931, "uuid": "b25825af-3054-4421-9e4c-9ffe3772edd5", "value": "6143fc1851d197d7f614c373a32266d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813931, "uuid": "b014d45d-c03d-45dc-bc95-601cc9318d9b", "value": "49152:IDezEIOI/114i2YfHY1NNNRNNN5YZbzEIOI/Y4i2YfHY1NNNRNNN5YZ3g9w5og9m:UezEIOIhyYJzEIOI0yYa949", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774813931, "uuid": "6adcdf02-a5f4-42d4-8a63-c7e04d29b9f4", "value": 6842880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774813931, "uuid": "0ce46f42-0aef-4918-8eea-36ba03484939", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774813931, "uuid": "1afe7f5f-d1b3-4dfc-99a0-995b013a84e2", "value": "1.5\u4ebf\u7f8e\u5207\u5ba2\u804a\u5929\u8bb0\u5f55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8980d917-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825425, "uuid": "b4199d08-c3fd-4c3f-bc4d-6434821df5ee", "comment": "Malware payload (Mirai)", "value": "da77178d9e421304a6bfbb19ce711591", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825425, "uuid": "752d944c-e9d4-4560-89af-c1c376516a70", "comment": "Malware payload (Mirai)", "value": "e3dd242bb2767772a4ed271ff11bec0f3c17aeeb0cf909ed0b753bc31d4a4b0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825425, "uuid": "4deab4f0-2bfd-4daa-a8b7-79d0da8a0cf4", "comment": "Malware payload (Mirai)", "value": "b0f2bd4734bfae7a1a61e6853b9fc8c7f3906ee0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825425, "uuid": "f2982aa3-33bf-4574-b672-de8547ea613c", "comment": "Malware payload (Mirai)", "value": "08f2c1176fec2613e03f9685c1471c1dd0e4d769b4557a1e726919089f4f86bc60a09ede944ee74c719097a501129235", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825425, "uuid": "06f99d4b-819b-4316-8bb6-631015391ca6", "value": "T1E7733A91BC815B23C5D012BBFB5E428E372613A8D3EE32079D266F21378786B0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825425, "uuid": "00fdd4d3-29bb-4b37-95ef-a74e70624b37", "value": "1536:ALPjjeA4B07cUuvj5vA+radO19ppOANn7E3vJs/F:ALPjt8vA6T3+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825425, "uuid": "90d25d43-5238-4aab-b5d0-2837c5044885", "value": 75392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825425, "uuid": "92aef405-aac2-4178-8350-db6c8d638790", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825425, "uuid": "e1d7e848-d92e-4d32-813d-16bbd9c08733", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b406d5-2bc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774823970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823970, "uuid": "d30a0b21-440e-4595-bb79-3a78d555fc51", "comment": "Malware payload (Mirai)", "value": "aacef572127eed5dda3479947b76f786", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823970, "uuid": "3bd7e7cc-2339-4828-ad48-986cb0cda07d", "comment": "Malware payload (Mirai)", "value": "e4d4f8a78789b836439eff210fbde07a4faf17dc8094794cb24186bfb7848511", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823970, "uuid": "37d0b14c-6715-4852-9c58-543322d22f10", "comment": "Malware payload (Mirai)", "value": "cf8f1e52515aa5ea3f7250e0c99c7d62f78ab63d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823970, "uuid": "7719f277-7810-4d0d-a006-da75811898df", "comment": "Malware payload (Mirai)", "value": "9f6a35cf72be68f414868955db33ff3bd4405b9184c146e4ff9ae753d45ae21c73e10c184b01726336a379c60828f080", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823970, "uuid": "de09b125-5763-4b71-a317-93b446a2c827", "value": "T12B03F111E5958343EDB9C03B94DE960B4C54CF23995AC0BEE594903F1A12FE2BEF9368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823970, "uuid": "4ac55ed1-d678-465b-a102-3d71741a20f1", "value": "768:32HJeRRzOfGyM21j1nXOwziq1hh1Jj5u7ZQ8YtnbcuyD7UHQRjI:mCRzGGyDzXOQD7z16ZQHtnouy8Hyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774823970, "uuid": "6f75d4ec-58b4-4702-a003-7cc3894fb35c", "value": 41296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774823970, "uuid": "633ea643-7e1e-455b-8d91-0f28ffd6234e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823970, "uuid": "ce8bed3b-8ab7-498e-b7f9-4f534c8e4b66", "value": "windy.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e65be56-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774825352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825352, "uuid": "016af1c9-f315-4468-bf5a-41651df8bcdc", "comment": "Malware payload (Gafgyt)", "value": "434842db2a9cf496a207506fc675550d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825352, "uuid": "8639f68a-bb54-4136-9355-5c9d5488674d", "comment": "Malware payload (Gafgyt)", "value": "e642ebc2e65906c162c0995c0bb1a87cd21afae3dc2eef1a372ef62d116426a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825352, "uuid": "c44e3f7f-b4f2-4988-83d0-c106465aa8b0", "comment": "Malware payload (Gafgyt)", "value": "c384e93b52a63810cc9558ff5225ba618104d2d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825352, "uuid": "24b16303-ca6e-493d-8dd4-a34278cb2940", "comment": "Malware payload (Gafgyt)", "value": "8e0b6e798c7277d69e0ab5525e7113e062715d2d2ac2dfb66c5d4cfe80caacda2e2e45cec271839c8c4cec36af918e57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825352, "uuid": "0d79d1ac-6e45-4ae9-9404-9fe31d61981d", "value": "T1ED93F892B900DFB7F40ED77A08D34724B670FBA24A531672731779A6AE322D43826F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825352, "uuid": "4e48da19-c4e0-4882-b399-9c938849bf00", "value": "1536:4wZTvNTV8V9eEG8ktQmzn5h8Jn9/QT60ydwgzr2JT9KHTmQ9VqXjewf2Le:BjT49m8KT8RQT60ydwSApKzmQ9VqXywp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825352, "uuid": "aac3681c-bb87-4640-a840-ff8f01501c9f", "value": 91083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825352, "uuid": "125f6a4b-f837-41d8-8cbb-5fc1e1f3444e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825352, "uuid": "76bd1c2d-d5ff-4daa-9ad9-96903fbe8784", "value": "i-5.8-6.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254a0343-2bc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774823968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823968, "uuid": "fc81d4a3-a107-49cb-b932-3bfe13b28104", "comment": "Malware payload (Mirai)", "value": "fbf6b981c2aa14e5c64fb9ff37d5c1e4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823968, "uuid": "e049cbfa-e5dc-4fd0-a93f-705af26b23d7", "comment": "Malware payload (Mirai)", "value": "e713b8a61da8604e9f3d8714250d534c0c8edd3006347db7e4e8a09101f13f1a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823968, "uuid": "33b7fb86-b1f5-4b8a-9de4-04ec144053e0", "comment": "Malware payload (Mirai)", "value": "4d193015389efaae55d71998ac40a789347bbe36", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823968, "uuid": "1cfef824-e332-4692-8ff8-8de6c04fa4d2", "comment": "Malware payload (Mirai)", "value": "5dc0b08302a4e72dc0a970aa2862bab7213fc63d4ff0fbc8f7cebc251a41f658a9946c880e2eb6a2d379c85e26dd3cb4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823968, "uuid": "33c016ab-abf3-4877-bf22-2cc5f6b2b93c", "value": "T102B2E1646B5504A0D3A424780F29C7462FD70C38D1F9B137375081BBB5DED86B478B8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823968, "uuid": "b06c157b-78d7-4789-9a49-9401dc473298", "value": "768:gEqSy9yWdXdhvjB4Du2xNHBd/yfAPzzos3UozMs:gnSyZX3jgPx9Bd2APfdzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774823968, "uuid": "953785f5-bc19-463c-8b86-8cf5b2f0defe", "value": 25104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774823968, "uuid": "5ba531c8-ee7d-4874-885b-cb6ec5cadb2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823968, "uuid": "b44b5422-dc94-4fd1-8c23-40af567a4bb8", "value": "windy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3928f19b-2b18-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774751846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774751846, "uuid": "801391d6-d511-4c23-bdce-e50f27172311", "comment": "Malware payload (Mirai)", "value": "a8982b111ce3ff3b54719af0ab34936d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774751846, "uuid": "f2424b12-6834-4d1e-998f-4878f9a9d793", "comment": "Malware payload (Mirai)", "value": "e7849f6d5aeeae9c6d965098075c2fcf0233f6d3231d2f5cbabd0a0f168dd101", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774751846, "uuid": "79236d0d-5771-4a54-92e5-71164c5fa0dd", "comment": "Malware payload (Mirai)", "value": "ee4ae25f8cb2c6260b225b0629db26375d38b0b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774751846, "uuid": "17101b6f-7b27-4d10-9d5d-6a1d71045816", "comment": "Malware payload (Mirai)", "value": "628492330e01109aeb5bad8acff35f98c4b3a2605bb91975b5e1083923baace7ff5319acb5e430fe5d2f2f7fc29b7e00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774751846, "uuid": "53f2881d-c502-43df-8640-9f5131a33bfb", "value": "T169640287FB217C1FCE010FB121DB079E66BCA65B82CB9091B2D4C95F35B6185B7A11C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774751846, "uuid": "15cf99f4-d64a-4e69-b1fc-2c0af0cbce3d", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioG3Q:p3lOYoaja8xzx/0wsxzSi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774751846, "uuid": "0e47f1ae-a99d-4678-be9d-819c98f7a057", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774751846, "uuid": "e07b07e8-f878-466c-8e9d-1b487c0f35ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774751846, "uuid": "b68d4f8e-25cb-43a3-8db5-d05cf533b38e", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a718d49-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774825346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825346, "uuid": "28310d06-b9df-4feb-8858-ec5d8114eea3", "comment": "Malware payload (Gafgyt)", "value": "fc260292cb147e12cf9b44e29d4a38ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825346, "uuid": "9345c9c4-4888-4676-ae6e-5c516e7e7215", "comment": "Malware payload (Gafgyt)", "value": "e7bf55498b8872a76194a0fe983d0b2ab8506b1b06d69ad2d274a8ccdfde0943", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825346, "uuid": "684a3deb-d355-4e35-ac01-7c8a497fa9a3", "comment": "Malware payload (Gafgyt)", "value": "d372386fb3b25a3c1ac7192c78cfb535703b2ab1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825346, "uuid": "59fa9a57-0cff-4196-a5a0-9475baa6cd27", "comment": "Malware payload (Gafgyt)", "value": "8505b8839cb8a381fccfeea26524aeb47beec4b3b7082b27e25110f3e1e65ff160714fc43660dcd14ea6fb3bf54417e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825346, "uuid": "17303ba9-d790-4caf-aaf0-fde9e308c366", "value": "T127733A02E652C6B3C8930BB602AB9B6A4631FD2A1E2B9F59F31C7DF49F124C87117355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825346, "uuid": "97eacbc4-7475-46c1-a535-5b9b41e16a24", "value": "1536:nm+c5osQWiKLoxKFn6pD+OTxzMEqOmLI2VOCjXUfJRk:45omr0xKFn6J+ODpmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825346, "uuid": "29bbb5ab-8fa3-4098-a2c2-c3d9571f299e", "value": 74020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825346, "uuid": "00549970-1d3d-4893-a344-010e87cb3b8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825346, "uuid": "5a62a18b-1727-4a98-828e-dda61be5868a", "value": "x-3.2-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb8565d8-2b20-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1774755501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774755501, "uuid": "91d240ae-244c-4d4d-be1b-a8e7dfbb402f", "comment": "Malware payload (SheetRAT)", "value": "f5af807c4a1189a2f77f2ce2a2ad5563", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774755501, "uuid": "2e7ef42a-bd04-446a-b15b-5ee8466d19f4", "comment": "Malware payload (SheetRAT)", "value": "e948db442613980f1f0f395cef3ac011f941230cc5a767a70b7c1dfd5fc34d86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774755501, "uuid": "2b30c355-f44a-4b26-b9ad-645918b32376", "comment": "Malware payload (SheetRAT)", "value": "6495a2264c3199bd2d155e430a27fcca137288dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774755501, "uuid": "dbe1f8b4-391d-466b-aca5-68b9045a19cf", "comment": "Malware payload (SheetRAT)", "value": "e9d48f203db1c5e913dd356980e517a52eb2690d9747caf42f6880e27a3cb2967c53ffd7dd6e654ede55ca870f09383f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774755501, "uuid": "8a45721f-e178-4ebe-9d90-0b17c5274f3f", "value": "T10B94D40CFE91E805DD5A3D77CFE614108BB125C22E219292315A6FFC8B9637798E61BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774755501, "uuid": "356db9f7-a6fb-421f-8596-a514c5e39cdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774755501, "uuid": "694a608d-2918-49e5-9e84-32c5ba0309aa", "value": "6144:RnJWdCub3gYGcspe6VlWT8b9Wx+pV4C0O1rmPWuHbtBeRbAXa:Rn4kK3gYYpPVle8gx+ptr2WuZBHXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774755501, "uuid": "233d4f47-95ef-4ca0-8eec-9666a085e4e6", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774755501, "uuid": "16469682-dde7-4285-aa13-3a9b022e2643", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774755501, "uuid": "b8542b22-c1fa-4efe-98ed-012a63a67383", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e144bd5-2bc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774824036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824036, "uuid": "95817a39-0077-4019-a782-2662bbf77951", "comment": "Malware payload (Mirai)", "value": "0e2ee28a6679049f7933be44a737ddf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824036, "uuid": "12ba9d0f-1d21-4a64-9207-078e3c8d78f4", "comment": "Malware payload (Mirai)", "value": "eef18de701cf87b2385b758c36b78321c3bbe3028ef694389e0ea2e6fd8e7cc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824036, "uuid": "c34cbc15-3c34-474a-818d-70e1da7d224e", "comment": "Malware payload (Mirai)", "value": "b563c6d0a853cbeb3ded73dc589568b7428aa481", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824036, "uuid": "c9206bc5-7848-41e7-972c-f857a182c312", "comment": "Malware payload (Mirai)", "value": "538a0ea30b47f3a079437a36fc065e67b7b123448c227ad915b84cfba0930145350ac080a4b14da6a990645a2f2b24ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824036, "uuid": "baa698b8-ba91-4fb3-b745-3fc204c6becf", "value": "T152833A47B98190FEC499D03847BF7537C923B4BE1239B29B63D4AE262D09ED01F19746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824036, "uuid": "0ccd0a18-2e19-4d84-8405-2243a6f22a94", "value": "1536:MqbF7IdAcsgpY+rg61LEVkCkj6Rv3U8GbdGrAyvQM9ol:TF74Acsgphg6OVkCdRvAbdGrXQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774824036, "uuid": "c82c2b4e-0ae4-443e-9522-3e2971cd5923", "value": 85904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774824036, "uuid": "ff63c132-1619-4082-a44a-a8555ca084a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824036, "uuid": "e5b5977a-4190-4bc0-8b30-74760d82a773", "value": "windy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a31415-2bc1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774824509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824509, "uuid": "ac4811f7-10da-49b9-9e0b-ed36777ad5c6", "comment": "Malware payload", "value": "e47f08f5d458998154a92fc43d3e6a5c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824509, "uuid": "03ea5373-a2fc-44c0-aaf6-54bafb2ec535", "comment": "Malware payload", "value": "ef2898023a19dbff0aa676a5a7767c8b8dd80752772cf219a51bfca50647deb9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824509, "uuid": "b9d32eb6-6fe3-4ad6-9d82-eb4c73b612a6", "comment": "Malware payload", "value": "f6295cde02e999c5cc79ea4f38dfb500adaae5ee", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774824509, "uuid": "947a020b-057c-4edf-af30-d6f7e86a715e", "comment": "Malware payload", "value": "32b5d67fcc9fb468801cef3dca45c71f7f3881aa5b9a28ec5569e3559e62c49551190ef67c9506bcf74a3dfe21a85c70", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824509, "uuid": "db2ff406-55a0-408f-b2ae-93836add404c", "value": "T1223633B6304C3CEEFFF315F69C076D61B64AEA487D65ADD240B686BE9048786473B900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824509, "uuid": "94005402-b98e-4bde-aabc-1828c21e6bff", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824509, "uuid": "ae1e2f00-e64f-431f-a12c-4c77867c32f7", "value": "98304:d1FCgf6maRBoIrXZWyMPtgnwdTRorflWYmIN8wANP79tlrWB52lPYHPz0f8UkA8L:RCsdajrXZWPtZtRorlnkNPRrq521YHPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774824509, "uuid": "67949b41-2dd9-444f-99cf-b7861c9dfee3", "value": 5218816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774824509, "uuid": "f855239c-a261-4527-b4c6-b2e68e793b44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774824509, "uuid": "9642f5b7-94b0-464d-8e30-17b3a46cab60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ec3c4c-2b8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774802085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774802085, "uuid": "c7690b7c-134d-4ab9-aa96-8209086ab30e", "comment": "Malware payload", "value": "5b7d5771652e40ab5f55d842744bea65", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774802085, "uuid": "9965bf08-4af7-4baa-9b01-bf11b31e704b", "comment": "Malware payload", "value": "ef445860925f2ecf57c9c7efd95ced20a1b56f61defb7ae770389fd9257f5075", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774802085, "uuid": "c0eca3a1-a952-400b-89ef-066f17a42ac2", "comment": "Malware payload", "value": "7780275e49bfce1b79c827df40ab7add17d590d9", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774802085, "uuid": "2e6980df-2bfa-413e-ab04-604332b84680", "comment": "Malware payload", "value": "98afd39026c935c32b1ad8fcef32b20a442f49ee2a443d4b62592aacae0b6319595f0057bdebc6c03101cabde321a13e", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774802085, "uuid": "b5ddd65c-f8d5-4f1d-9f97-d8217de69642", "value": "T16012D78119F30A31C9A395B68BFB9206215FB79331D1DDD83A8C95044F8D0748BB9EAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774802085, "uuid": "1af47d27-7480-4051-b7a5-b40b8ea7131d", "value": "192:4LZ9+BwtCSZ2Srkz0w6k1J1+E/bjpOa+yIZNkw:4z+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774802085, "uuid": "f209f83a-8990-440d-9940-0c274d8aeadd", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774802085, "uuid": "6514ddad-428a-47ee-ba91-4a9586d3aff1", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774802085, "uuid": "00b94652-3871-42a9-96d4-0d54b9239bbe", "value": "_ef445860925f2ecf57c9c7efd95ced20a1b56f61defb7ae770389fd9257f5075.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622a6522-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774825359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825359, "uuid": "1662dc14-246e-435b-beb8-b6a02fda17d3", "comment": "Malware payload (Gafgyt)", "value": "a8b99bd48f14add4b53eec8b635c2aca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825359, "uuid": "9acb3ab5-8459-4294-98a7-69de0ee83af9", "comment": "Malware payload (Gafgyt)", "value": "f3416c68120458b92d4fda0a058ed05864123192d84e5a8fe1b8719991665329", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825359, "uuid": "bbbfbf12-d55a-436c-94b3-42a2c6c69554", "comment": "Malware payload (Gafgyt)", "value": "58c08f28f002bfc3d959ca368f7309ffe6ca8a67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825359, "uuid": "a596db05-cd31-443a-a9d7-8e75d17e153b", "comment": "Malware payload (Gafgyt)", "value": "b36d6a0d4557b6c2e39c6a00b5973e67ad5c3ec6ad85201e99e36469b704154f2ae632a0a352b557960b22eb892f605b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825359, "uuid": "b84b525d-da5e-42f4-ad9d-8d41a80614dd", "value": "T1CB734A47AD629FB7C146AAB525A759300713B8215F0F2B89713DAAF8430F8CDB80F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825359, "uuid": "febbaa30-595d-4525-ba13-483aec014c0b", "value": "1536:kAmbedEfIKy1BABWWNxiEVN/CP3yvt1cMmj9VqYLe8f26e:v+eefvyoWWF/A3ovmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825359, "uuid": "c3528b89-d330-4c65-960f-d1e5464053bf", "value": 77749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825359, "uuid": "6f732126-a12a-406f-9c83-f088c9003d39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825359, "uuid": "16dba389-4114-4704-9de0-b29f6967a7a8", "value": "s-h.4-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d839e231-2b73-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774791197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774791197, "uuid": "d64becf5-7df9-4ea4-8fc3-8cebe395b31b", "comment": "Malware payload (LummaStealer)", "value": "c6428bd8e282deb61157b23a7c55754f", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774791197, "uuid": "d1e2a4d0-8ca2-4531-ad71-625278fcd09e", "comment": "Malware payload (LummaStealer)", "value": "f729d53ce638fd57c0a25523e880b039eb3e1aa5af3f3d7f312c815b79d16465", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774791197, "uuid": "a2111d23-6400-40ec-9cab-58ca11f429b5", "comment": "Malware payload (LummaStealer)", "value": "c9f2fc6d19595ba18c7f7e9fdf9d77c69448eb86", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774791197, "uuid": "ae4beba6-8df8-4bcb-808a-e36d46860b6c", "comment": "Malware payload (LummaStealer)", "value": "d626f4e66c25a39508c450f6de490ef9b15983add3eac06f7904f1ca047f68f2c1e4790032880ecafcaa7703260ce661", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774791197, "uuid": "10c338f7-d000-4627-8f8f-787019cdbcb2", "value": "T142755A41ED8789B6E012133299AB52FF3735AC094F329AD3EA447B3AF9775D11832316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774791197, "uuid": "249c7388-205c-4f2d-bd89-05ea3c7ae031", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774791197, "uuid": "284e4e44-327d-4460-ba3a-360c63b149b9", "value": "24576:lyQ+bIGSlwVIg/LetD9eKKTiWuOqHmHAA8Rz2aNLlK21i7GDYEIJIT+Vqb3cuVtF:lDCPAgKKu15K21aGYEIJTkbsuab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774791197, "uuid": "d04829b5-bd17-4df5-b774-e062a0fc7822", "value": 1646592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774791197, "uuid": "7de0abc0-b6b7-47f2-a95a-8d5d1b0e906c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774791197, "uuid": "c6d069a6-c4d8-4b53-a633-cc50c54315f3", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956dd6ba-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774825445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825445, "uuid": "a6da5302-5bfd-4d68-972f-8dc5207374a8", "comment": "Malware payload (Mirai)", "value": "da88640488af499cf06528e03a32fed7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825445, "uuid": "fc7beda7-05fb-4848-b352-622e543b8f20", "comment": "Malware payload (Mirai)", "value": "f7da18f061001d1db8fcd458154aaef8312fe61e235dbb05ac85193c6a6e9e4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825445, "uuid": "0047bace-c21d-4c87-9ce1-ea9e81df4968", "comment": "Malware payload (Mirai)", "value": "2f7a7dd9386d85ebb73a6aa329efb901564b37be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825445, "uuid": "13b12990-15f9-45f0-9656-36a8de2303c0", "comment": "Malware payload (Mirai)", "value": "c4aa02ccef5bef3c5d6dd02041998e80f465954d267f57c357e872d789614f5c7067ad7e477ae938f80c640bcd12e06d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825445, "uuid": "f1a79030-5ac4-4c7e-ab53-4d96cc386afb", "value": "T15EE33C46EA414B13C4D6177ABAEF42453323A764D3DB33059928BFB43F8279E4E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825445, "uuid": "c0693973-8a32-41fc-b841-75e4b14ff306", "value": "3072:9rVkSCDKKCaOkYZdTyCKppSESnYruPIWq/rUM/95CR0jt:9rVyCaOTZdTyCapEn0uAWq/gM/95njt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825445, "uuid": "0327249f-52e2-40dd-94cd-fc033bc10f06", "value": 155862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825445, "uuid": "a937e8e0-2f08-49ce-94ce-99c6599a5c19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825445, "uuid": "8da71022-d45a-428a-a3e3-796b93ae94be", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "529b638f-2bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774825332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825332, "uuid": "199ed0ae-563d-426a-884d-ce3644a1ee7b", "comment": "Malware payload (Gafgyt)", "value": "32465b34a321141b044e12a90a76e508", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825332, "uuid": "4e1d6289-94f1-4be2-8b05-781e726a64a5", "comment": "Malware payload (Gafgyt)", "value": "f8a3602dfcad45d46d1e66d7b81cd7c08e860a095ad475136ec8836808a5a33b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825332, "uuid": "b249d769-0219-489b-9725-e767c6425f52", "comment": "Malware payload (Gafgyt)", "value": "61e215275a4408d76012f2e0e8aebfc3f7616bdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774825332, "uuid": "f575408b-a94e-4aad-a281-ce3c8386f1cb", "comment": "Malware payload (Gafgyt)", "value": "912651a996a7b731b4b6d9e00a8f8899a5a27781250dd2ab7fc394dbded8c9b75d3efd7e86e4e5a76e75b450c9daa4c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825332, "uuid": "ef62df42-3a25-4580-afcd-d48de54d598b", "value": "T173B32901D5508B67C2D2277AF79F825D37332BA8979B33125A24BFB42BC278D1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825332, "uuid": "5ab7dd4f-9683-4728-95eb-dedb18392d71", "value": "3072:b6an17WtsWhdgYJh0DvRWXbmTQOWsXAOn:Wan17WPJh0DGbmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774825332, "uuid": "beebe5c6-8d11-4ed5-907d-9f7efec8e43f", "value": 111508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774825332, "uuid": "146c0dde-ebd4-4919-ab23-cbd0e72f616b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774825332, "uuid": "aa813747-ba3a-4cc5-bceb-f9a4b258b3c2", "value": "a-r.m-6.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bb1868-2b1d-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774754120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754120, "uuid": "afb3b0e3-f4ed-4a09-a6a7-45fe3afe676d", "comment": "Malware payload (ValleyRAT)", "value": "ad9d305a6987dfd8790f4bab9efc53a4", "object_relation": "md5", "Tag": [ { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754120, "uuid": "6e75243f-71e9-4651-b566-b244ed5b183d", "comment": "Malware payload (ValleyRAT)", "value": "f9e8d4097c3a8f4cdb1ce70ead16f7443e37139a708675eec7f07b15cb8d5af1", "object_relation": "sha256", "Tag": [ { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754120, "uuid": "bc119103-7d2d-4d50-8e8c-6e0668641b3d", "comment": "Malware payload (ValleyRAT)", "value": "193eb1589f832ad6423363548d9107d5813bd6f9", "object_relation": "sha1", "Tag": [ { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754120, "uuid": "f78a166d-415e-455f-9733-afda1b7d1036", "comment": "Malware payload (ValleyRAT)", "value": "58b9d335c8cd31fa258b92f392558fed4cad6778d7d13b3262223fab66f126b3fa1295b8b28f6a5d4455c36c8d691284", "object_relation": "sha3-384", "Tag": [ { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754120, "uuid": "aabcd846-a6dc-4b78-898d-4b67e6aca0cc", "value": "T1CDA633872833720FF486C9FBABD168B41077E9A79912176E7F7133546AF307A821D261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754120, "uuid": "24908be6-3e3c-4e89-ae84-6cd3e8625134", "value": "196608:MOMZ2/JZLjrNoMLKmJu/4CQs/Y8xfT810c23Ohzl7tL3VFQPRRTGQs:MOG2/rLjxoQKmE0o1w1/ak3fyrGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774754120, "uuid": "239047e9-eb0c-47c9-a2a8-b4b788612904", "value": 9807277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774754120, "uuid": "4151ea21-f07f-4486-bd4b-5275209a096b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754120, "uuid": "d4287c2e-ebf5-4cd8-affd-f8c40076ac51", "value": "\u4e09\u89d2\u6d32\u63a5\u89e6\u9ad8\u5371\u795e\u5668\u6d4b\u8bd5\u7248.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27596a9-2ba9-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774814353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814353, "uuid": "d7e7927d-fc87-4790-a564-aa80eafa98f1", "comment": "Malware payload (SalatStealer)", "value": "497b1251a28b4195ba74ceb0df7dc4df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814353, "uuid": "da13ffdd-9b8a-448e-90cc-5d19bf29b6da", "comment": "Malware payload (SalatStealer)", "value": "fa90e90a74b458b0b51940de6da9e61093db92aab2ccdc648341c1ee5ab2a149", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814353, "uuid": "afe2bade-2c8d-4322-9f3d-f2aa707ed649", "comment": "Malware payload (SalatStealer)", "value": "3e325b7967151a61a70d12958201e805f713b3a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774814353, "uuid": "8a143747-472f-4101-81b4-3937c8fa5e92", "comment": "Malware payload (SalatStealer)", "value": "7f3b3eabbd756f6893c9595b1b1dcf7c86c579cb90fa86902f1d5ea28b0148ef536dedfec5cce44c2d9f7741f83b5957", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814353, "uuid": "35075f05-42c6-41d0-96b7-ac8bb723f1ce", "value": "T1F4D65C01FE8B54F6E903693151AF723F33305D048B28DB9BEB487A6AF877691187A705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814353, "uuid": "eca707f7-7c3e-4a0a-990d-743b6472bc35", "value": "49152:OUhCcswGERdRHZlSHh3rgyBG0lS5/LqVoXgXiXwNdKMRmXLT6Rp0oZ8pWQHoOS5V:dCdw9SHJU4GV5IuqmqQO3j4pyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774814353, "uuid": "ed1ba98a-e1b0-483b-913c-edb0db830cf8", "value": 12921344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774814353, "uuid": "9af551c4-7bcc-40c2-b34a-d4ec15219c3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774814353, "uuid": "ae9efcb3-c946-4ca5-87e3-64651f2129ff", "value": "cpiyogn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a45c66d-2b1f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774754774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754774, "uuid": "048fdce2-33c8-4a0f-9960-8190d99184a9", "comment": "Malware payload", "value": "d2dc1747970c16d8121ea1bc090e4ff4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754774, "uuid": "fe664834-0eb6-431d-b5f0-e926fbb03d46", "comment": "Malware payload", "value": "fb6cf30a77f8bc43cbdb4a8361b964a4d768784e58bd74aa50c47ac30bf9ec1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754774, "uuid": "f6cdd412-716c-40b6-b618-0b133b475479", "comment": "Malware payload", "value": "7b6c5334d4391fbe8e1fad54ba99878f6aee621b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774754774, "uuid": "6af6ea58-281b-458d-a611-48bbc780f64f", "comment": "Malware payload", "value": "53aa72caf56f95ab34a00d00a75517dd5ac051e905c2da6bbb801d2cccb57c0a2790ed6853957eba101698a3ea7100d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754774, "uuid": "1a1a53d0-cdb9-4fbc-82b7-af58419e4219", "value": "T136B5D022B9418077E2A30231997D5B759AADBE30273540DBB3D43E2D1DB04D2FA39B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754774, "uuid": "f0b26083-6cea-41aa-ab6a-9da1a4935c07", "value": "496d06c4281a615c2ec24a661294cd13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754774, "uuid": "c3db9853-2541-43db-a7b6-0c0a0a2fcbf5", "value": "49152:G9D9rO5CcRxgsBGRnEbeMie6St6RwLTUO2wW5LjkBIbm8ZsN:0D9rO5CcfO7MixTqPY3+iY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774754774, "uuid": "2c9953ad-ecc5-48e5-bdfe-9e0a8dec4c32", "value": 2460744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774754774, "uuid": "37304a52-1911-474b-9c7a-c5b183709fc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774754774, "uuid": "1d3c7f6d-92a1-4d95-bd7c-406425eea103", "value": "2025-08-10_d2dc1747970c16d8121ea1bc090e4ff4_black-basta_darkgate_elex_hijackloader_luca-stealer_mespinoza.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6bc309-2ba5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774812409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774812409, "uuid": "19ca17dc-7536-4fa0-b43c-df9a00352ee9", "comment": "Malware payload", "value": "a2ad8160d0c945f72102d668a844e2a2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774812409, "uuid": "7fca8374-69e2-45b8-bd13-e0c5b4de265e", "comment": "Malware payload", "value": "fc803f15ac92a8d7642999722ade1a02cfe8c9529ec593bd1c8d0cd366e6ebb5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774812409, "uuid": "b924cc9a-c084-4d39-9bd8-b924f7e80778", "comment": "Malware payload", "value": "68947c34f83d3115cf5937fc1c851c3aebd7731f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774812409, "uuid": "004c25c2-282f-4034-88bd-1362645b28f2", "comment": "Malware payload", "value": "1ec0cbc9d098f30d5c2963f90c289013a7e19651f8c1877faaeb3ee2b2ea914aa4322e3b4ba41c315b1c1ab0b234b131", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774812409, "uuid": "d38e98a2-7bf9-4b6f-abd6-16d6b9fb7e7c", "value": "T1B317E007EC9515E9C4AAE234CA229253BA71BC495B3173D72B90F7382F77BD06A79700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774812409, "uuid": "05eb61a2-4bd4-4f80-a465-38ce987bc4f9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774812409, "uuid": "f26fad24-0130-4263-a43d-f431d31d826a", "value": "393216:XeNSr1gYSV7kmj5g/1gzUT5y93UQTtQVvrL934MKibL:XuU1qnz2fCtQVvrLaMKWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774812409, "uuid": "48fecac3-0e10-469e-9993-e5ade3f074d4", "value": 19400192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774812409, "uuid": "fe19c930-a0ac-4c88-b174-55b1ed93b9ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774812409, "uuid": "1dffe6fe-577b-4da9-ac10-bf48c1b15ca2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0202a243-2bc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774823909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823909, "uuid": "18d1fad6-9b25-4293-a032-66a915c24790", "comment": "Malware payload (Mirai)", "value": "220c2fb05e9fac2f7c861d9532c6384f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823909, "uuid": "16dd43d2-3f58-4ff2-8764-e543b5f1dfba", "comment": "Malware payload (Mirai)", "value": "fe2515a83fa2a5b58e000e434557fdf6a68bde3aeba4feb3be3ec7e93979882d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823909, "uuid": "bad128a3-a76c-43fc-ab6b-01409b870e93", "comment": "Malware payload (Mirai)", "value": "766ed412cfcc27480a025eb1e887fa52b9531b9f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774823909, "uuid": "d91b8c42-adce-4641-948a-a41108cce80a", "comment": "Malware payload (Mirai)", "value": "a57da9a2de4bcb70b94d2032e116a19c43a9b266594b1abe9360b5fdaa16780359ff9e94479c5fc54b1fb2749a2851d7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823909, "uuid": "4dbf44c7-a873-4593-9dba-efa6c3013032", "value": "T1BAD49D5277F11271D640923686A2D760B617E7A278E4034BDFA04EEFEFA31650E84CF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823909, "uuid": "0f7dac3d-0179-4fd1-b802-b73c38d7b2f1", "value": "12288:1Kwo8cgFaI2LObGuhe6LYmhj5696GBZ5lrCE6:14gPbGJ6nV54DC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774823909, "uuid": "8b305dd1-c324-427b-a0cc-eb15caf60b24", "value": 639864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774823909, "uuid": "a14d6cbc-3e31-4943-b865-8a632cf12c30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774823909, "uuid": "c5290a0e-a5df-4f96-8660-7138fb446bbe", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399368ec-2b1d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774753994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774753994, "uuid": "a1c8cef0-215a-43cb-a271-53969dc686e9", "comment": "Malware payload", "value": "a6a5a8473858b8cbdef37d4be463ca34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774753994, "uuid": "8b1c7f11-cd2b-41c2-9913-f1fc41cafb77", "comment": "Malware payload", "value": "ff5c4049c0e75a90d7d594e3fcbbe20746a882388508b92bc9170a081b0091b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774753994, "uuid": "d33ec05c-faf7-4da4-89a5-12061f5fbfef", "comment": "Malware payload", "value": "35c3582d3badf847ba775169742b43ed53fea7ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774753994, "uuid": "c0c6dc9d-798a-4ef0-abe8-14f49d472714", "comment": "Malware payload", "value": "030f028ce28f77d282c6a577e008bdf0dcca8879af49988fc9207c161f2082178e70e0c8cfa410e83f3d26f9a1b54ac4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774753994, "uuid": "0666afef-4b32-47f0-882c-a3c4c6bb15c2", "value": "T13B44B15332988523D26B5674577781A0C3EEECC26821F6FB6C8F7ABA257F670011067E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774753994, "uuid": "62933a96-ab5b-41d5-87da-2a0dd11dfc3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774753994, "uuid": "4034fcb7-f276-47c8-b6c6-678b8df38c9e", "value": "3072:wAT65wV1QP05VFt/FMaIyEzE090HbJekvkF23P88RaF23P88RgoE090XaD:wATRVVFt9kzE09YbJZsWPKWPHE097D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774753994, "uuid": "ef970c9d-9805-402d-809a-72c268403043", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774753994, "uuid": "191e955b-ae82-4137-af63-d8c29ffb9a41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774753994, "uuid": "3ee3562e-bb83-4473-ac38-1356e8f0020d", "value": "MonkeModManager.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }